diff --git a/.buildinfo b/.buildinfo
new file mode 100644
index 000000000..fa6fedd17
--- /dev/null
+++ b/.buildinfo
@@ -0,0 +1,4 @@
+# Sphinx build info version 1
+# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
+config: 3ad445e9e2766700709bd1b5cedfac5e
+tags: 645f666f9bcd5a90fca523b33c5a78b7
diff --git a/.nojekyll b/.nojekyll
new file mode 100644
index 000000000..e69de29bb
diff --git a/_images/group_roles.png b/_images/group_roles.png
new file mode 100644
index 000000000..f8c176d22
Binary files /dev/null and b/_images/group_roles.png differ
diff --git a/_images/groups.png b/_images/groups.png
new file mode 100644
index 000000000..7e630da45
Binary files /dev/null and b/_images/groups.png differ
diff --git a/_images/locked_session.png b/_images/locked_session.png
new file mode 100644
index 000000000..104c5bf50
Binary files /dev/null and b/_images/locked_session.png differ
diff --git a/_images/putty1.png b/_images/putty1.png
new file mode 100644
index 000000000..b107bf2db
Binary files /dev/null and b/_images/putty1.png differ
diff --git a/_images/putty10.png b/_images/putty10.png
new file mode 100644
index 000000000..ebfd243e0
Binary files /dev/null and b/_images/putty10.png differ
diff --git a/_images/putty2.png b/_images/putty2.png
new file mode 100644
index 000000000..73f4c51b0
Binary files /dev/null and b/_images/putty2.png differ
diff --git a/_images/putty3.png b/_images/putty3.png
new file mode 100644
index 000000000..dbdbb6d79
Binary files /dev/null and b/_images/putty3.png differ
diff --git a/_images/putty4.png b/_images/putty4.png
new file mode 100644
index 000000000..68ee93e06
Binary files /dev/null and b/_images/putty4.png differ
diff --git a/_images/putty5.png b/_images/putty5.png
new file mode 100644
index 000000000..56b25d143
Binary files /dev/null and b/_images/putty5.png differ
diff --git a/_images/putty6.png b/_images/putty6.png
new file mode 100644
index 000000000..f0b333c79
Binary files /dev/null and b/_images/putty6.png differ
diff --git a/_images/putty7.png b/_images/putty7.png
new file mode 100644
index 000000000..a685172fe
Binary files /dev/null and b/_images/putty7.png differ
diff --git a/_images/putty8.png b/_images/putty8.png
new file mode 100644
index 000000000..81a61100c
Binary files /dev/null and b/_images/putty8.png differ
diff --git a/_images/putty9.png b/_images/putty9.png
new file mode 100644
index 000000000..491fa9bbe
Binary files /dev/null and b/_images/putty9.png differ
diff --git a/_sources/administration/configuration/bastion_conf.rst.txt b/_sources/administration/configuration/bastion_conf.rst.txt
new file mode 100644
index 000000000..c1bc1550d
--- /dev/null
+++ b/_sources/administration/configuration/bastion_conf.rst.txt
@@ -0,0 +1,1042 @@
+============
+bastion.conf
+============
+
+ .. note::
+
+   The Bastion has a lot of configuration options so that you can tailor it
+   to your needs. However, if you're just beggining and would like to get
+   started quickly, just configure the ``Main Options``.
+   All the other options have sane defaults that can still be customized
+   at a later time.
+
+Option List
+===========
+
+Main Options options
+--------------------
+
+Those are the options you should customize when first setting up a bastion. All the other options have sane defaults and can be customized later if needed.
+
+- `bastionName`_
+- `bastionCommand`_
+- `readOnlySlaveMode`_
+- `adminAccounts`_
+- `superOwnerAccounts`_
+
+SSH Policies options
+--------------------
+
+All the options related to the SSH configuration and policies, both for ingress and egress connections.
+
+- `allowedIngressSshAlgorithms`_
+- `allowedEgressSshAlgorithms`_
+- `minimumIngressRsaKeySize`_
+- `maximumIngressRsaKeySize`_
+- `minimumEgressRsaKeySize`_
+- `maximumEgressRsaKeySize`_
+- `defaultAccountEgressKeyAlgorithm`_
+- `defaultAccountEgressKeySize`_
+- `moshAllowed`_
+- `moshTimeoutNetwork`_
+- `moshTimeoutSignal`_
+- `moshCommandLine`_
+
+Global network policies options
+-------------------------------
+
+Those options can set a few global network policies to be applied bastion-wide.
+
+- `dnsSupportLevel`_
+- `allowedNetworks`_
+- `forbiddenNetworks`_
+- `ingressToEgressRules`_
+
+Logging options
+---------------
+
+Options to customize how logs should be produced.
+
+- `enableSyslog`_
+- `syslogFacility`_
+- `syslogDescription`_
+- `enableGlobalAccessLog`_
+- `enableAccountAccessLog`_
+- `enableGlobalSqlLog`_
+- `enableAccountSqlLog`_
+- `ttyrecFilenameFormat`_
+- `ttyrecAdditionalParameters`_
+- `ttyrecStealthStdoutPattern`_
+
+Other ingress policies options
+------------------------------
+
+Policies applying to the ingress connections
+
+- `ingressKeysFrom`_
+- `ingressKeysFromAllowOverride`_
+
+Other egress policies options
+-----------------------------
+
+Policies applying to the egress connections
+
+- `defaultLogin`_
+- `egressKeysFrom`_
+- `keyboardInteractiveAllowed`_
+- `passwordAllowed`_
+- `telnetAllowed`_
+
+Session policies options
+------------------------
+
+Options to customize the established sessions behaviour
+
+- `displayLastLogin`_
+- `fanciness`_
+- `interactiveModeAllowed`_
+- `interactiveModeTimeout`_
+- `interactiveModeByDefault`_
+- `interactiveModeProactiveMFAenabled`_
+- `interactiveModeProactiveMFAexpiration`_
+- `idleLockTimeout`_
+- `idleKillTimeout`_
+- `warnBeforeLockSeconds`_
+- `warnBeforeKillSeconds`_
+- `accountExternalValidationProgram`_
+- `accountExternalValidationDenyOnFailure`_
+- `alwaysActiveAccounts`_
+
+Account policies options
+------------------------
+
+Policies applying to the bastion accounts themselves
+
+- `accountMaxInactiveDays`_
+- `accountExpiredMessage`_
+- `accountCreateSupplementaryGroups`_
+- `accountCreateDefaultPersonalAccesses`_
+- `ingressRequirePIV`_
+- `accountMFAPolicy`_
+- `MFAPasswordMinDays`_
+- `MFAPasswordMaxDays`_
+- `MFAPasswordWarnDays`_
+- `MFAPasswordInactiveDays`_
+- `MFAPostCommand`_
+- `TOTPProvider`_
+
+Other options options
+---------------------
+
+These options are either discouraged (in which case this is explained in the description) or rarely need to be modified.
+
+- `accountUidMin`_
+- `accountUidMax`_
+- `ttyrecGroupIdOffset`_
+- `documentationURL`_
+- `debug`_
+- `remoteCommandEscapeByDefault`_
+- `sshClientDebugLevel`_
+- `sshClientHasOptionE`_
+
+Option Reference
+================
+
+Main Options
+------------
+
+.. _bastionName:
+
+bastionName
+***********
+
+:Type: ``string``
+
+:Default: ``"fix-my-config-please-missing-bastion-name"``
+
+This will be the name advertised in the aliases admins will give to bastion users, and also in the banner of the plugins output. You can see it as a friendly name everybody will use to refer to this machine: something more friendly than just its full hostname.
+
+.. _bastionCommand:
+
+bastionCommand
+**************
+
+:Type: ``string``
+
+:Default: ``"ssh USER@HOSTNAME -t --"``
+
+The ``ssh`` command to launch to connect to this bastion as a user. This will be printed on ``accountCreate``, so that the new user knows how to connect. Magic tokens are:
+
+- ACCOUNT or USER: replaced at runtime by the account name
+- BASTIONNAME: replaced at runtime by the name defined in ``bastionName``
+- HOSTNAME: replaced at runtime by the hostname of the system
+
+So, for example if your specify ``ssh USER@HOSTNAME -t --``, it'll give ``johndoe@bastion1.example.org -t --`` as a bastion alias to *johndoe*
+
+.. _readOnlySlaveMode:
+
+readOnlySlaveMode
+*****************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+If set to ``false``, this bastion will work in standalone mode, or will be the master in a master/slave mode. If set to ``true``, this'll be the slave which means all plugins that modify groups, accounts, or access rights will be disabled, and the master bastion will push its modifications using inotify/rsync, please refer do the documentation to set this up.
+
+.. _adminAccounts:
+
+adminAccounts
+*************
+
+:Type: ``array of strings (account names)``
+
+:Default: ``[]``
+
+The list of accounts that are Admins of the bastion. Admins can't be deleted or otherwise modified by non-admins. They also gain access to special dangerous/sensitive ``--osh`` commands, such as being able to impersonate anybody else. Note that an Admin is also always considered as a Super Owner, which means they also override all checks of group administrative commands. Don't forget to add them to the ``osh-admin`` group too (system-wise), or they won't really be considered as Admins: this is an additional security measure against privilege escalation. Rule of thumb: it's probably a good idea to only add here people that have ``root`` access to the bastion machine itself.
+
+.. _superOwnerAccounts:
+
+superOwnerAccounts
+******************
+
+:Type: ``array of strings (account names)``
+
+:Default: ``[]``
+
+The list of accounts that are "Super Owners". They can run all group administrative commands, exactly as if they were implicitly owners of all the groups. Super Owners are only here as a last resort when the owners/gatekeepers/aclkeepers of a group are not available. Every command run by a Super Owner that would have failed if the account was not a Super Owner is logged explicitly as "Super Owner Override", you might want to add a rule for those in your SIEM. You can consider than the Super Owners have an implicit *sudo* for group management. Don't add here accounts that are bastion Admins, as they already inherit the Super Owner role. Don't forget to add them to the ``osh-superowner`` group too (system-wise), or they won't really be considered as "Super Owners": this is an additional security measure against privilege escalation.
+
+SSH Policies
+------------
+
+.. _allowedIngressSshAlgorithms:
+
+allowedIngressSshAlgorithms
+***************************
+
+:Type: ``array of strings (algorithm names)``
+
+:Default: ``[ "rsa", "ecdsa", "ed25519" ]``
+
+The algorithms authorized for ingress ssh public keys added to this bastion. Possible values: ``rsa``, ``ecdsa``, ``ed25519``, ``ecdsa-sk``, ``ed25519-sk``, note that some of those might not be supported by your current version of ``OpenSSH``: unsupported algorithms are automatically omitted at runtime.
+
+.. _allowedEgressSshAlgorithms:
+
+allowedEgressSshAlgorithms
+**************************
+
+:Type: ``array of strings (algorithm names)``
+
+:Default: ``[ "rsa", "ecdsa", "ed25519" ]``
+
+The algorithms authorized for egress ssh public keys generated on this bastion. Possible values: ``rsa``, ``ecdsa``, ``ed25519``, note that some of those might not be supported by your current version of ``OpenSSH``, unsupported algorithms are automatically omitted at runtime.
+
+.. _minimumIngressRsaKeySize:
+
+minimumIngressRsaKeySize
+************************
+
+:Type: ``int > 0``
+
+:Default: ``2048``
+
+The minimum allowed size for ingress RSA keys (user->bastion). Sane values range from 2048 to 4096.
+
+.. _maximumIngressRsaKeySize:
+
+maximumIngressRsaKeySize
+************************
+
+:Type: ``int > 0``
+
+:Default: ``8192``
+
+The maximum allowed size for ingress RSA keys (user->bastion). Too big values (>8192) are extremely CPU intensive and don't really add that much security.
+
+.. _minimumEgressRsaKeySize:
+
+minimumEgressRsaKeySize
+***********************
+
+:Type: ``int > 0``
+
+:Default: ``2048``
+
+The minimum allowed size for egress RSA keys (bastion->server). Sane values range from 2048 to 4096.
+
+.. _maximumEgressRsaKeySize:
+
+maximumEgressRsaKeySize
+***********************
+
+:Type: ``int > 0``
+
+:Default: ``8192``
+
+The maximum allowed size for ingress RSA keys (bastion->server). Too big values (>8192) are extremely CPU intensive and don't really add that much security.
+
+.. _defaultAccountEgressKeyAlgorithm:
+
+defaultAccountEgressKeyAlgorithm
+********************************
+
+:Type: ``string``
+
+:Default: ``"rsa"``
+
+The default algorithm to use to create the egress key of a newly created account
+
+.. _defaultAccountEgressKeySize:
+
+defaultAccountEgressKeySize
+***************************
+
+:Type: ``int > 0``
+
+:Default: ``4096``
+
+The default size to use to create the egress key of a newly created account (also see ``defaultAccountEgressKeyAlgorithm``)
+
+.. _moshAllowed:
+
+moshAllowed
+***********
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+If set to ``true``, mosh usage is allowed (mosh needs to be installed on serverside, obviously). Otherwise, this feature is disabled.
+
+.. _moshTimeoutNetwork:
+
+moshTimeoutNetwork
+******************
+
+:Type: ``int > 0``
+
+:Default: ``86400``
+
+Number of seconds of inactivity (network-wise) after a mosh-server will exit. By design even if the client is disconnected "for good", mosh-server would wait forever. If mosh is meant to handle shaky connections but not mobility, you can set this to a low value. It sets the ``MOSH_SERVER_NETWORK_TMOUT`` envvar for mosh, see ``man mosh-server`` for more information (mosh 1.2.6+).
+
+.. _moshTimeoutSignal:
+
+moshTimeoutSignal
+*****************
+
+:Type: ``int > 0``
+
+:Default: ``30``
+
+Number of seconds of inactivity (network-wise) a mosh-server will wait after receiving a ``SIGUSR1`` before exiting. It sets the ``MOSH_SERVER_SIGNAL_TMOUT`` envvar for mosh, see ``man mosh-server`` for more information (mosh 1.2.6+).
+
+.. _moshCommandLine:
+
+moshCommandLine
+***************
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"-s -p 40000:49999"``
+
+Additional parameters that will be passed as-is to mosh-server. See ``man mosh-server``, you should at least add the ``-p`` option to specify a fixed number of ports (easier for firewall configuration).
+
+Global network policies
+-----------------------
+
+.. _dnsSupportLevel:
+
+dnsSupportLevel
+***************
+
+:Type: ``integer between 0 and 2``
+
+:Default: ``2``
+
+If set to 0, The Bastion will never attempt to do DNS or reverse-DNS resolutions, and return an error if you request connection to a hostname instead of an IP. Use this if you know there's no working DNS in your environment and only use IPs everywhere.
+ If set to 1, The Bastion will not attempt to do DNS or reverse-DNS resolutions unless you force it to (i.e. by requesting connection to a hostname instead of an IP). You may use this if for example you have well-known hostnames in /etc/hosts, but don't have a working DNS (which would imply that reverse-DNS resolutions will always fail).
+ If set to 2, The Bastion will make the assumption that you have a working DNS setup, and will do DNS and reverse-DNS resolutions normally.
+
+.. _allowedNetworks:
+
+allowedNetworks
+***************
+
+:Type: ``array of strings (IPs and/or prefixes)``
+
+:Default: ``[]``
+
+:Example: ``["10.42.0.0/16","192.168.111.0/24","203.0.113.42"]``
+
+Restricts egress connection attempts to those listed networks only. This is enforced at all times and can NOT be overridden by users. If you are lucky enough to have you own IP blocks, it's probably a good idea to list them here. An empty array means no restriction is applied.
+
+.. _forbiddenNetworks:
+
+forbiddenNetworks
+*****************
+
+:Type: ``array of strings (IPs and/or prefixes)``
+
+:Default: ``[]``
+
+:Example: ``["10.42.42.0/24"]``
+
+Prevents egress connection to the listed networks, this takes precedence over ``allowedNetworks``. This can be used to prevent connection to some hosts or subnets in a broadly allowed prefix. This is enforced at all times and can NOT be overridden by users.
+
+.. _ingressToEgressRules:
+
+ingressToEgressRules
+********************
+
+:Type: ``array of rules, a rule being a 3-uple of [array, array, string]``
+
+:Default: ``[]``
+
+Fine-grained rules (a la *netfilter*) to apply global restrictions to possible egress destinations given ingress IPs. This is similar to ``allowedNetworks`` and ``forbiddenNetworks``, but way more powerful (in fact, those two previous options can be expressed exclusively using ``ingressToEgressRules``). Those rules here are enforced at all times and can **NOT** be overridden by users or admins.
+Each rule will be processed **IN ORDER**. The first rule to match will be applied and no other rule will be checked.
+If no rule matches, the default is to apply no restriction.
+A rule is a 3-uple of [``array of ingress networks``, ``array of egress networks``, ``policy to apply``].
+
+- ``array of ingress networks``: if the IP of the ingress connection matches a network or IP in this list, the rule *may* apply: we proceed to check the egress network IP
+- ``array of egress networks``: if the IP of the egress connection matches a network or IP in this list, the rule *does* apply and we'll enforce the policy defined in the third item of the rule
+- ``policy to apply``: this is what to enforce when the ingress and egress network match
+
+The "policy to apply" item can have 3 values:
+
+- ``ALLOW``, no restriction will be applied (all rights-check of groups and personal accesses still apply)
+- ``DENY``, access will be denied regardless of any group or personal accesses
+- ``ALLOW-EXCLUSIVE``, access will be allowed **if and only if** the egress network match, given the ingress network. In other words, if the ingress IP matches one of the ingress networks specified in the rule, but the egress IP **DOES NOT** match any of the egress network specified, access will be denied. This is an easy way to ensure that a given list of ingress networks can only access a precise list of egress networks and nothing else.
+
+For example, take the following configuration:
+
+::
+
+   [
+      [["10.19.0.0/16","10.15.15.0/24"], ["10.20.0.0/16"],    "ALLOW-EXCLUSIVE"],
+      [["192.168.42.0/24"],              ["192.168.42.0/24"], "ALLOW"],
+      [["192.168.0.0/16"],               ["192.168.0.0/16"],  "DENY"]
+   ]
+
+- The ``10.19.0.0/16`` and ``10.15.15.0/24`` networks can only access the ``10.20.0.0/16`` network (rule ``#1``)
+- The ``192.168.42.0/24`` network can access any machine from its own /24 network (rule ``#2``), but not any other machine from the wider ``192.168.0.0/16`` network (rule ``#3``). It can however access any other machine outside of this block (implicit allow catch-all rule, as there is no corresponding ``DENY`` rule, and rule ``#2`` is ``ALLOW`` and not ``ALLOW-EXCLUSIVE``)
+- The ``192.168.0.0/16`` network (except ``192.168.42.0/16``) can access any machine except one from its own network (rule ``#3``)
+- All the other networks can access any other network (including egress ``10.20.0.0/16`` or egress ``192.168.0.0/16``)
+
+In any case, all the personal and group accesses still apply in addition to these global rules.
+
+Logging
+-------
+
+.. _enableSyslog:
+
+enableSyslog
+************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If enabled, we'll send logs through syslog, don't forget to setup your syslog daemon!. You can also adjust ``syslogFacility`` and ``syslogDescription`` below, to match your syslog configuration. Note that the provided ``syslog-ng`` templates work with the default values left as-is.
+
+.. _syslogFacility:
+
+syslogFacility
+**************
+
+:Type: ``string``
+
+:Default: ``"local7"``
+
+Sets the facility that will be used for syslog.
+
+.. _syslogDescription:
+
+syslogDescription
+*****************
+
+:Type: ``string``
+
+:Default: ``"bastion"``
+
+Sets the description that will be used for syslog.
+
+.. _enableGlobalAccessLog:
+
+enableGlobalAccessLog
+*********************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If enabled, all *open* and *close* logs will be written to ``/home/logkeeper/global-log-YYYYMM.log``. Those are also logged through syslog if *enableSyslog* is set.
+
+.. _enableAccountAccessLog:
+
+enableAccountAccessLog
+**********************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If enabled, all *open* and *close* logs will be written to the corresponding user's home in ``/home/USER/USER-log-YYYYMM.log``. Those are also logged through syslog if *enableSyslog* is set.
+
+.. _enableGlobalSqlLog:
+
+enableGlobalSqlLog
+******************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If enabled, all access logs (corresponding to the *open* and *close* events) will be written in a short SQL format, as one row per access, to ``/home/logkeeper/global-log-YYYYMM.sqlite``.
+
+.. _enableAccountSqlLog:
+
+enableAccountSqlLog
+*******************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If enabled, all access logs (corresponding to the *open* and *close* events) will be written in a detailed SQL format, as one row per access, in the corresponding user's home to ``/home/USER/USER-log-YYYYMM.sqlite``. If you want to use ``selfListSessions`` and/or ``selfPlaySession``, this is required.
+
+.. _ttyrecFilenameFormat:
+
+ttyrecFilenameFormat
+********************
+
+:Type: ``string``
+
+:Default: ``"%Y-%m-%d.%H-%M-%S.#usec#.&uniqid.&account.&user.&ip.&port.ttyrec"``
+
+Sets the filename format of the output files of ttyrec for a given session. Magic tokens are: ``&bastionname``, ``&uniqid``, ``&account``, ``&ip``, ``&port``, ``&user`` (they'll be replaced by the corresponding values of the current session). Then, this string (automatically prepended with the correct folder) will be passed to ttyrec's ``-F`` parameter, which uses ``strftime()`` to expand it, so the usual character conversions will be done (``%Y`` for the year, ``%H`` for the hour, etc., see ``man strftime``). Note that in a addition to the usual ``strftime()`` conversion specifications, ttyrec also supports ``#usec#``, to be replaced by the current microsecond value of the time.
+
+.. _ttyrecAdditionalParameters:
+
+ttyrecAdditionalParameters
+**************************
+
+:Type: ``array of strings``
+
+:Default: ``[]``
+
+:Example: ``["-s", "This is a message with spaces", "--zstd"]``
+
+Additional parameters you want to pass to ``ttyrec`` invocation. Useful, for example, to enable on-the-fly compression, disable cheatcodes, or set/unset any other ``ttyrec`` option. This is an ARRAY, not a string.
+
+.. _ttyrecStealthStdoutPattern:
+
+ttyrecStealthStdoutPattern
+**************************
+
+:Type: ``regex``
+
+:Default: ``""``
+
+:Example: ``"^rsync --server .+"``
+
+When this is set to a non-falsy value, this is expected to be a string that will be converted to a regex which will be matched against a potential remote command specified when connecting through SSH to a remote server. If the regex matches, then we'll instruct ttyrec to NOT record stdout for this session.
+
+Other ingress policies
+----------------------
+
+.. _ingressKeysFrom:
+
+ingressKeysFrom
+***************
+
+:Type: ``array of strings (list of IPs and/or prefixes)``
+
+:Default: ``[]``
+
+This array of IPs (or prefixes, such as ``10.20.30.0/24``) will be used to build the ``from="..."`` in front of the ingress account public keys used to connect to the bastion (in ``accountCreate`` or ``selfAddIngressKey``). If the array is empty, then **NO** ``from="..."`` is added (this lowers the security).
+
+.. _ingressKeysFromAllowOverride:
+
+ingressKeysFromAllowOverride
+****************************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+If set to ``false``, any user-specified ``from="..."`` prefix on keys in commands such as ``selfAddIngressKey`` or ``accountCreate`` are silently ignored and replaced by the IPs in the ``ingressKeysFrom`` configuration option (if any).
+If set to ``true``, any user-specified ``from="..."`` will override the value set in ``ingressKeysFrom`` (if any).
+Note that when no user-specified ``from="..."`` appears, the value of ``ingressKeysFrom`` is still used, regardless of this option.
+
+Other egress policies
+---------------------
+
+.. _defaultLogin:
+
+defaultLogin
+************
+
+:Type: ``string``
+
+:Default: ``""``
+
+The default remote user to use for egress ssh connections where no user has been specified by our caller. If set to the empty string (``""``), will default to the account name of the caller. If your bastion is mainly used to connect as ``root`` on remote systems, you might want to set this to ``root`` for example, to spare a few keystrokes to your users. This is only used when no user is specified on the connection line. For example if your bastion alias is ``bssh``, and you say ``bssh srv1.example.net``, the value of the ``defaultLogin`` value will be used as the user to login as remotely.
+
+.. _egressKeysFrom:
+
+egressKeysFrom
+**************
+
+:Type: ``array of strings (IPs and/or prefixes)``
+
+:Default: ``[]``
+
+These IPs will be added to the ``from="..."`` of the personal account keys and the group keys. Typically you want to specify only the bastions IP here (including all the slaves). Note that if this option is NOT set at all or set to the empty array, it will default to autodetection at runtime (using ``hostname --all-ip-addresses`` under the hood). This is dependent from your system configuration and is therefore discouraged.
+
+.. _keyboardInteractiveAllowed:
+
+keyboardInteractiveAllowed
+**************************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If set to ``true``, will allow keyboard-interactive authentication when publickey auth is requested for egress connections, this is needed e.g. for 2FA.
+
+.. _passwordAllowed:
+
+passwordAllowed
+***************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+If set to ``true``, will allow password authentication for egress ssh, so that user can type his remote password interactively.
+
+.. _telnetAllowed:
+
+telnetAllowed
+*************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+If set to ``true``, will allow telnet egress connections (``-e`` / ``--telnet``).
+
+Session policies
+----------------
+
+.. _displayLastLogin:
+
+displayLastLogin
+****************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If ``true``, display their last login information on connection to your users.
+
+.. _fanciness:
+
+fanciness
+*********
+
+:Type: ``string``
+
+:Default: ``full``
+
+Customize to which extent the text output by the program will use decorations to enhance human-friendliness and highlight warnings or critical messages. Note that if a given session's terminal doesn't advertise UTF-8 support, UTF-8 will not be used, regardless of what is set here.
+
+- "none": Text will only consist of us-ascii characters
+- "basic": UTF-8 characters will be used to draw tables, instead of ---'s, among other things
+- "full": Some emoticons may appear to highlight important messages
+
+.. _interactiveModeAllowed:
+
+interactiveModeAllowed
+**********************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If set to ``true``, ``--interactive`` mode is allowed. Otherwise, this feature is disabled.
+
+.. _interactiveModeTimeout:
+
+interactiveModeTimeout
+**********************
+
+:Type: ``int >= 0 (seconds)``
+
+:Default: ``60``
+
+The number of idle seconds after which the user is disconnected from the bastion when in interactive mode. A value of 0 will disable this feature (user will never be disconnected for idle timeout).
+
+.. _interactiveModeByDefault:
+
+interactiveModeByDefault
+************************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If ``true``, drops the user to interactive mode if nothing is specified on the command line. If ``false``, displays the help and exits with an error. Note that for ``true`` to have the expected effect, interactive mode must be enabled (see the ``interactiveModeAllowed`` option above).
+
+.. _interactiveModeProactiveMFAenabled:
+
+interactiveModeProactiveMFAenabled
+**********************************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If enabled, the ``mfa`` command is allowed in interactive mode, to trigger a proactive MFA challenge, so that subsequent commands normally requiring MFA won't ask for it again.
+
+.. _interactiveModeProactiveMFAexpiration:
+
+interactiveModeProactiveMFAexpiration
+*************************************
+
+:Type: ``int >= 0 (seconds)``
+
+:Default: ``900``
+
+If the above ``interactiveModeProactiveMFAenabled`` option is ``true``, then this is the amount of seconds after which the proactive MFA mode is automatically disengaged.
+
+.. _idleLockTimeout:
+
+idleLockTimeout
+***************
+
+:Type: ``int >= 0 (seconds)``
+
+:Default: ``0``
+
+If set to a positive value >0, the number of seconds of input idle time after which the session is locked. If ``false``, disabled.
+
+.. _idleKillTimeout:
+
+idleKillTimeout
+***************
+
+:Type: ``int >= 0 (seconds)``
+
+:Default: ``0``
+
+If set to a positive value >0, the number of seconds of input idle time after which the session is killed. If ``false``, disabled. If ``idleLockTimeout`` is set, this value must be higher (obviously).
+
+.. _warnBeforeLockSeconds:
+
+warnBeforeLockSeconds
+*********************
+
+:Type: ``int >= 0 (seconds)``
+
+:Default: ``0``
+
+If set to a positive value >0, the number of seconds before ``idleLockTimeout`` where the user will receive a warning message telling them about the upcoming lock of his session. Don't enable this (by setting a non-zero value) if `idleLockTimeout` is disabled (set to zero).
+
+.. _warnBeforeKillSeconds:
+
+warnBeforeKillSeconds
+*********************
+
+:Type: ``int >= 0 (seconds)``
+
+:Default: ``0``
+
+If set to a positive value >0, the number of seconds before ``idleKillTimeout`` where the user will receive a warning message telling them about the upcoming kill of his session. Don't enable this (by setting a non-zero value) if `idleKillTimeout` is disabled (set to zero).
+
+.. _accountExternalValidationProgram:
+
+accountExternalValidationProgram
+********************************
+
+:Type: ``string (path to a binary)``
+
+:Default: ``""``
+
+:Example: ``"$BASEDIR/bin/other/check-active-account-simple.pl"``
+
+Binary or script that will be called by the bastion, with the account name in parameter, to check whether this account should be allowed to connect to the bastion. If empty, this check is skipped. ``$BASEDIR`` is a magic token that is replaced by where the bastion code lives (usually, ``/opt/bastion``).
+
+You can use this configuration parameter to counter-verify all accounts against an external system, for example an *LDAP*, an *Active Directory*, or any system having a list of identities, right when they're connecting to the bastion (on the ingress side). However, it is advised to avoid calling an external system in the flow of an incoming connection, as this violates the "the bastion must be working at all times, regardless of the status of the other components of the company's infrastructure" rule. Instead, you should have a cronjob to periodically fetch all the allowed accounts from said external system, and store this list somewhere on the bastion, then write a simple script that will be called by the bastion to verify whether the connecting account is present on this locally cached list.
+
+An account present in this list is called an *active account*, in the bastion's jargon. An *inactive* account is an account existing on the bastion, but not in this list, and won't be able to connect. Note that for security reasons, inactive bastions administrators would be denied as any other account.
+
+The result is interpreted from the program's exit code. If the program return 0, the account is deemed active. If the program returns 1, the account is deemed inactive. A return code of 2, 3 or 4 indicates a failure of the program in determining the activeness of the account. In this case, the decision to allow or deny the access is determined by the ``accountExternalValidationDenyOnFailure`` option below. Status code 3 additionally logs the ``stderr`` of the program *silently* to the syslog: this can be used to warn admins of a problem without leaking information to the user. Status code 4 does the same, but the ``stderr`` is also shown directly to the user. Any other return code deems the account inactive (same behavior that return code 1).
+
+.. _accountExternalValidationDenyOnFailure:
+
+accountExternalValidationDenyOnFailure
+**************************************
+
+:Type: ``boolean``
+
+:Default: ``true``
+
+If we can't validate an account using the program configured in ``accountExternalValidationProgram``, for example because the path doesn't exist, the file is not executable, or because the program returns the exit code 4 (see above for more information), this configuration option indicates whether we should deny or allow access.
+
+Note that the bastion admins will always be allowed if the ``accountExternalValidationProgram`` doesn't work correctly, because they're expected to be able to fix it. They would be denied, as any other account, if ``accountExternalValidationProgram`` works correctly and denies them access, however. If you're still testing your account validation procedure, and don't want to break your users workflow while you're not 100% sure it works correctly, you can say ``false`` here, and return 4 instead of 1 in your ``accountExternalValidationProgram`` when you would want to deny access.
+
+.. _alwaysActiveAccounts:
+
+alwaysActiveAccounts
+********************
+
+:Type: ``array of strings (account names)``
+
+:Default: ``[]``
+
+List of accounts which should NOT be checked against the ``accountExternalValidationProgram`` mechanism above (for example bot accounts). This can also be set per-account at account creation time or later with the ``accountModify`` plugin's ``--always-active`` flag.
+
+Account policies
+----------------
+
+.. _accountMaxInactiveDays:
+
+accountMaxInactiveDays
+**********************
+
+:Type: ``int >= 0 (days)``
+
+:Default: ``0``
+
+If > 0, deny access to accounts that didn't log in since at least that many days. A value of 0 means that this functionality is disabled (we will never deny access for inactivity reasons).
+
+.. _accountExpiredMessage:
+
+accountExpiredMessage
+*********************
+
+:Type: ``string``
+
+:Default: ``""``
+
+If non-empty, customizes the message that will be printed to a user attempting to connect with an expired account (see ``accountMaxInactiveDays`` above). When empty, defaults to the standard message "Sorry, but your account has expired (#DAYS# days), access denied by policy.". The special token ``#DAYS#`` is replaced by the number of days since we've last seen this user.
+
+.. _accountCreateSupplementaryGroups:
+
+accountCreateSupplementaryGroups
+********************************
+
+:Type: ``array of strings (system group names)``
+
+:Default: ``[]``
+
+List of system groups to add a new account to when its created (see ``accountCreate``). Can be useful to grant some restricted commands by default to new accounts. For example ``osh-selfAddPersonalAccess``, ``osh-selfDelPersonalAccess``, etc. Note that the group here are **NOT** *bastion groups*, but system groups.
+
+.. _accountCreateDefaultPersonalAccesses:
+
+accountCreateDefaultPersonalAccesses
+************************************
+
+:Type: ``array of strings (list of IPs and/or prefixes)``
+
+:Default: ``[]``
+
+List of strings of the form USER@IP or USER@IP:PORT or IP or IP:PORT, with IP being IP or prefix (such as 1.2.3.0/24). This is the list of accesses to add to the personal access list of newly created accounts. The special value ACCOUNT is replaced by the name of the account being created. This can be useful to grant some accesses by default to new accounts (for example ACCOUNT@0.0.0.0/0)
+
+.. _ingressRequirePIV:
+
+ingressRequirePIV
+*****************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+When set to true, only PIV-enabled SSH keys will be able to be added with selfAddIngressKey, hence ensuring that an SSH key generated on a computer, and not within a PIV-compatible hardware token, can't be used to access The Bastion. If you only want to enable this on a per-account basis, leave this to false and set the flag on said accounts using accountPIV instead. When set to false, will not require PIV-enabled SSH keys to be added by selfAddIngressKey. If you have no idea what PIV keys are, leave this to false, this is what you want.
+
+.. _accountMFAPolicy:
+
+accountMFAPolicy
+****************
+
+:Type: ``string``
+
+:Default: ``"enabled"``
+
+Set a MFA policy for the bastion accounts, the supported values are:
+
+- ``disabled``: the commands to setup TOTP and UNIX account password are disabled, nobody can setup MFA for themselves or others. Already configured MFA still applies, unless the sshd configuration is modified to no longer call PAM on the authentication phase
+- ``password-required``: for all accounts, a UNIX account password is required in addition to the ingress SSH public key. On first connection with his SSH key, the user is forced to setup a password for his account, and can't disable it afterwards
+- ``totp-required``: for all accounts, a TOTP is required in addition to the ingress SSH public key. On first connection with his SSH key, the user is forced to setup a TOTP for his account, and can't disable it afterwards
+- ``any-required``: for all accounts, either a TOTP or an UNIX account password is required in addition to the ingress SSH public key. On first connection with his SSH key, the user is forced to setup either of those, as he sees fit, and can't disable it afterwards
+- ``enabled``: for all accounts, TOTP and UNIX account password are available as opt-in features as the users see fit. Some accounts can be forced to setup either TOTP or password-based MFA if they're flagged accordingly (with the accountModify command)
+
+
+.. _MFAPasswordMinDays:
+
+MFAPasswordMinDays
+******************
+
+:Type: ``int >= 0 (days)``
+
+:Default: ``0``
+
+For the PAM UNIX password MFA, sets the min amount of days between two password changes (see ``chage -m``)
+
+.. _MFAPasswordMaxDays:
+
+MFAPasswordMaxDays
+******************
+
+:Type: ``int >= 0 (days)``
+
+:Default: ``90``
+
+For the PAM UNIX password MFA, sets the max amount of days after which the password must be changed (see ``chage -M``)
+
+.. _MFAPasswordWarnDays:
+
+MFAPasswordWarnDays
+*******************
+
+:Type: ``int >= 0 (days)``
+
+:Default: ``15``
+
+For the PAM UNIX password MFA, sets the number of days before expiration on which the user will be warned to change his password (see ``chage -W``)
+
+.. _MFAPasswordInactiveDays:
+
+MFAPasswordInactiveDays
+***********************
+
+:Type: ``int >= -1 (days)``
+
+:Default: ``-1``
+
+For the PAM UNIX password MFA, the account will be blocked after the password is expired (and not renewed) for this amount of days (see ``chage -E``). -1 disables this feature. Note that this is different from the ``accountMaxInactiveDays`` option above, that is handled by the bastion software itself instead of PAM
+
+.. _MFAPostCommand:
+
+MFAPostCommand
+**************
+
+:Type: ``array of strings (a valid system command)``
+
+:Default: ``[]``
+
+:Example: ``["sudo","-n","-u","root","--","/sbin/pam_tally2","-u","%ACCOUNT%","-r"] or ["/usr/sbin/faillock","--reset"]``
+
+When using JIT MFA (i.e. not directly by calling PAM from SSHD's configuration, but using ``pamtester`` from within the code), execute this command on success.
+This can be used for example if you're using ``pam_tally2`` or ``pam_faillock`` in your PAM MFA configuration, ``pamtester`` can't reset the counter to zero because this is usually done in the ``account_mgmt`` PAM phase. You can use a script to reset it here.
+The magic token ``%ACCOUNT%`` will be replaced by the account name.
+Note that usually, ``pam_tally2`` can only be used by root (hence might require the proper sudoers configuration), while ``faillock`` can directly be used by unprivileged users to reset their counter.
+
+.. _TOTPProvider:
+
+TOTPProvider
+************
+
+:Type: ``string``
+
+:Default: ``'google-authenticator'``
+
+Defines which is the provider of the TOTP MFA, that will be used for the ``(self|account)MFA(Setup|Reset)TOTP`` commands. Allowed values are:
+- none: no TOTP providers are defined, the corresponding setup commands won't be available.
+- google-authenticator: the pam_google_authenticator.so module will be used, along with its corresponding setup binary. This is the default, for backward compatibility reasons. This is also what is configured in the provided pam templates.
+- duo: enable the use of the Duo PAM module (pam_duo.so), of course you need to set it up correctly in your `/etc/pam.d/sshd` file.
+
+Other options
+-------------
+
+.. _accountUidMin:
+
+accountUidMin
+*************
+
+:Type: ``int >= 100``
+
+:Default: ``2000``
+
+Minimum allowed UID for accounts on this bastion. Hardcoded > 100 even if configured for less.
+
+.. _accountUidMax:
+
+accountUidMax
+*************
+
+:Type: ``int > 0``
+
+:Default: ``99999``
+
+Maximum allowed UID for accounts on this bastion.
+
+.. _ttyrecGroupIdOffset:
+
+ttyrecGroupIdOffset
+*******************
+
+:Type: ``int > 0``
+
+:Default: ``100000``
+
+Offset to apply on user group uid to create its ``-tty`` group, should be > ``accountUidMax - accountUidMin`` to ensure there is no overlap.
+
+.. _documentationURL:
+
+documentationURL
+****************
+
+:Type: ``string``
+
+:Default: ``"https://ovh.github.io/the-bastion/"``
+
+The URL of the documentation where users will be pointed to, for example when displaying help. If you have some internal documentation about the bastion, you might want to advertise it here.
+
+.. _debug:
+
+debug
+*****
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+Enables or disables debug *GLOBALLY*, printing a lot of information to anyone using the bastion. Don't enable this unless you're chasing a bug in the code and are familiar with it.
+
+.. _remoteCommandEscapeByDefault:
+
+remoteCommandEscapeByDefault
+****************************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+If set to ``false``, will not escape simple quotes in remote commands by default. Don't enable this, this is to keep compatibility with an ancient broken behavior. Will be removed in the future. Can be overridden at runtime with ``--never-escape`` and ``--always-escape``.
+
+.. _sshClientDebugLevel:
+
+sshClientDebugLevel
+*******************
+
+:Type: ``int (0-3)``
+
+:Default: ``0``
+
+Indicates the number of ``-v``'s that will be added to the ssh client command line when starting a session. Probably a bad idea unless you want to annoy your users.
+
+.. _sshClientHasOptionE:
+
+sshClientHasOptionE
+*******************
+
+:Type: ``boolean``
+
+:Default: ``false``
+
+Set to ``true`` if your ssh client supports the ``-E`` option and you want to use it to log debug info on opened sessions. **Discouraged** because it has some annoying side effects (some ssh errors then go silent from the user perspective).
+
diff --git a/_sources/administration/configuration/index.rst.txt b/_sources/administration/configuration/index.rst.txt
new file mode 100644
index 000000000..235ebe250
--- /dev/null
+++ b/_sources/administration/configuration/index.rst.txt
@@ -0,0 +1,36 @@
+===================
+Configuration files
+===================
+
+Main configuration files
+========================
+
+These config files should be reviewed and adapted for the environment in which
+you're deploying The Bastion. The doc:`bastion_conf` is the only one that is
+mandatory to get you started. You should however review the other ones before
+going into production.
+
+.. toctree::
+   :maxdepth: 1
+
+   bastion_conf
+   osh-backup-acl-keys_conf
+   osh-encrypt-rsync_conf
+   osh-sync-watcher_sh
+   osh-http-proxy_conf
+
+Configuration files for satellite scripts
+=========================================
+
+These config files govern the behavior of satellite scripts that handle
+background tasks of The Bastion. Most of the time, there is no need to alter
+the configuration as sane defaults are already built in.
+
+.. toctree::
+   :maxdepth: 1
+
+   osh-piv-grace-reaper_conf
+   osh-remove-empty-folders_conf
+   osh-cleanup-guest-key-access_conf
+   osh-lingering-sessions-reaper_conf
+   osh-orphaned-homedir_conf
diff --git a/_sources/administration/configuration/osh-backup-acl-keys_conf.rst.txt b/_sources/administration/configuration/osh-backup-acl-keys_conf.rst.txt
new file mode 100644
index 000000000..720b257b9
--- /dev/null
+++ b/_sources/administration/configuration/osh-backup-acl-keys_conf.rst.txt
@@ -0,0 +1,183 @@
+========================
+osh-backup-acl-keys.conf
+========================
+
+ .. note::
+
+    This script is called by cron and is responsible
+    for backing up the bastion configuration, users & groups lists,
+    credentials, and everything needed to be able to restore a functioning
+    bastion from scratch.
+
+ .. warning::
+
+    If left unconfigured, this script won't do anything,
+    and you won't have backups, unless this task is handled by
+    some other external system.
+
+Option List
+===========
+
+Logging & activation options
+----------------------------
+
+Script logging configuration and script activation
+
+- `LOGFILE`_
+- `LOG_FACILITY`_
+- `ENABLED`_
+
+Backup policy options
+---------------------
+
+These options configure the backup policy to apply
+
+- `DESTDIR`_
+- `DAYSTOKEEP`_
+
+Encryption and signing options
+------------------------------
+
+These options configure how the script uses GPG to encrypt and sign the ttyrec files
+
+- `GPGKEYS`_
+- `SIGNING_KEY`_
+- `SIGNING_KEY_PASSPHRASE`_
+
+Remote backup options
+---------------------
+
+These options configure how the script should push the encrypted backups to a remote system
+
+- `PUSH_REMOTE`_
+- `PUSH_OPTIONS`_
+
+Option Reference
+================
+
+Logging & activation
+--------------------
+
+LOGFILE
+*******
+
+:Type: ``string, path to a file``
+
+:Default: ``""``
+
+File where the logs will be written to (don't forget to configure ``logrotate``!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.
+
+LOG_FACILITY
+************
+
+:Type: ``string``
+
+:Default: ``"local6"``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+ENABLED
+*******
+
+:Type: ``0 or 1``
+
+:Default: ``1``
+
+If set to 1, the script is enabled and will run when started by crond.
+
+Backup policy
+-------------
+
+DESTDIR
+*******
+
+:Type: ``path to a folder``
+
+:Default: ``""``
+
+:Example: ``"/root/backups"``
+
+Folder where to put the backup artefacts (``.tar.gz`` files).
+This folder will be created if needed. If empty or omitted,
+the script won't run: this option is mandatory.
+
+DAYSTOKEEP
+**********
+
+:Type: ``int > 0``
+
+:Default: ``90``
+
+Number of days to keep the old backups on the filesystem before deleting them.
+
+Encryption and signing
+----------------------
+
+GPGKEYS
+*******
+
+:Type: ``string, space-separated list of GPG keys IDs``
+
+:Default: ``""``
+
+:Example: ``"41FDB9C7 DA97EFD1 339483FF"``
+
+List of public GPG keys to encrypt to (see ``gpg --list-keys``), these must be separated by spaces.
+Note that if this option is empty or omitted, backup artefacts will NOT be encrypted!
+
+SIGNING_KEY
+***********
+
+:Type: ``string, GPG key ID in short or long format``
+
+:Default: ``(none)``
+
+ID of the GPG key used to sign the ttyrec files.
+The key must be in the local root keyring, check it with ``gpg --list-secret-keys``.
+If empty, the archives will not be signed, but encrypted only (using the GPGKEYS configuration above).
+
+SIGNING_KEY_PASSPHRASE
+**********************
+
+:Type: ``string``
+
+:Default: ``(none)``
+
+This passphrase should be able to unlock the SIGNING_KEY defined above.
+Please ensure this configuration file only readable by root (0640), to protect this passphrase.
+As a security measure, the script will refuse to read the configuration otherwise.
+
+Remote backup
+-------------
+
+PUSH_REMOTE
+***********
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"push@192.0.2.4:~/backup/"``
+
+The ``scp`` remote host push backups to. If empty or missing, won't push backups.
+This will also be the case if the ``GPGKEYS`` option above is empty or missing,
+because we will never push unencrypted backups.
+Don't forget to put a trailing ``/`` (except if you want to push to the remote ``$HOME``,
+in which case ending with a simple ``:`` works, as per standard ``scp``).
+
+PUSH_OPTIONS
+************
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"-i $HOME/.ssh/id_backup"``
+
+Additional options to pass to ``scp``, if needed.
+
diff --git a/_sources/administration/configuration/osh-cleanup-guest-key-access_conf.rst.txt b/_sources/administration/configuration/osh-cleanup-guest-key-access_conf.rst.txt
new file mode 100644
index 000000000..b4cb7d3bb
--- /dev/null
+++ b/_sources/administration/configuration/osh-cleanup-guest-key-access_conf.rst.txt
@@ -0,0 +1,51 @@
+=================================
+osh-cleanup-guest-key-access.conf
+=================================
+
+ .. note::
+
+   This script is called by cron and is responsible for cleaning up dangling
+   accesses to group keys for group guests that no longer have access to any
+   server of the group. This happens when the last access a guest have on a
+   group has a TTL, and this TTL expires.
+   This is a basic background task of The Bastion, hence there is not much
+   to configure. You can still disable this script below, if needs be.
+
+Option List
+===========
+
+Logging & activation options
+----------------------------
+
+Script logging configuration and script activation
+
+- `syslog_facility`_
+- `enabled`_
+
+Option Reference
+================
+
+Logging & activation
+--------------------
+
+syslog_facility
+***************
+
+:Type: ``string``
+
+:Default: ``local6``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+enabled
+*******
+
+:Type: ``bool``
+
+:Default: ``true``
+
+If not set to `true` (or a true value), the script will not run.
+
diff --git a/_sources/administration/configuration/osh-encrypt-rsync_conf.rst.txt b/_sources/administration/configuration/osh-encrypt-rsync_conf.rst.txt
new file mode 100644
index 000000000..0cfdd311e
--- /dev/null
+++ b/_sources/administration/configuration/osh-encrypt-rsync_conf.rst.txt
@@ -0,0 +1,243 @@
+======================
+osh-encrypt-rsync.conf
+======================
+
+.. note::
+
+   The osh-encrypt-rsync script is called by cron and is responsible for encrypting
+   and optionally pushing the recorded ``ttyrec`` files to a distant server, along
+   with the user logs (``/home/*/*.log``) and user sqlite files (``/home/*/*.sqlite``).
+   The global log and sqlite files are also handled (located in ``/home/logkeeper/``).
+   Note that logs sent through syslog are NOT managed by this script.
+
+.. warning::
+
+   If left unconfigured, this script won't do anything, and the recorded ``ttyrec`` files,
+   along with the log and sqlite files won't be encrypted or moved out from the server.
+   This might not be a problem for low-traffic bastions or if you have plenty of storage available, though.
+
+Option List
+===========
+
+Logging options
+---------------
+
+These options configure the way the script logs its actions
+
+- `logfile`_
+- `syslog_facility`_
+- `verbose`_
+
+Encryption and signing options
+------------------------------
+
+These options configure how the script uses GPG to encrypt and sign the ttyrec files
+
+- `signing_key`_
+- `signing_key_passphrase`_
+- `recipients`_
+- `encrypt_and_move_to_directory`_
+- `encrypt_and_move_ttyrec_delay_days`_
+- `encrypt_and_move_user_logs_delay_days`_
+- `encrypt_and_move_user_sqlites_delay_days`_
+
+Push files to a remote destination options
+------------------------------------------
+
+These options configure the way the script uses rsync to optionally push the encrypted files out of the server
+
+- `rsync_destination`_
+- `rsync_rsh`_
+- `rsync_delay_before_remove_days`_
+
+Option Reference
+================
+
+Logging
+-------
+
+logfile
+*******
+
+:Type: ``string, path to a file``
+
+:Default: ``""``
+
+File where the logs will be written to (don't forget to configure ``logrotate``!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.
+
+syslog_facility
+***************
+
+:Type: ``string``
+
+:Default: ``"local6"``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+verbose
+*******
+
+:Type: ``int >= 0``
+
+:Default: ``0``
+
+The verbosity level of the logs produced by the script
+0: normal (default)
+1: log more information about what is happening
+2: log debug-level information
+
+Encryption and signing
+----------------------
+
+signing_key
+***********
+
+:Type: ``string, GPG key ID in short or long format``
+
+:Default: ``(none), setting a value is mandatory``
+
+ID of the GPG key used to sign the ttyrec files.
+The key must be in the local root keyring, check it with ``gpg --list-secret-keys``
+
+signing_key_passphrase
+**********************
+
+:Type: ``string``
+
+:Default: ``(none), setting a value is mandatory``
+
+This passphrase should be able to unlock the ``signing_key`` defined above.
+As a side note, please ensure this configuration file only readable by root (0640),
+to protect this passphrase. As a security measure,
+the script will refuse to read the configuration otherwise.
+
+recipients
+**********
+
+:Type: ``array of array of strings, a string being a GPG key ID in short or long format``
+
+:Default: ``(none), setting a value is mandatory``
+
+The ttyrecs will be encrypted with those GPG keys, possibly using multi-layer GPG encryption.
+Each sub-array is a layer, the first sub-array being the first encryption layer (which is also the last one for decryption)
+To completely decrypt a ttyrec, one would need at least one key of each layer.
+To encrypt only to a single layer and to only one key, simply use [ [ "KEYID" ] ].
+To encrypt to a single layer but with 3 keys being able to decrypt the ttyrec, use [ [ "KEY1", "KEY2", "KEY3" ] ], etc.
+A common use of multi-layer encryption is to have the first layer composed of the auditors' GPG keys, and
+the second layer composed of the sysadmins' GPG keys. During an audit, the sysadmins would get the ttyrec encrypted file,
+decrypt the second encryption layer (the first for decryption), and handle the now only auditor-protected file to the auditors.
+All public keys must be in the local root keyring (gpg --list-keys).
+Don't forget to trust those keys "ultimately" in root's keyring, too (gpg --edit-key ID)
+
+encrypt_and_move_to_directory
+*****************************
+
+:Type: ``string, a valid directory name``
+
+:Default: ``"/home/.encrypt"``
+
+After encryption (and compression), move ttyrec, user sqlite and user log files to subdirs of this directory.
+It'll be created if it doesn't exist yet.
+You may want this directory to be the mount point of a remote filer, if you wish.
+If you change this, it's probably a good idea to ensure that the path is excluded from the
+master/slave synchronization, in ``/etc/bastion/osh-sync-watcher.rsyncfilter``.
+This is already the case for the default value.
+
+encrypt_and_move_ttyrec_delay_days
+**********************************
+
+:Type: ``int > 0, or -1``
+
+:Default: ``14``
+
+Don't touch ttyrec files that have a modification time more recent than this amount of days.
+The files won't be encrypted nor moved yet, and will still be readable by the ``selfPlaySession`` command.
+You can set this to a (possibly) much higher value, the only limit is the amount of disk space you have.
+If set to -1, the ttyrec files will never get encrypted or moved by this script.
+The eligible files will be encrypted and moved to ``encrypt_and_move_to_directory``.
+NOTE: The old name of this option is `encrypt_and_move_delay_days`.
+If it is found in your configuration file and `encrypt_and_move_ttyrec_delay_days` is not,
+then the value of `encrypt_and_move_delay_days` will be used instead of the default.
+
+encrypt_and_move_user_logs_delay_days
+*************************************
+
+:Type: ``int >= 31, or -1``
+
+:Default: ``31``
+
+Don't touch user log files (``/home/*/*.log``) that have been modified more recently than this amount of days.
+The bare minimum is 31 days, to ensure we're not moving a current-month file.
+You can set this to a (possibly) much higher value, the only limit is the amount of disk space you have.
+If set to -1, the user log files will never get encrypted or moved by this script.
+The eligible files will be encrypted and moved to ``encrypt_and_move_to_directory``.
+
+encrypt_and_move_user_sqlites_delay_days
+****************************************
+
+:Type: ``int >= 31, or -1``
+
+:Default: ``31``
+
+Don't touch user sqlite files (``/home/*/*.sqlite``) that have been modified more recently than this amount of days.
+The files won't be encrypted nor moved yet, and will still be usable by the ``selfListSessions`` command.
+The bare minimum is 31 days, to ensure we're not moving a current-month file.
+You can set this to a (possibly) much higher value, the only limit is the amount of disk space you have.
+If set to -1, the user sqlite files will never get encrypted or moved by this script.
+The eligible files will be encrypted and moved to ``encrypt_and_move_to_directory``.
+
+Push files to a remote destination
+----------------------------------
+
+rsync_destination
+*****************
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"user@remotebackup.example.org:/remote/dir"``
+
+The value of this option will be passed to ``rsync`` as the destination.
+Note that the source of the rsync is already configured above, as the ``encrypt_and_move_to_directory``.
+We only rsync the files that have already been encrypted and moved there.
+If this option is empty, this will **disable** ``rsync``, meaning that the ttyrec files will be encrypted,
+but not moved out of the server. In other words, the files will pile up in ``encrypt_and_move_to_directory``,
+which can be pretty okay in you have enough disk space.
+
+rsync_rsh
+*********
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"ssh -p 222 -i /root/.ssh/id_ed25519_backup"``
+
+The value of this option will be passed to ``rsync``'s ``--rsh`` option.
+This is useful to specify an SSH key or an alternate SSH port for example.
+This option is ignored when ``rsync`` is disabled (i.e. when ``rsync_destination`` is empty).
+
+rsync_delay_before_remove_days
+******************************
+
+:Type: ``int >= 0, or -1``
+
+:Default: ``0``
+
+After encryption/compression, and successful rsync of ``encrypt_and_move_to_directory`` to remote,
+wait for this amount of days before removing the encrypted/compressed files locally.
+Specify 0 to remove the files as soon as they're transferred.
+This option is ignored when ``rsync`` is disabled (i.e. when ``rsync_destination`` is empty).
+Note that if rsync is enabled (see ``rsync_destination`` above), we'll always sync the files present in
+``encrypt_and_move_to_directory`` as soon as we can, to ensure limitation of logs data loss in case of
+catastrophic failure of the server. The ``rsync_delay_before_remove_days`` option configures the number
+of days after we remove the files locally, but note that these have already been transferred remotely
+as soon as they were present in ``encrypt_and_move_to_directory``.
+To rsync the files remotely but never delete them locally, set this to -1.
+
diff --git a/_sources/administration/configuration/osh-http-proxy_conf.rst.txt b/_sources/administration/configuration/osh-http-proxy_conf.rst.txt
new file mode 100644
index 000000000..6dbac531e
--- /dev/null
+++ b/_sources/administration/configuration/osh-http-proxy_conf.rst.txt
@@ -0,0 +1,178 @@
+===================
+osh-http-proxy.conf
+===================
+
+ .. note::
+
+    This module is optional, and disabled by default.
+    To know more about the HTTP Proxy feature of The Bastion,
+    please check the :doc:`/using/http_proxy` section
+
+Option List
+===========
+
+HTTP Proxy configuration options
+--------------------------------
+
+These options modify the behavior of the HTTP Proxy, an optional module of The Bastion
+
+- `enabled`_
+- `port`_
+- `ssl_certificate`_
+- `ssl_key`_
+- `ciphers`_
+- `insecure`_
+- `min_servers`_
+- `max_servers`_
+- `min_spare_servers`_
+- `max_spare_servers`_
+- `timeout`_
+- `log_request_response`_
+- `log_request_response_max_size`_
+
+Option Reference
+================
+
+HTTP Proxy configuration
+------------------------
+
+enabled
+*******
+
+:Type: ``bool``
+
+:Default: ``false``
+
+Whether the HTTP proxy daemon daemon is enabled or not. If it's not enabled, it'll exit when started.
+Of course, if you want to enable this daemon, you should **also** configure your init system to start it
+for you. Both sysV-style scripts and systemd unit files are provided.
+For systemd, using `systemctl enable osh-http-proxy.service` should be enough.
+For sysV-style inits, it depends on the scripts provided for your distro,
+but usually `update-rc.d osh-http-proxy defaults` then `update-rc.d osh-http-proxy enable` should
+do the trick.
+
+port
+****
+
+:Type: ``int, 1 to 65535``
+
+:Default: ``8443``
+
+The port to listen to. You can use ports < 1024, in which case privileges will be dropped after binding,
+but please ensure your systemd unit file starts the daemon as root in that case.
+
+ssl_certificate
+***************
+
+:Type: ``string``
+
+:Default: ``/etc/ssl/certs/ssl-cert-snakeoil.pem``
+
+The file that contains the server SSL certificate in PEM format.
+For tests, install the ``ssl-cert`` package and point this configuration item
+to the snakeoil certs (which is the default).
+
+ssl_key
+*******
+
+:Type: ``string``
+
+:Default: ``/etc/ssl/private/ssl-cert-snakeoil.key``
+
+The file that contains the server SSL key in PEM format.
+For tests, install the ``ssl-cert`` package and point this configuration item
+to the snakeoil certs (which is the default).
+
+ciphers
+*******
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"``
+
+The ordered list the TLS server ciphers, in ``openssl`` classic format. Use ``openssl ciphers``
+to see what your system supports, an empty list leaves the choice to your openssl libraries default
+values (system-dependent)
+
+insecure
+********
+
+:Type: ``bool``
+
+:Default: ``false``
+
+Whether to ignore SSL certificate verification for the connection between the bastion and the devices
+
+min_servers
+***********
+
+:Type: ``int, 1 to 512``
+
+:Default: ``8``
+
+Number of child processes to start at launch
+
+max_servers
+***********
+
+:Type: ``int, 1 to 512``
+
+:Default: ``32``
+
+Hard maximum number of child processes that can be active at any given time no matter what
+
+min_spare_servers
+*****************
+
+:Type: ``int, 1 to 512``
+
+:Default: ``8``
+
+The daemon will ensure that there is at least this number of children idle & ready to accept
+new connections (as long as max_servers is not reached)
+
+max_spare_servers
+*****************
+
+:Type: ``int, 1 to 512``
+
+:Default: ``16``
+
+The daemon will kill *idle* children to keep their number below this maximum when traffic is low
+
+timeout
+*******
+
+:Type: ``int, 1 to 3600``
+
+:Default: ``120``
+
+Timeout delay (in seconds) for the connection between the bastion and the devices
+
+log_request_response
+********************
+
+:Type: ``bool``
+
+:Default: ``true``
+
+When enabled, the complete response of the device to the request we forwarded will be logged,
+otherwise we'll only log the response headers
+
+log_request_response_max_size
+*****************************
+
+:Type: ``int, 0 to 2^30 (1 GiB)``
+
+:Default: ``65536``
+
+This option only applies when `log_request_response` is true (see above).
+When set to zero, the complete response will be logged in the account's home log directory,
+including the body, regardless of its size. If set to a positive integer,
+the query response will only be partially logged, with full status and headers but the body only up
+to the specified size. This is a way to avoid turning off request response logging completely on
+very busy bastions, by ensuring logs growth don't get out of hand, as some responses to queries can
+take megabytes, with possibly limited added value to traceability.
+
diff --git a/_sources/administration/configuration/osh-lingering-sessions-reaper_conf.rst.txt b/_sources/administration/configuration/osh-lingering-sessions-reaper_conf.rst.txt
new file mode 100644
index 000000000..e24343b73
--- /dev/null
+++ b/_sources/administration/configuration/osh-lingering-sessions-reaper_conf.rst.txt
@@ -0,0 +1,81 @@
+==================================
+osh-lingering-sessions-reaper.conf
+==================================
+
+ .. note::
+
+    This script is called by cron and is responsible for terminating
+    lingering sessions that no longer have any tty attached nor parent PID,
+    and have been running for some time.
+
+Option List
+===========
+
+Logging & activation options
+----------------------------
+
+Script logging configuration and script activation
+
+- `LOGFILE`_
+- `LOG_FACILITY`_
+- `ENABLED`_
+
+Main options
+------------
+
+These options govern the behavior of the script
+
+- `MAX_AGE`_
+
+Option Reference
+================
+
+Logging & activation
+--------------------
+
+LOGFILE
+*******
+
+:Type: ``string, path to a file``
+
+:Default: ``""``
+
+File where the logs will be written to (don't forget to configure ``logrotate``!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.
+
+LOG_FACILITY
+************
+
+:Type: ``string``
+
+:Default: ``"local6"``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+ENABLED
+*******
+
+:Type: ``0 or 1``
+
+:Default: ``1``
+
+If set to 1, the script is enabled and will run when started by crond.
+
+Main
+----
+
+MAX_AGE
+*******
+
+:Type: ``int >= 0``
+
+:Default: ``86400``
+
+The minimum number of seconds a session must have been opened before
+being considered as possibly a lingering orphan session.
+Still alive sessions, even older than MAX_AGE seconds, will be kept.
+
diff --git a/_sources/administration/configuration/osh-orphaned-homedir_conf.rst.txt b/_sources/administration/configuration/osh-orphaned-homedir_conf.rst.txt
new file mode 100644
index 000000000..de0bccd53
--- /dev/null
+++ b/_sources/administration/configuration/osh-orphaned-homedir_conf.rst.txt
@@ -0,0 +1,62 @@
+=========================
+osh-orphaned-homedir.conf
+=========================
+
+ .. note::
+
+    This script is called by cron and is responsible for clearing up
+    orphaned home directories on secondary bastions.
+    Indeed, once the user has been deleted, a few files may remain,
+    such as logs, so this script handles the proper archiving
+    of these sparse files, before removing the orphaned home directory.
+
+Option List
+===========
+
+Logging & activation options
+----------------------------
+
+Script logging configuration and script activation
+
+- `LOGFILE`_
+- `LOG_FACILITY`_
+- `ENABLED`_
+
+Option Reference
+================
+
+Logging & activation
+--------------------
+
+LOGFILE
+*******
+
+:Type: ``string, path to a file``
+
+:Default: ``""``
+
+File where the logs will be written to (don't forget to configure ``logrotate``!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.
+
+LOG_FACILITY
+************
+
+:Type: ``string``
+
+:Default: ``"local6"``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+ENABLED
+*******
+
+:Type: ``0 or 1``
+
+:Default: ``1``
+
+If set to 1, the script is enabled and will run when started by crond.
+
diff --git a/_sources/administration/configuration/osh-piv-grace-reaper_conf.rst.txt b/_sources/administration/configuration/osh-piv-grace-reaper_conf.rst.txt
new file mode 100644
index 000000000..ca678c7fa
--- /dev/null
+++ b/_sources/administration/configuration/osh-piv-grace-reaper_conf.rst.txt
@@ -0,0 +1,48 @@
+=========================
+osh-piv-grace-reaper.conf
+=========================
+
+ .. note::
+
+   This script is called by cron and is responsible for removing temporary
+   grace periods on PIV policies, once they expire. If you don't use PIV keys,
+   this script won't do anything (see :doc:`/using/piv`).
+
+Option List
+===========
+
+Logging & activation options
+----------------------------
+
+Script logging configuration and script activation
+
+- `syslog_facility`_
+- `enabled`_
+
+Option Reference
+================
+
+Logging & activation
+--------------------
+
+syslog_facility
+***************
+
+:Type: ``string``
+
+:Default: ``local6``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+enabled
+*******
+
+:Type: ``bool``
+
+:Default: ``true``
+
+If not set to `true` (or a true value), the script will not run.
+
diff --git a/_sources/administration/configuration/osh-remove-empty-folders_conf.rst.txt b/_sources/administration/configuration/osh-remove-empty-folders_conf.rst.txt
new file mode 100644
index 000000000..54f63bb84
--- /dev/null
+++ b/_sources/administration/configuration/osh-remove-empty-folders_conf.rst.txt
@@ -0,0 +1,84 @@
+=============================
+osh-remove-empty-folders.conf
+=============================
+
+ .. note::
+
+    This script is called by cron and is responsible for getting rid of empty
+    folders in the ``ttyrec/`` directory of users homes, which may contain a
+    high amount of empty folders for busy users connecting to a lot of
+    different servers, as we create one folder per destination IP.
+    Of course, this script will only remove empty folders, never actual files.
+
+Option List
+===========
+
+Logging & activation options
+----------------------------
+
+Script logging configuration and script activation
+
+- `LOGFILE`_
+- `LOG_FACILITY`_
+
+Behavior options
+----------------
+
+These options govern the behavior of the script
+
+- `ENABLED`_
+- `MTIME_DAYS`_
+
+Option Reference
+================
+
+Logging & activation
+--------------------
+
+LOGFILE
+*******
+
+:Type: ``string, path to a file``
+
+:Default: ``""``
+
+File where the logs will be written to (don't forget to configure ``logrotate``!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.
+
+LOG_FACILITY
+************
+
+:Type: ``string``
+
+:Default: ``"local6"``
+
+The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.
+
+Behavior
+--------
+
+ENABLED
+*******
+
+:Type: ``0 or 1``
+
+:Default: ``1``
+
+If set to 1, the script is enabled and will attempt to garbage-collect empty directories located
+in ``/home/*/ttyrec``. If set to anything else, the script is considered disabled and will not run.
+
+MTIME_DAYS
+**********
+
+:Type: ``int, >= 0``
+
+:Default: ``1``
+
+The amount of days the empty folder must have been empty before considering a removal. You probably
+don't need to change the default value, unless you want to ensure that a given folder has not been
+used since some time before removing it (this has no impact as folders are re-created as needed).
+
diff --git a/_sources/administration/configuration/osh-sync-watcher_sh.rst.txt b/_sources/administration/configuration/osh-sync-watcher_sh.rst.txt
new file mode 100644
index 000000000..c0cc7ffd7
--- /dev/null
+++ b/_sources/administration/configuration/osh-sync-watcher_sh.rst.txt
@@ -0,0 +1,119 @@
+===================
+osh-sync-watcher.sh
+===================
+
+ .. note::
+
+    This daemon is responsible for ensuring secondary bastions
+    are synced up to their primary at all times.
+    If you don't have such HA setup, you can ignore this config file.
+    For more information, refer to
+    :ref:`installation/advanced:clustering (high availability)`.
+
+Option List
+===========
+
+Logging options
+---------------
+
+These options configure the way the script logs its actions
+
+- `logdir`_
+- `syslog`_
+
+Daemon setup options
+--------------------
+
+These options configure whether the synchronization daemon is enabled
+
+- `enabled`_
+- `timeout`_
+
+Remote synchronization options
+------------------------------
+
+These options configure how the primary bastion should push its configuration to the secondaries
+
+- `rshcmd`_
+- `remoteuser`_
+- `remotehostlist`_
+
+Option Reference
+================
+
+Logging
+-------
+
+logdir
+******
+
+:Type: ``string``
+
+:Default: ``""``
+
+Directory where the logs will be written to. Note that using this configuration option, the script will directly write to a file, without using syslog. If empty, won't log directly to a file.
+
+syslog
+******
+
+:Type: ``string``
+
+:Default: ``"local6"``
+
+The syslog facility to use for logging the script output. If set to the empty string, we'll not log through syslog at all. If this configuration option is missing from your config file altogether, the default value will be used (local6), which means that we'll log to syslog.
+
+Daemon setup
+------------
+
+enabled
+*******
+
+:Type: ``int``
+
+:Default: ``0``
+
+If set to anything else than ``1``, the daemon will refuse to start (e.g. you don't have secondary bastions). You can set this to ``1`` when you've configured and tested the primary/secondaries setup.
+
+timeout
+*******
+
+:Type: ``int > 0``
+
+:Default: ``120``
+
+The maximum delay, in seconds, after which we'll forcefully synchronize our data to the secondaries, even if no change was detected.
+
+Remote synchronization
+----------------------
+
+rshcmd
+******
+
+:Type: ``string``
+
+:Default: ``""``
+
+:Example: ``"ssh -q -i /root/.ssh/id_master2slave -o StrictHostKeyChecking=accept-new"``
+
+This value will be passed as the ``--rsh`` parameter of ``rsync`` (don't use ``-p`` to specify the port here, use the ``remotehostlist`` config below instead), this can be used to specify which SSH key to use, for example. NOTE THAT THIS OPTION IS MANDATORY (if you don't have anything to specify here, you can just say ``ssh``). If you followed the standard installation procedure, the "example" value specified below will work.
+
+remoteuser
+**********
+
+:Type: ``string``
+
+:Default: ``"bastionsync"``
+
+The remote user to connect as, using ``ssh`` while rsyncing to secondaries. You probably don't need to change this.
+
+remotehostlist
+**************
+
+:Type: ``space-separated list of strings, each string being either 'ip' or 'ip:port'``
+
+:Default: ``""``
+
+:Example: ``"192.0.2.17 192.0.2.12:2244"``
+
+The list of the secondary bastions to push our data to. If this list is empty, the daemon won't do anything.
+
diff --git a/_sources/administration/logs.rst.txt b/_sources/administration/logs.rst.txt
new file mode 100644
index 000000000..53fe5d22c
--- /dev/null
+++ b/_sources/administration/logs.rst.txt
@@ -0,0 +1,599 @@
+====
+Logs
+====
+
+.. note::
+   The Bastion comes with a lot of traceability features, you have to ensure that you've done your configuration
+   correctly so that those logs are kept in a safe place when you need them. It is warmly advised to enable at least
+   the syslog option, and push your logs to a remote syslog server.
+
+.. contents::
+   :depth: 5
+
+
+Message types
+=============
+
+The Bastion has several configurable ways of logging events, but before detailing those,
+let's see the different message types that can be logged.
+The Bastion currently has 12 different message types, listed below:
+
+- :ref:`log_open`
+- :ref:`log_close`
+- :ref:`log_warn`
+- :ref:`log_warninfo`
+- :ref:`log_codewarn`
+- :ref:`log_acl`
+- :ref:`log_membership`
+- :ref:`log_security`
+- :ref:`log_group`
+- :ref:`log_account`
+
+First, let's list the fields that are common to all the message types:
+
+uniqid
+   This is the unique connection ID, you can find all the logs relevant to the same connection
+   by filtering on the ``uniqid``. This ID is also, by default, part of the filename given to the ``ttyrec`` files,
+   for easier correlation. The same ID is also used in the sqlite logs, if you enabled those. In some rare cases,
+   the value can be "-", for example if a satellite script has something to log,
+   not linked to an actual connection or session.
+
+version
+   This indicates the version of The Bastion software that is writing the log
+
+pid, ppid
+   This is the system PID (resp. system parent PID) of the process writing the log,
+   for easier correlation with system audit logs if you have them
+
+sysuser
+   This is the system user under which the process writing the log is currently running on,
+   can be useful to detect abnormalities
+
+sudo_user
+   When the value is present, it contains the system user name that has launched the ``sudo`` command the code is
+   currently running under (this will be the case if a so-called "bastion helper" is pushing a log, for example).
+   However this field will often have an empty value, it means that the code that is writing the log
+   is not running under ``sudo``
+
+uid, gid
+   This is the system user ID aka UID (resp. group ID aka GID) under which
+   the process writing the log is currently running
+
+account
+   This is the name of the bastion account that launched the command that produced the log
+
+The other fields depend on the message type, as detailed in the next sections.
+
+.. _log_open:
+
+open
+****
+
+This log is produced when a user established a session with the bastion.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: open uniqid="e9e4baf6873b" version="3.01.03" pid="18721" ppid="18720"
+   sysuser="gthreepw" sudo_user="" uid="99998" gid="99998" account="gthreepw" cmdtype="ssh" allowed="true"
+   ip_from="172.17.0.1" port_from="39696" host_from="172.17.0.1" ip_bastion="172.17.0.2" port_bastion="22"
+   host_bastion="myhostname.example.org" user="foo" ip_to="172.17.0.123" port_to="22" host_to="srv123.example.org"
+   plugin="" globalsql="ok" accountsql="ok" comment="" params="ttyrec -f
+   /home/gthreepw/ttyrec/172.17.0.123/2020-12-28.11-12-26.074894.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec -F
+   /home/gthreepw/ttyrec/172.17.0.123/%Y--%d.%H-%M-%S.#usec#.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec --
+   /usr/bin/ssh 172.17.0.123 -l foo -p 22 -i /home/gthreepw/.ssh/id_rsa4096_private.1594384739 -i
+   /home/keykeeper/keyagroup/id_ed25519_agroup.1607524914 -o PreferredAuthentications=publickey"
+
+Fields:
+
+cmdtype
+   Indicates which category of command has been requested by the user:
+
+   - ssh: the user is trying to establish an SSH egress connection to a remote server
+   - telnet: the user is trying to establish a telnet egress connection to a remote server
+   - abort: the action requested by the user has been aborted early, possibly because of permission issues
+     or impossibility to understand the request, more information is available in the **bastion_comment** field
+   - osh: the user is trying to execute a bastion plugin with the ``--osh`` command
+   - interactive: the user just entered interactive mode. Note that all the commands launched through
+     the interactive mode will still have their own log.
+   - sshas: an administrator is currently establishing a connection on behalf of another user.
+     This connection will also have its own log.
+   - proxyhttp_daemon: the HTTPS proxy daemon received a request
+   - proxyhttp_worker: the HTTPS proxy worker specifically spawned for the user by the daemon is handling the request
+
+allowed
+   Indicates whether the requested action was allowed or not by the bastion, after executing the authorization phase.
+   Will be either "true" or "false".
+
+ip_from, port_from, host_from
+   These are the IP and source port as seen by the bastion, from which the ingress connection originates.
+   If the bastion can resolve the reverse of the IP to a hostname, it'll be indicated in host_from,
+   otherwise the IP will be repeated there.
+
+ip_bastion, port_bastion, host_bastion
+   These are the IP and port of the bastion to which the ingress connection terminates.
+   If your bastion has several IPs and/or interfaces, this can be useful.
+   If the bastion can resolve the reverse of the IP to a hostname, it'll be indicated in host_bastion,
+   otherwise the IP will be repeated there.
+
+ip_to, port_to, host_to
+   These are the IP and destination port to which the bastion will connect on the egress side,
+   on behalf of the requesting user. If the bastion can resolve the reverse of the IP to a hostname,
+   it'll be indicated in host_to, otherwise the IP will be repeated there.
+
+plugin
+   When ``cmdtype`` is ``osh``, the name of the command (or *plugin*) will appear in this field.
+   Otherwise it'll be blank.
+
+accountsql
+   This field will contain either:
+
+   - ok: when :ref:`enableAccountSqlLog` is enabled, and we successfully inserted a new row for the log
+   - no: when :ref:`enableAccountSqlLog` is disabled
+   - error: when we couldn't insert a new row, **error** followed by a detailed error message,
+     for example "error SQL error [global] err 8 while doing [inserting data (execute)]:
+     attempt to write a readonly database".
+
+globalsql
+   This field can contain the same values than **accountsql** above,
+   but for ``enableGlobalSqlLog`` instead of ``enableAccountSqlLog``
+
+comment
+   Some more information about the current event, depending on the ``cmdtype`` value.
+
+params
+   This is the fully expanded command line that will be launched under the currently running user rights,
+   to establish the egress connection, if applicable.
+
+.. _log_close:
+
+close
+*****
+
+This log is produced when a user terminates a currently running session with The Bastion.
+It is always matched (through the ``uniqid``) to another log with the ``open`` message type.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: open uniqid="e9e4baf6873b" version="3.01.03" pid="18721" ppid="18720"
+   sysuser="gthreepw" sudo_user="" uid="99998" gid="99998" account="gthreepw" cmdtype="ssh" allowed="true"
+   ip_from="172.17.0.1" port_from="39696" host_from="172.17.0.1" ip_bastion="172.17.0.2" port_bastion="22"
+   host_bastion="myhostname.example.org" user="foo" ip_to="172.17.0.123" port_to="22"
+   host_to="srv123.example.org" plugin="" globalsql="ok" accountsql="ok" comment="" params="ttyrec -f
+   /home/gthreepw/ttyrec/172.17.0.123/2020-12-28.11-12-26.074894.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec -F
+   /home/gthreepw/ttyrec/172.17.0.123/%Y--%d.%H-%M-%S.#usec#.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec --
+   /usr/bin/ssh 172.17.0.123 -l foo -p 22 -i /home/gthreepw/.ssh/id_rsa4096_private.1594384739 -i
+   /home/keykeeper/keyagroup/id_ed25519_agroup.1607524914 -o PreferredAuthentications=publickey" sysret="0"
+   signal="" comment_close="hostkey_changed passauth_disabled" duration="43.692"
+
+All the fields from the corresponding ``open`` log are repeated in this log line, in addition to the following fields:
+
+sysret
+   Return code of the launched system command (that established the egress connection)
+   or the plugin (if an ``--osh`` command was passed).
+   If we don't have a return code, for example because we were interrupted by a signal, the value will be empty.
+
+signal
+   Name of the UNIX signal that terminated the command, if any. For example "HUP" or "SEGV".
+   If we got no signal, the value will be empty.
+
+comment_close
+   A space-separated list of messages giving some hints gathered at the end of a session.
+   For example `hostkey_changed passauth_disabled` means that we detected that our egress ssh client
+   emitted a warning telling us that the remote keys changed, and also that password authentication has been disabled.
+
+duration
+   Amount of seconds (with a millisecond precision) between the session open and the session close.
+
+.. _log_warn:
+
+warn, die
+*********
+
+These logs are produced when Perl emits a warning (using the ``warn()`` call),
+or respectively when Perl halts abruptly due to a ``die()`` call.
+This should not happen during nominal use. You might want to keep a look on those messages if they're produced.
+
+Example::
+
+  Dec 28 11:12:26 myhostname bastion: warn uniqid="a46e51b5dce4" version="3.01.02" pid="3308212" ppid="3308206"
+  sysuser="lechuck" sudo_user="" uid="99994" gid="99994" msg="Cannot find termcap: TERM not set at
+  /usr/share/perl/5.28/Term/ReadLine.pm line 379.  " program="/opt/bastion/bin/shell/osh.pl" cmdline="-c^-i ssh
+  root@172.17.0.222 id" trace=" at /opt/bastion/bin/shell/../../lib/perl/OVH/Bastion.pm
+  line 41.   OVH::Bastion::__ANON__(\"Cannot find termcap: TERM not set at /usr/share/perl/5.28/Ter\"...)
+  called at /usr/share/perl/5.28/Term/ReadLine.pm line
+  391     Term::ReadLine::TermCap::ornaments(Term::ReadLine::Stub=ARRAY(0x5575da36b690), 1) called at
+  /opt/bastion/lib/perl/OVH/Bastion/interactive.inc line 77   OVH::Bastion::interactive(\"realOptions\", \"-i ssh
+  root\\@172.17.0.222 id\"..., \"timeoutHandler\", CODE(0x5575da15aa78), \"self\", \"lechuck\")
+  called at /opt/bastion/bin/shell/osh.pl line 485 "
+
+Fields:
+
+msg
+   This is the message used as a parameter to the ``warn()`` or ``die()`` call
+
+program
+   Contains the name of the currently running program (first parameter of ``execve()``)
+
+cmdline
+   Contains the full command line passed to the currently running program (remaining parameters of ``execve()``).
+   The command-line fields are separated by ``^``'s.
+
+trace
+   The call trace leading to this ``warn()`` or ``die()``
+
+.. _log_warninfo:
+
+warn-info, die-info
+*******************
+
+These logs are produced when some known portion of code (including libraries) called ``warn()`` or ``die()``
+but in a known case that can happen during nominal use.
+Don't use these logs to directly trigger an alert, but you can keep an eye on those, as e.g. an unusually
+high number of occurences in a short time may be a weak signal that somebody or something is misbehaving.
+
+The fields are the same than the ones specified above for **warn** and **die**.
+
+.. _log_codeinfo:
+
+code-info
+*********
+
+These logs are produced when some portion of the code encounters an minor issue that is worth logging,
+to e.g. help debugging an issue or understanding what happened in a specific use-case,
+for example if a user-session ended abruptly.
+These logs are not the result of an error on the bastion configuration and don't mandate immediate admin attention.
+
+Example::
+
+   Dec 25 14:56:11 myhostname bastion: code-info uniqid="98d2f32b1a2d" version="3.07.00" pid="3708843"
+   ppid="3708842" sysuser="lechuck" sudo_user="" uid="8423" gid="8423" msg="execute():
+   error while syswriting(Broken pipe) on stderr, aborting this cycle"
+
+Fields:
+
+msg
+   A human-readable text describing the error
+
+.. _log_codewarn:
+
+code-warning
+************
+
+These logs are produced when some portion of the code encounters an unexpected issue or abnormality
+that is worth logging. They'll usually not be emitted due to a bad user interaction, but rather if the bastion
+is misconfigured, or for anything that might need some attention or fixing from the admins.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: code-warning uniqid="ffee33abd1ba" version="3.01.03" pid="3709643"
+   ppid="3709642" sysuser="lechuck" sudo_user="" uid="8423" gid="8423" msg="Configuration error
+   for plugin selfGenerateEgressKey on the 'disabled' key: expected a boolean, casted 'no' into false"
+
+Fields:
+
+msg
+   A human-readable text describing the error
+
+.. _log_acl:
+
+acl
+***
+
+This log is produced when an access control list is modified,
+either personal accesses of an account, or a group servers list.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: acl uniqid="f25fe71c6635" version="3.01.02" pid="3116604"
+   ppid="3116603" sysuser="keysomegroup" sudo_user="lechuck" uid="10006" gid="10057" action="add"
+   type="group" group="somegroup" account="" user="root" ip="172.16.2.2" port="22" ttl="" force_key="" comment=""
+
+Fields:
+
+action
+   Will be either *add* if an access is added, or *del* if an access is removed
+
+type
+   Will be either *group* if we're modifying a group server list, in which case the *group* field will be filled,
+   or *account* if we're modifying personal accesses of an account, in which case the *account* field will be filled
+
+group
+   If **type** is *group*, indicates which group servers list has been modified
+
+account
+   If **type** is *account*, indicates which account personal accesses have been modified
+
+user
+   The remote user part of the access we're adding/removing
+
+ip
+   The IP or IP block of the access we're adding/removing
+
+port
+   The port of the access we're adding/removing
+
+ttl
+   If set, represents the TTL after which the access will automatically be removed
+
+force_key
+   If set, this contains the fingerprint of the key that'll be used for this access
+
+comment
+   Any comment set by the user adding/removing the access
+
+.. _log_membership:
+
+membership
+**********
+
+This log is produced when one of a group's role list is modified:
+either an owner, member, guest, aclkeeper or gatekeeper.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: membership uniqid="a00993ec6767" version="3.01.02"
+   pid="1072528" ppid="1072497" sysuser="lechuck" sudo_user="" uid="2070" gid="2070" action="add"
+   type="member" group="monkeys" account="stan" self="lechuck" user="" host="" port="" ttl=""
+
+Fields:
+
+action
+   Either *add* when an account is added to a group role list, or *del* when an account is removed
+
+type
+   Type of the role list we're modifying, either *member*, *aclkeeper*, *gatekeeper*, *guest* or *owner*
+
+group
+   Group whose one of the role list is being modified
+
+account
+   Account being added/removed to/from the group role list
+
+self
+   Account performing the change
+
+user
+   When **type** is *guest*, the remote user part of the access we're adding/removing
+
+host
+   When **type** is *guest*, the IP or IP block part of the access we're adding/removing
+
+port
+   When **type** is *guest*, the port of the access we're adding/removing
+
+ttl
+   When **type** is *guest* and **action** is *add*, if a TTL has been specified for the access, it appears here
+
+.. _log_security:
+
+security
+********
+
+This log is produced when an important security event has occurred, such as when an admin impersonates another user,
+or when a super owner uses his implicit global ownership to modify a group. You might want to watch those closely.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: security uniqid="601a17b5e5ba" version="3.01.03" pid="20519"
+   ppid="20518" sysuser="lechuck" sudo_user="" uid="2604" gid="2604" type="admin-ssh-as" account="lechuck"
+   sudo-as="gthreepw" plugin="ssh" params="--user root --host supersecretserver.example.org --port 22"
+
+Fields:
+
+type
+   Type of the security event that occurred. Can be:
+
+   - admin-ssh-as: an admin impersonated another user to establish an egress connection
+   - admin-sudo: an admin impersonated another user and launched an osh plugin on their behalf
+   - superowner-override: a super owner used his implicit ownership on all groups to modify a group
+
+account
+   Account that emitted the security event
+
+sudo-as
+   When **type** is *admin-ssh-as* or *admin-sudo*, name of the account that was impersonated
+
+plugin
+   Name of the osh plugin that was launched
+
+params
+   Parameters passed to the plugin, or command line used to establish the egress connection
+
+.. _log_group:
+
+group
+*****
+
+This log is produced when a group is created or deleted.
+Note that membership modifications are referenced with the **membership** type instead, see above.
+
+Example::
+
+   Dec 28 11:12:26 myhostname bastion: group uniqid="56f321fb3e58" version="3.01.03" pid="1325901"
+   ppid="1325900" sysuser="root" sudo_user="lechuck" uid="0" gid="0" action="create" group="themonkeys"
+   owner="stan" egress_ssh_key_algorithm="ed25519" egress_ssh_key_size="256" egress_ssh_key_encrypted="false"
+
+Fields:
+
+action
+   Either *create* or *delete*, indicating whether the group has just been created or deleted
+
+group
+   The group name being created or deleted
+
+owner
+   When **action** is *create*, the name of the owner of the new group we're creating
+
+egress_ssh_key_algorithm, egress_ssh_key_size
+   When **action** is *create*, the algorithm (and size) used to generate the first pair of SSH keys,
+   can be empty if ``--no-key`` was specified
+
+egress_ssh_key_encrypted
+   When **action** is *create*, if a key was generated,
+   will be *true* if ``--encrypted`` has been used, *false* otherwise
+
+.. _log_account:
+
+account
+*******
+
+This log is produced when an account is created or deleted.
+
+Example::
+
+   Dec 21 14:30:26 myhostname bastion: account uniqid="ee4c91000b75" version="3.01.02" pid="537253" ppid="537252"
+   sysuser="root" sudo_user="lechuck" uid="0" gid="0" action="create" account="stan" account_uid="8431"
+   public_key="ssh-rsa AAAAB[...]" always_active="false" uid_auto="false" osh_only="false" immutable_key="false"
+   comment="CREATED_BY=lechuck BASTION_VERSION=3.01.02 CREATION_TIME=Mon Dec 21 14:30:26 2020
+   CREATION_TIMESTAMP=1608561026 COMMENT=requested_by_the_sword_master_of_melee_island_see_ticket_no_1337"
+
+Fields:
+
+action
+   Either *create* or *delete*, indicating whether the account has just been created or deleted
+
+account
+   The account name being created or deleted
+
+account_uid
+   When **action** is *create*, the UID associated corresponding to the account we're creating
+
+public_key
+   When **action** is *create*, the public key we've generated for the new account
+
+always_active, uid_auto, osh_only, immutable_key
+   When **action** is *create*, *true* if the corresponding option was specified (``--always-active``,
+   ``--uid-auto``, ``--osh-only`` or ``--immutable-key``), *false* otherwise
+
+comment
+   When **action** is *create*, the comment specified at creation if any, with some metadata that'll be stored in
+   the account properties (*created_by*, *bastion_version*, *creation_time*, *creation_timestamp*)
+
+tty_group
+   When **action** is *delete*, the name of the tty group specific to this account that was deleted at the same time
+
+.. _syslog:
+
+Syslog
+======
+
+Files location
+**************
+
+If you use ``syslog-ng`` and installed the provided templates (which is the default if you used
+the ``--new-install`` option to the install script), you'll have 4 files in your system log directory:
+
+/var/log/bastion/bastion.log
+   This is where all the bastion usage logs will be written. All the above message types can be found in this file.
+
+/var/log/bastion/bastion-die.log
+   This is where Perl crashes will be logged, with the message type ``die``.
+   On a production bastion, this file should normally be empty.
+
+/var/log/bastion/bastion-warn.log
+   This is where Perl warnings will be logged, with the message type ``warning``.
+   On a production bastion, this file should mostly be empty.
+
+/var/log/bastion/bastion-scripts.log
+   This is where all the satellite scripts (mostly found in the ``bin/cron/`` directory) will log their output.
+
+Log format
+**********
+
+A syslog message will always match the following generic format::
+
+   SYSLOG_TIME SYSLOG_HOST bastion: MSGTYPE field1="value1" field2="second value" ...
+
+Where SYSLOG_TIME is the usual datetime field added by your local syslog daemon,
+and SYSLOG_HOST the hostname of the local machine.
+The MSGTYPE indicates the message type of the log line (the list of types is further below).
+Then, a possibly long list of fields with quoted values, depending on the MSGTYPE.
+
+An example follows::
+
+   Dec 28 11:14:23 myhostname bastion: code-warning uniqid="e192fce7553a" version="3.01.03"
+   pid="18803" ppid="18802" sysuser="gthreepw" sudo_user="" uid="99998" gid="99998"
+   msg="Configuration error: specified adminAccounts 'joe' is not a valid account, ignoring"
+
+In that case, the MSGTYPE is ``code-warning``, and we have a few field/value couples with some metadata of interest,
+followed by a human-readable message, indicated by the ``msg`` field.
+
+Only satellite scripts will miss the field/value construction, which will just be replaced by a plain text message.
+These logs are stored in :file:`/var/log/bastion/bastion-scripts.log` by default.
+
+Access logs
+===========
+
+If you don't or can't use :ref:`syslog`, the bastion can create and use access log files on its own,
+without relying on a syslog daemon. Note that you can enable both syslog and these access logs, if you want.
+
+These access logs will only contain :ref:`log_open` and :ref:`log_close` log types, which can be seen as "access logs".
+All the other log types, such as :ref:`log_warn`, :ref:`log_membership`, etc. are only logged through syslog.
+
+These logs are enabled through the :ref:`enableGlobalAccessLog` and :ref:`enableAccountAccessLog` options.
+
+enableGlobalAccessLog
+   When enabled, a single log file will be used, located in :file:`/home/logkeeper/global-log-YYYYMM.log`.
+   There will be one file per month. Note that it can grow quite large if you have a busy bastion.
+
+enableAccountAccessLog
+   When enabled, one log file per account will be used, located in :file:`/home/USER/USER-log-YYYYMM.log`.
+   There will be one file per month.
+
+If both options are enabled, it means that every access log will be logged twice, to two different locations.
+If you also enabled syslog, it's even three times!
+
+SQLite logs
+===========
+
+If you want to store access logs into local sqlite databases, you can enable either :ref:`enableGlobalSqlLog`,
+:ref:`enableAccountSqlLog`, or both.
+
+enableGlobalSqlLog
+   When enabled, a global sqlite database will be created in :file:`/home/logkeeper/global-log-YYYYMM.sqlite`.
+   It'll contain one row per access (created at the same time the :ref:`log_open` log is emitted).
+   The following columns exist: id, timestamp, account, cmdtype, allowed, ipfrom, ipto, portto, user, plugin, uniqid.
+   Refer to the :ref:`log_open` log description to get the meaning of each column.
+
+enableAccountSqlLog
+   When enabled, an sqlite database per account will be created in :file:`/home/USER/USER-log-YYYYMM.sqlite`.
+   It'll contain one row per access (created at the same time the :ref:`log_open` log is emitted),
+   and the same row will be updated by the :ref:`log_close` event when it is emitted. The following columns exist:
+   id, timestamp, timestampusec, account, cmdtype, allowed, hostfrom, ipfrom, bastionip, bastionport, hostto,
+   ipto, portto, user, plugin, ttyrecfilee, params, timestampend, timestampendusec, returnvalue, comment, uniqid.
+   Refer to the :ref:`log_open` log and :ref:`log_close` log descriptions to get the meaning of each column.
+   Note that the :ref:`enableAccountSqlLog` option is required if you want the :doc:`/plugins/open/selfListSessions`
+   and :doc:`/plugins/open/selfPlaySession` plugins to work, as they use this database.
+
+Note that enabling these on a very busy bastion (several new connections per second) can create lock contention,
+especially on the global log: ensure you have a fast storage. In any case, if a connection can't get the lock after
+a few seconds, it'll proceed anyway, and skip writing the sql log. In that case, if you enabled syslog or
+local access logs, the **globalsql** and/or the **accountsql** field will contain the error detail.
+
+Terminal recordings (*ttyrec*)
+==============================
+
+Every egress connection is started under ``ttyrec``, which means that everything appearing on the console is recorded.
+If a password is asked by some program, for example, and typing the password prints '*' or doesn't print
+anything at all, this won't be recorded. This is by design. In other words, the keystrokes are not recorded,
+except if they produce something on the screen.
+
+The ttyrec files location is always :file:`/home/USER/ttyrec/REMOTEIP/file.ttyrec`, where the actual `file.ttyrec`
+name can be configured by the :ref:`ttyrecFilenameFormat` option.
+By default, it'll contain the date, time, account, remote ip, port and user used to start the egress connection,
+as well as the uniqid, for easier correlation between all the logs produced by the same connection.
+Note that for long connections, or connections producing a lot of output, ttyrec files will be transparently rotated,
+without interrupting the connection.
+This is to avoid ending up with ttyrec files of several gigabytes that would still be opened, written to,
+hence impossible to compress, encrypt, and push to an escrow filer.
+The uniqid will be the same for all the ttyrec files corresponding to the same connection.
+
+To play ttyrec files, you can either use :doc:`/plugins/open/selfPlaySession` for yourself, or,
+for admins having local access to the bastion machine, the ``ttyplay`` program can be used.
+Another software, perhaps more powerful than ttyplay, can also be used:
+`IPBT <https://www.chiark.greenend.org.uk/~sgtatham/ipbt/>`_ (`wiki <https://nethackwiki.com/wiki/IPBT>`_),
+aka "It's PlayBack Time", by the PuTTY author.
+It can do more advanced things such as look for words appearing on any frame recorded in the ttyrec file,
+play files using a logarithmic speed, or display an OSD with the exact time output you're seeing has appeared.
+As ttyrec is a well-known format that has been around for a while,
+there are a bunch of other programs you can use to read or convert these files.
diff --git a/_sources/administration/mfa.rst.txt b/_sources/administration/mfa.rst.txt
new file mode 100644
index 000000000..951e30a38
--- /dev/null
+++ b/_sources/administration/mfa.rst.txt
@@ -0,0 +1,441 @@
+===========================
+Multi-Factor Authentication
+===========================
+
+.. contents::
+
+Introduction
+============
+
+Flavors
+*******
+
+The Bastion supports two flavors of Multi-Factor Authentication (MFA, sometimes called 2FA):
+
+- `Immediate MFA`, mandatory on a per-account basis during the SSH authentication phase on the ingress side,
+  done by the system even before executing the bastion code, regardless of which actions (plugin calls,
+  remote connection, ...) are to be done by the account currently being authenticated
+
+- `JIT MFA`, done after the authentication phase, by the bastion code, conditionally (*just-in-time*), when
+  an action that is about to be done requires it by (configurable) policy
+
+Each of these methods and their differences are detailed below, so you can choose the one that fits your environment.
+
+Supported additional factors
+****************************
+
+The first factor is always the SSH publickey. Two additional factors are supported:
+
+- `password`, in which case a password is attached to the account. This password's policy is configurable through
+  :ref:`administration/configuration/bastion_conf:mfapasswordmindays`,
+  :ref:`administration/configuration/bastion_conf:mfapasswordmaxdays`,
+  :ref:`administration/configuration/bastion_conf:mfapasswordwarndays`,
+  :ref:`administration/configuration/bastion_conf:mfapasswordinactivedays`.
+
+- `TOTP`, aka "Time-based One-Time Password", which requires a smartphone app and generates a new pin-code every
+  60 seconds.
+
+Immediate MFA
+=============
+
+This method implements MFA directly using PAM during the initial SSH authentication phase, on the ingress
+side, e.g. when accounts are connecting to the bastion. This entirely resides on SSH/PAM and doesn't even depend
+on The Bastion code (appart from the setup side of the additional factor for each account).
+
+.. note::
+
+   Use this method if you want to enable MFA for some or all accounts unconditionally, regardless of which action
+   they're about to conduct on The Bastion (i.e. use an ``--osh`` command, or attempt to connect somewhere,
+   or just display the help). If you want to enable MFA only for some precise ``--osh`` commands or some remote hosts,
+   you'll want to use :ref:`jit_mfa` instead.
+
+This method requires proper configuration of both the SSH server, and PAM. The included templates of
+:file:`/etc/ssh/sshd_config` and :file:`/etc/pam.d/ssh` files do support it out of the box.
+
+Detailed explanation of the SSH server and PAM configuration
+************************************************************
+
+This works by modifying the ``AuthenticationMethods`` in :file:`sshd_config` to add ``keyboard-interactive:pam``,
+which instructs the SSH server to rely on PAM for part of the authentication phase. Then, the PAM file defines
+several authentications methods, which include several factors that can be configured per-account.
+
+.. note::
+
+   You can skip this subsection if you're not interested in how this works exactly, but mainly want to know how
+   to setup MFA. If you're using the included :file:`sshd_config` and :file:`pam.d/ssh` templates unmodified,
+   which you are if you've followed the installation section, this will just work out of the box so you may skip
+   over the details and jump to :ref:`immediate_mfa_howto`.
+
+sshd_config snippet
+-------------------
+
+Let's take the last few lines of the :file:`ssh_config` file and explain them step by step. These are where the
+MFA logic is implemented. We've left the comments that can be found in the template, for clarity.
+
+.. code-block:: shell
+
+   # If 2FA has been configured for root, we force pubkey+PAM for it. If this is the case
+   # on your system, uncomment the next two lines (see
+   # https://ovh.github.io/the-bastion/installation/advanced.html#fa-root-authentication)
+   #Match User root
+   #    AuthenticationMethods publickey,keyboard-interactive:pam
+
+As explained in the comments within the file, this section (commented by default) refers to the MFA that can be
+configured on the ``root`` account to protect The Bastion's own system. This is out of the scope of this documenation
+section, as we're focusing on the users MFA here, so refer to the :ref:`installation/advanced:2fa root authentication`
+section if that's what you want to achieve.
+
+.. code-block:: shell
+
+   # Unconditionally skip PAM auth for members of the bastion-nopam group
+   Match Group bastion-nopam
+       AuthenticationMethods publickey
+
+The snipper above tells the SSH server to NOT rely on PAM (hence disable MFA) for accounts that are part of the
+``bastion-nopam`` group. This is an internal group that is used for accounts whose MFA setup has been set to
+bypass PAM authentication, with the following command:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh accountModify --account robot-sync --pam-auth-bypass yes
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ modify the configuration of an account
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Bypassing sshd PAM auth usage for this account...
+   │ ... done, this account will no longer use PAM for authentication
+   ╰────────────────────────────────────────────────────────────</accountModify>───
+
+This way, the account ``robot-sync`` will fall into the above configuration section ``Match`` case and end up
+only using classic ``publickey`` authentication, hence no MFA. As MFA is only meaningful for humans, use this setting
+for accounts that are used by any automated process you might have that interact with the bastion (for example using
+its :doc:`/using/api`).
+
+.. code-block:: shell
+
+   # if in one of the mfa groups AND the osh-pubkey-auth-optional group, use publickey+pam OR pam
+   Match Group mfa-totp-configd,mfa-password-configd Group osh-pubkey-auth-optional
+       AuthenticationMethods publickey,keyboard-interactive:pam keyboard-interactive:pam
+
+The snippet above tells SSH that for accounts having an authentication factor configured, namely either a TOTP or
+a password, and having the "public key is optional" flag, set by ``--osh accountModify --pubkey-auth-optional``,
+implies that those accounts can either authenticate through public key and an additional factor (through PAM),
+or through PAM only. In essence these accounts may use only a password, or a TOTP, or both, without having a
+public key in addition to the other factors. Hence, this is not MFA per-se, but is an additional functionaly available
+should you need this in your environment. You may remove (or comment) the two lines above if you're confident you'll
+never require the `pubkey-auth-optional` feature.
+
+.. code-block:: shell
+
+   # if in one of the mfa groups, use publickey AND pam
+   Match Group mfa-totp-configd,mfa-password-configd
+       AuthenticationMethods publickey,keyboard-interactive:pam
+
+The snippet above is the core of the mandatory MFA configuration of the SSH server: it instructs the SSH server to
+authenticate accounts that have at least one MFA factor configured with their public key first, then hand over the
+authentication phase to PAM to check the additional factors.
+
+.. code-block:: shell
+
+   # by default, always ask the publickey (no PAM)
+   Match All
+       AuthenticationMethods publickey
+
+Finally, the snippet above is for the general case, i.e. accounts not having MFA configured, in which case they're
+authenticated using their public key only.
+
+PAM ssh snippet
+---------------
+
+The template is `heavily commented<https://github.com/ovh/the-bastion/blob/master/etc/pam.d/sshd.debian12>`, line by line, please have a look at it if you want to know more.
+
+.. _immediate_mfa_howto:
+
+How to use Immediate MFA
+************************
+
+If you want to setup immediate MFA, you'll need to setup the SSH server and PAM configurations correctly, as explained
+above. If you installed the provided templates for both (which is the default), you're good to go.
+
+You may want either to enable MFA for *all* the accounts existing on your bastion, or only a subset of these users,
+read on the proper section below for each case.
+
+Requiring all users to setup their MFA
+--------------------------------------
+
+To ensure no user can use their account without configuring their MFA first, you have to set the ``accountMFAPolicy``
+option of :file:`bastion.conf` to either ``any-required``, ``totp-required`` or ``password-required``. Detailed
+information about this configuration setting is available
+:ref:`here <administration/configuration/bastion_conf:accountmfapolicy>`.
+
+When this setting is configured to any of the 3 above values, no interaction will be allowed on the bastion (such as
+using plugins or connecting to a remote asset) as long as the user didn't set up their MFA:
+
+.. code-block:: none
+
+    bssh --osh selfListAccesses
+    │ 
+    │ ⛔ Sorry johndoe, but you need to setup the Multi-Factor Authentication before using this bastion, please use either the `--osh selfMFASetupPassword' or the `--osh selfMFASetupTOTP' option, at your discretion, to do so
+
+The only allowed ``--osh`` commands allowed in such a case are ``help``, ``info`` and the two ones referenced in the
+above error message, precisely to be able to setup the MFA on the account.
+
+In this mode, if you want to exclude a few accounts from requiring MFA (if you have accounts that are used by
+automation or any other M2M workflow), you can do so using ``accountModify --pam-auth-bypass yes``.
+
+.. _immediate_mfa_subset_users:
+
+Requiring only a subset of users to setup their MFA
+---------------------------------------------------
+
+If instead of forcing all users to require MFA, you want to require a precise subset of users to have MFA, you should
+leave the ``accountMFAPolicy`` to ``enabled``, and set the requirement flag on a per-account basis. This can be
+done using ``accountModify --mfa-password-required yes`` and/or ``accountModify --mfa-totp-required yes``. If you
+set both flags on the same account, the bastion will require both factors to be set and provided on authentication,
+in addition to publickey authentication. In this case, 3 authentication factors would be required. This is why we
+call it *MFA* instead of *2FA*: the number of additional factors you want is configurable.
+
+.. _jit_mfa:
+
+JIT MFA
+=======
+
+This method implements MFA checking right before an action is allowed, depending on the bastion policy, instead of
+requiring it at the ingress authentication stage.
+
+.. note::
+
+   Use this method if you want to enable MFA on a per-action basis. In this case, The Bastion will decide whether
+   providing additional authentication factors is required right before a specific action is requested (such as
+   connection to a given remote asset, or execution of a subset of ``--osh`` commands).
+   You may also want to use this method if for some reason you can't setup the :file:`sshd_config` file
+   as required by the *Immediate MFA* method
+
+Note that the different ways detailed below can be cumulated: you might want to enable MFA for a few plugins, along
+with enabling it for sensitive remote hosts present in specific bastion groups, in addition to a few sensitive
+accounts that would require it no matter what.
+
+.. _jit_mfa_sshd_config:
+
+Proper setup of sshd_config
+***************************
+
+To use `JIT MFA`, your first have to disable `Immediate MFA`, as is the default if you're using the provided
+configuration template for your SSH server (which you are if you followed the default installation steps).
+You'll need to comment out two lines within the :file:`/etc/ssh/sshd_config` file, these are located near the
+end of the file:
+
+.. code-block:: shell
+
+   # if in one of the mfa groups, use publickey AND pam
+   #Match Group mfa-totp-configd,mfa-password-configd
+   #    AuthenticationMethods publickey,keyboard-interactive:pam
+
+You'll need to reload the SSH daemon for this to be taken into account. The next subsections explain how to setup
+policies depending on the actions you want to protect through `JIT MFA`.
+
+On a per-plugin basis
+*********************
+
+First ensure you've followed the :ref:`jit_mfa_sshd_config`.
+
+To force MFA for a plugin, you may add the ``mfa_required`` option to its configuration. This configuration parameter
+allows 4 values:
+
+- `any`, in which case MFA is required with any supported factor (currently either password or TOTP)
+- `password`, in which case a password is required in addition to publickey authentication
+- `totp`, in which case a TOTP is required in addition to publickey authentication
+- `none`, in which case no MFA is required (which is the default if the ``mfa_required`` setting is omitted)
+
+To enable MFA for the ``adminSudo`` plugin, for example, you may add:
+
+.. code-block:: shell
+
+   {
+      "mfa_required": "any"
+   }
+
+to the :file:`/etc/bastion/plugin.adminSudo.conf` file. Please ensure that this file is readable by the
+``bastion-users`` system group (as all :file:`/etc/bastion/plugin.*.conf` files should be), so that the code running
+under the bastion users permissions can read it.
+
+When configured like this, usage of the adminSudo plugin, in our example, will trigger the validation of additional
+authentication factors.
+Note that for this to work, you must have the :file:`/etc/pam.d/ssh` file set up correctly,
+as we're using PAM for this. The provided template is advised, and you're already using it if you followed the
+default installation steps.
+If you are not sure you're using the provided template, you may compare your current :file:`/etc/pam.d/ssh` file
+with the proper template for your distro, which can be found in :file:`/opt/bastion/etc/pam.d/sshd.*`.
+
+As you see, the MFA phase will be fired up for this plugin, but not for the ``info`` plugin for example:
+
+.. code-block:: none
+   :emphasize-lines: 1,7
+
+   bssh --osh adminSudo
+   As this is required to run this plugin, entering MFA phase for johndoe.
+   Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+   Your password expires on 2023/10/31, in 89 days
+   Password: ^C
+
+   bssh --osh info
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ information
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ You are johndoe
+   [...]
+
+On a per-group basis
+********************
+
+First ensure you've followed the :ref:`jit_mfa_sshd_config`.
+
+If you want to ensure that MFA is required to connect to a remote host through a bastion group,
+you should tag this group to require MFA. To do this, use the ``groupModify`` command:
+
+.. code-block:: none
+   :emphasize-lines: 1,9,18
+
+   guybrush@bastion1(master)> groupModify --group securegroup --mfa-required any
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ modify the configuration of a group
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Modifying mfa-required policy of group...
+   │ ... done, policy is now: any
+   ╰──────────────────────────────────────────────────────────────</groupModify>───
+
+   guybrush@bastion1(master)> groupInfo --group securegroup
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ group info
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Group securegroup's Owners are: guybrush
+   [...]
+   │ ❗ MFA Required: when connecting to servers of this group, users will be asked for an additional authentication factor
+   [...]
+
+   guybrush@bastion1(master)> ssh root@127.1.2.3
+   │ Welcome to bastion1, guybrush, your last login was 00:00:27 ago (Wed 2023-08-02 15:36:03 UTC) from 172.17.0.1(172.17.0.1)
+   [...]
+
+    will try the following accesses you have: 
+     - group-member of securegroup with ED25519-256 key SHA256:94yETEnnWUy9yTG1dgAdXgunq6zzJPjlddFXjUH0Czw [2023/03/03]  (MFA REQUIRED: ANY)
+
+   As this is required for this host, entering MFA phase for guybrush.
+   Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+   Your password expires on 2023/10/31, in 89 days
+   Password: 
+
+As you see, after setting the flag on the group, attempting to access an asset that is part of the group (see
+``groupListServers``) will require MFA.
+
+.. note::
+
+   If an account has access to an asset via several groups, MFA will be required if at least one group requires it.
+   Hence, a good way to ensure that all connections to an asset will require MFA would be to list the
+   SSH keys on the remote server, match those to groups on the bastion, and ensure they all have ``--mfa-required`` enabled.
+
+On a per-account basis
+**********************
+
+You may also use this method to enable MFA on a per-account basis (as is possible with the `Immediate MFA` method).
+
+To do this, you should follow the same steps than are outlined in the :ref:`immediate_mfa_subset_users` subsection of the `Immediate MFA` setup.
+
+The only difference will be in your :file:`sshd_config` file, as for `JIT MFA` your should ensure you've followed the :ref:`jit_mfa_sshd_config`.
+
+In the case of `Immediate MFA`, the uncommented :file:`sshd_config` file block asks the SSH server to hand over authentication to PAM, hereby
+requiring MFA at the authentication phase. For the `JIT MFA` on a per-account basis, this configuration is disabled, but the bastion code, after the
+authentication phase is over, verifies whether the account requires to provide additional authentication factors, and triggers a PAM call if this
+is the case.
+
+Bypassing MFA for automated workflows
+*************************************
+
+If you have accounts that are used for automation, you'll want to exclude them from requiring MFA.
+
+To do this, use ``--osh accountModify --mfa-password-required bypass --mfa-totp-required bypass``. Accounts
+with this setting will no longer require to enter additional credentials even when the policy of `JIT MFA` would
+require them to.
+
+Additional information
+======================
+
+MFA and interactive mode
+************************
+
+When using the interactive mode, and `JIT MFA`, attempting to conduct an action that requires MFA will trigger the MFA authentication phase, as expected.
+
+However, when multiple MFA-required operations are to be done back to back, as is often the case when interactive mode
+is used, the MFA authentication phase will be triggered for each and every action, which can be cumbersome.
+
+As long as :ref:`administration/configuration/bastion_conf:interactivemodeproactivemfaenabled` is true, users can use the **mfa** command in interactive
+mode, to trigger the MFA authentication phase proactively, and enter an elevated session that will not require to enter MFA again. This elevated session
+will expire after :ref:`administration/configuration/bastion_conf:interactivemodeproactivemfaexpiration` seconds (15 minutes by default). Users can exit
+the elevated session manually by typing **nomfa**.
+
+Here is how it looks like:
+
+.. code-block:: none
+   :emphasize-lines: 1,8,12,18,24,27
+
+   bssh -i
+
+   Welcome to bastion1 interactive mode, type `help' for available commands.
+   You can use <tab> and <tab><tab> for autocompletion.
+   You'll be disconnected after 60 seconds of inactivity.
+   Loading... 90 commands and 0 autocompletion rules loaded.
+
+   guybrush@bastion1(master)> mfa
+   As proactive MFA validation has been requested, entering MFA phase.
+   Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+   Your password expires on 2023/10/31, in 88 days
+   Password: 
+   pamtester: successfully authenticated
+   Proactive MFA enabled, any command requiring MFA from now on will not ask you again.
+   This mode will expire in 00:15:00 (Thu 2023-08-03 12:35:08 UTC)
+   To exit this mode manually, type 'nomfa'.
+
+   guybrush@bastion1(master)[MFA-OK]> groupAddServer
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ adding a server to a group
+   ├───────────────────────────────────────────────────────────────────────────────
+   [...]
+
+   guybrush@bastion1(master)[MFA-OK]> nomfa
+   Your proactive MFA validation has been forgotten.
+
+   guybrush@bastion1(master)> 
+
+
+As you seen, once ``mfa`` has been entered and the MFA validated, the prompt changes to ``[MFA-OK]`` implying that
+any command usually requiring MFA will not ask for it again (such as ``groupAddServer`` in the above example, as
+we've configured it to). We then explicitely exit the MFA elevated session by entering ``nomfa``.
+
+MFA and --osh batch
+*******************
+
+The :doc:`/plugins/open/batch` plugin is useful to enter several ``--osh`` commands in a batch way. However, if
+any of those commands require MFA, it would ask us repeatedly for our MFA, which can be cumbersome.
+
+To avoid this behavior, and if you know that some of the commands you want to use in batch more will require MFA,
+you may use the ``--proactive-mfa`` option to the bastion, which will ask for your MFA *before* executing the
+:doc:`/plugins/open/batch` plugin, and any command requiring MFA will not ask for it again:
+
+.. code-block:: none
+   :emphasize-lines: 1,6
+
+   bssh --proactive-mfa --osh batch
+
+   As proactive MFA has been requested, entering MFA phase for guybrush.
+   Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+   Your password expires on 2023/11/01, in 89 days
+   Password: 
+   pamtester: successfully authenticated
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ batch
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Feed me osh commands line by line on stdin, I'll execute them sequentially.
+   │ Use 'exit', 'quit' or ^D to stop.
+   │ --- waiting for input
+   [...]
+
diff --git a/_sources/administration/security_advisories.rst.txt b/_sources/administration/security_advisories.rst.txt
new file mode 100644
index 000000000..31f8ef091
--- /dev/null
+++ b/_sources/administration/security_advisories.rst.txt
@@ -0,0 +1,13 @@
+Security Advisories
+===================
+
+This section contains all the security advisories since The Bastion has been published.
+
+If you find any behavior or bug that you suspect might have a security impact, please
+`report it here <https://github.com/ovh/the-bastion/security>`_.
+
+.. toctree::
+   :maxdepth: 1
+   :caption: CVE List
+
+   security_advisories/cve_2023_45140.rst
diff --git a/_sources/administration/security_advisories/cve_2023_45140.rst.txt b/_sources/administration/security_advisories/cve_2023_45140.rst.txt
new file mode 100644
index 000000000..2d9310e75
--- /dev/null
+++ b/_sources/administration/security_advisories/cve_2023_45140.rst.txt
@@ -0,0 +1,79 @@
+==============
+CVE-2023-45140
+==============
+
+- ``Severity``: **4.8** (CVSS V3)
+- ``Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N``
+- ``Affected versions``: from 3.0.0 included to 3.14.15 excluded
+- ``Patched versions``: 3.14.15 and up
+
+`This advisory is also available online <https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x>`_.
+
+Summary
+=======
+
+SCP and SFTP plugins don't honor group-based and account-based JIT MFA.
+
+Details
+=======
+Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to `per-group-based JIT MFA <https://ovh.github.io/the-bastion/administration/mfa.html#on-a-per-group-basis>`_ and `JIT MFA on a per-account basis <https://ovh.github.io/the-bastion/administration/mfa.ht↪·ml#on-a-per-account-basis>`_.
+
+Other MFA setup types, such as `Immediate MFA <https://ovh.github.io/the-bastion/administration/mfa.html#immediate-mfa>`_ and `JIT MFA on a per-plugin basis <https://ovh.github.io/the-bastion/administration/mfa.html#on-a-per-plugin-basis>`_ are not affected.
+
+Normal SSH access (i.e. not SCP nor SFTP) is not affected.
+
+How to reproduce for group-based JIT MFA
+========================================
+- Create a group
+- Apply ``groupModify --mfa-required any`` to this group
+- Grant SSH access to someone via this group on a given IP
+- Grant ``scp`` download right (or ``sftp`` right) to the same person via this group on the same IP
+- This group should now force MFA for any connection of the person allowed through the group's rights set. This is the case for SSH, but not for SCP or SFTP as would be expected.
+
+How to reproduce for account-based JIT MFA
+==========================================
+- Create an account
+- Apply ``accountModify --personal-egress-mfa-required any`` to this account
+- Grant a personal SSH access to this account on a given IP
+- Grant ``scp`` download right (or ``sftp`` right) to the same account via their personal access on the same IP
+- This account should now have forced MFA for any egress connection allowed through their personal rights set. This is the case for SSH, but not for SCP or SFTP as would be expected.
+
+Impact for group-based JIT MFA
+==============================
+For an actor to be able to bypass MFA for scp/sftp to a given remote server, ALL the following conditions must apply:
+
+- The target server must be part of a group (and have the egress group's public key trusted in its :file:`authorized_keys` file)
+- The group must have JIT MFA enabled on it (through ``groupModify --mfa-required any``)
+- The actor must have an account on the bastion
+- The actor must be a member of the group (granted by the groups's gatekeepers)
+- scp and/or sftp must be globally enabled on the bastion (this is the default)
+- scp and/or sftp must be explicitly allowed to the given remote server through the group (granted by the groups's aclkeepers)
+
+When all conditions above apply, the actor would be able to use scp or sftp on the target server without requiring to provide an additional factor where it should.
+
+Impact for account-based JIT MFA
+================================
+For an actor to be able to bypass MFA for scp/sftp to a given remote server, ALL the following conditions must apply:
+
+- The target server must be part of the actor's account personal accesses (and have the account's egress public key trusted in its :file:`authorized_keys` file)
+- The account must have JIT MFA enabled on it (through ``accountModify --personal-egress-mfa-required any``)
+- scp and/or sftp must be globally enabled on the bastion (this is the default)
+- scp and/or sftp must be explicitly allowed to the given remote server through this account's personal accesses (granted by either ``selfAddPersonalAccess`` or ``accountAddPersonalAccess``)
+
+When all conditions above apply, the actor would be able to use scp or sftp on the target server without requiring to provide an additional factor where it should.
+
+Mitigation
+==========
+If you don't use the `per-group-based JIT MFA <https://ovh.github.io/the-bastion/administration/mfa.html#on-a-per-group-basis>`_ on any of your groups (through ``groupModify --mfa-required``), and don't use the `JIT MFA on a per-account basis <https://ovh.gi↪·thub.io/the-bastion/administration/mfa.ht↪·ml#on-a-per-account-basis>`_ (through ``accountModify --personal-egress-mfa-required``), you don't need to mitigate the issue as you don't use the impacted feature (see above for impact details).
+
+Otherwise, if you can't immediately upgrade to v3.14.15 or more recent, and you feel that the aforementioned impacts are important enough in your environment, you may choose to temporarily disable the ``scp`` and ``sftp`` plugins globally on the bastion, by setting ``"disabled": true`` in these plugins configuration files, which can be found in :file:`/etc/bastion/plugin.scp.conf` and :file:`/etc/bastion/plugin.sftp.conf` respectively. If these files don't exist, create them with the contents as ``{ "disabled": true }``. They should be readable by anyone but modifiable only by root (i.e. ``chmod 664; chown root:root``)
+
+Timeline
+========
+
+- 2023-10-06: security bug report filed on GitHub
+- 2023-10-06: bug report accepted and confirmed as having a security impact
+- 2023-10-11: CVE ID requested
+- 2023-10-11: CVE ID assigned
+- 2023-11-07: fix pushed to a private fork for review
+- 2023-11-08: v3.14.15 released with the fix
diff --git a/_sources/development/setup.rst.txt b/_sources/development/setup.rst.txt
new file mode 100644
index 000000000..e00926564
--- /dev/null
+++ b/_sources/development/setup.rst.txt
@@ -0,0 +1,190 @@
+Environment setup
+=================
+
+.. contents::
+
+This documentation section outlines the few steps needed to build a development environment for The Bastion,
+easing code modification, tests, checks, and ultimately, pull requests.
+
+Available tools
+***************
+
+The provided :file:`docker/devenv/run-tool.sh` script will build a development docker for you, under which it'll
+run several tools. Your local git folder will be mounted as a volume inside this docker so that it can
+access the files, and potentially modify them (such as for ``perltidy``).
+
+The supported tools are as follows:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   Usage: ./docker/devenv/run-tool.sh COMMAND [OPTIONS]
+
+     COMMAND may be one of the following:
+
+     tidy       [FILES..] runs perltidy on several or all the Perl source files, modifying them if needed
+     tidycheck  [FILES..] runs perltidy in dry-run mode, and returns an error if files are not tidy
+     perlcritic           runs perlcritic on all the Perl source files
+     shellcheck [FILES..] runs shellcheck on all the shell source files
+     lint                 runs tidy, perlcritic and shellcheck on all files in one command
+     doc                  generates the documentation
+     sphinx-view-objects  shows the named objects of the Sphinx documentation that can be referenced
+     rebuild              forces the rebuild of the devenv docker image that is needed to run all the above commands
+     run <COMMAND>        spawn an interactive shell to run any arbitrary command in the devenv docker
+     doc-serve <PORT>     starts a local HTTP python server on PORT to view generated documentation
+
+Before submitting a pull request, you'll need at minimum to run ``lint``. It might be a good idea to setup a
+git pre-commit hook to do this on modified files, see below.
+
+Git pre-commit hook
+*******************
+
+Some lint checks are enforced through GitHub Actions, but it'll save you a lot of back-and-forth if you ensure that
+these checks are passing locally on your development environment.
+
+To this effect, you'll need to setup pre-commit hooks on your local copy of the git repository, so that your code
+is automatically checked by ``perlcritic``, ``perltidy`` and ``shellcheck`` each time you commit.
+
+If you previously cloned the repository with such a command:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   git clone https://github.com/ovh/the-bastion
+
+Then you can copy the provided :file:`pre-commit` script into your local :file:`.git` folder:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   cp contrib/git/pre-commit .git/hooks/pre-commit
+
+To verify that it works checkout a new test branch and add two dummy files like this:
+
+.. code-block:: none
+   :emphasize-lines: 1-5
+
+   git checkout -B mybranch
+   printf "%b" "#! /usr/bin/env bash\nunused=1\n" > bin/shell/dummy.sh
+   printf "%b" "#! /usr/bin/env perl\nsub dummy { 1; };\n" > lib/perl/dummy.pm
+   git add bin/shell/dummy.sh lib/perl/dummy.pm
+   git commit -m dummy
+
+   *** Checking shell files syntax using system shellcheck
+   `-> bin/shell/dummy.sh
+
+   In bin/shell/dummy.sh line 2:
+   unused=1
+   ^----^ SC2034: unused appears unused. Verify use (or export if used externally).
+
+   `-> [ERR.] 
+
+   ERROR: shell-check failed on bin/shell/dummy.sh
+   *** Checking perl tidiness
+   `-> lib/perl/dummy.pm
+   ./lib/perl/dummy.pm ./lib/perl/dummy.pm.tdy differ: char 38, line 2
+   --- ./lib/perl/dummy.pm 2023-10-03 08:19:55.605950307 +0000
+   +++ ./lib/perl/dummy.pm.tdy     2023-10-03 08:20:43.618577295 +0000
+   @@ -1,2 +1,2 @@
+    #! /usr/bin/env perl
+   -sub dummy { 1; };
+   +sub dummy { 1; }
+
+   ERROR: perl tidy failed on lib/perl/dummy.pm
+
+   !!! COMMIT ABORTED !!!
+   If you want to commit nevertheless, use -n.
+
+As you see, the checks are running before the commit is validated and abort it should any check fail.
+
+Running integration tests
+*************************
+
+Using Docker
+------------
+
+Functional tests use ``Docker`` to spawn an environment matching a bastion install.
+One of the docker instances will be used as client, which will connect to the other instance
+which is used as the bastion server. The client instance sends commands to the server instance
+and tests the return values against expected output.
+
+To test the current code, use the following script, which will run ``docker build`` and launch the tests:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   tests/functional/docker/docker_build_and_run_tests.sh <TARGET>
+
+Where target is one of the supported OSes. Currently only Linux targets are supported.
+You'll get a list of the supported targets by calling the command without argument.
+
+For example, if you want to test it under Debian (which is a good default OS if you don't have any preference):
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   tests/functional/docker/docker_build_and_run_tests.sh debian12
+
+The full tests usually take 25 to 50 minutes to run, depending on your hardware specs.
+If you want to launch only a subset of the integration tests, you may specify it:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   tests/functional/docker/docker_build_and_run_tests.sh debian12 --module=320-base.sh
+
+Other options are supported, and passed through as-is to the underlying test script, use ``--help`` as below to
+get the list (the output in this documentation might not be up to date, please actually launch it yourself
+to get up-to-date information):
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   tests/functional/launch_tests_on_instance.sh --help
+
+   Usage: /home/user/bastion/tests/functional/launch_tests_on_instance.sh [OPTIONS] <IP> <SSH_Port> <HTTP_Proxy_Port_or_Zero> <Remote_Admin_User_Name> <Admin_User_SSH_Key_Path> <Root_SSH_Key_Path>
+
+   Test Options:
+       --skip-consistency-check   Speed up tests by skipping the consistency check between every test
+       --no-pause-on-fail         Don't pause when a test fails
+       --log-prefix=X             Prefix all logs by this name
+       --module=X                 Only test this module (specify a filename found in `functional/tests.d/`), can be specified multiple times
+
+   Remote OS directory locations:
+       --remote-etc-bastion=X     Override the default remote bastion configuration directory (default: /etc/bastion)
+       --remote-basedir=X         Override the default remote basedir location (default: /home/user/bastion)
+
+   Specifying features support of the underlying OS of the tested bastion:
+       --has-ed25519=[0|1]        Ed25519 keys are supported (default: 1)
+       --has-mfa=[0|1]            PAM is usable to check passwords and TOTP (default: 1)
+       --has-mfa-password=[0|1]   PAM is usable to check passwords (default: 0)
+       --has-pamtester=[0|1]      The `pamtester` binary is available, and PAM is usable (default: 1)
+       --has-piv=[0|1]            The `yubico-piv-tool` binary is available (default: 1)
+       --has-sk=[0|1]             The openssh-server supports Secure Keys (FIDO2) (default: 0)
+
+Without Docker
+--------------
+
+.. note::
+
+   This method is discouraged, prefer using the Docker method above when possible
+
+You can test the code against a BSD (or any other OS) without using Docker, by spawning a server
+under the target OS (for example, on a VM), and installing the bastion on it.
+
+Then, from another machine, run:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   test/functional/launch_tests_on_instance.sh <IP> <port> <remote_user_name> <ssh_key_path> [outdir]
+
+Where ``IP`` and ``port`` are the information needed to connect to the remote server to test,
+``remote_user_name`` is the name of the account created on the remote bastion to use for the tests,
+and ``ssh_key_path`` is the private SSH key path used to connect to the account.
+The ``outdir`` parameter is optional, if you want to keep the raw output of each test.
+
+This script is also the script used by the Docker client instance,
+so you're sure to get the proper results even without using Docker.
+
+Please do **NOT** run any of those tests on a production bastion!
diff --git a/_sources/development/tests.rst.txt b/_sources/development/tests.rst.txt
new file mode 100644
index 000000000..e1672128a
--- /dev/null
+++ b/_sources/development/tests.rst.txt
@@ -0,0 +1,180 @@
+Writing tests
+=============
+
+.. contents::
+
+When modifying code, adding features or fixing bugs, you're expected to write one or more tests to ensure that
+the feature your adding works correctly, or that the bug you've fixed doesn't come back.
+
+Integration tests modules live in the :file:`tests/functional/tests.d` folder.
+You may either add a new file to test your feature, or modify an existing file.
+
+These modules are shell scripts, and are sourced by the main integration test engine. Having a look at one of
+these modules will help you understand how they work, the :file:`tests/functional/tests.d/320-base.sh` is a good
+example you might want to look at.
+
+Example
+-------
+
+Here is a simple test taken from :file:`320-base.sh`:
+
+.. code-block:: none
+   :caption: a simple test
+
+   success   help2     $a0 --osh help
+   contain "OSH help"
+   json .error_code OK .command help .value null
+
+A complete reference of such commands can be found below, but let's explain this example in a few words:
+
+The command ``success`` implies that we're running a new test command, and that we expect it to work (we might
+also want to test invalid commands and ensure they fail as they should).
+The tester docker will connect to the target docker (that is running the bastion code) as a bastion user, and
+run the ``--osh help`` command there. This is expected to exit with a code indicating success (0),
+otherwise this test fails.
+
+The output of the command, once run on the bastion, should contain the text ``OSH help``, or the test will fail.
+
+In the JSON output (see :doc:`/using/api`) of this command, we expect to find the ``error_code`` field set to ``OK``,
+the ``command`` field set to ``help``, and the ``value`` field set to ``null``, or the test will fail.
+
+Running just this test will yield the following output:
+
+.. code-block:: none
+   :caption: a simple test output
+
+   00m04 [--] *** [0010/0021] 320-base::help2 (timeout --foreground 30 ssh -F /tmp/bastiontest.pgoA5h/ssh_config -i /tmp/bastiontest.pgoA5h/account0key1file user.5000@bastion_debian10_target -p 22 -- --json-greppable --osh help)
+   00m05 [--] [ OK ] RETURN VALUE (0)
+   00m05 [--] [ OK ] MUST CONTAIN (OSH help)
+   00m05 [--] [ OK ] JSON VALUE (.error_code => OK) [  ]
+   00m05 [--] [ OK ] JSON VALUE (.command => help) [  ]
+   00m05 [--] [ OK ] JSON VALUE (.value => null) [  ]
+
+As you can see, this simple test actually checked 5 things: the return value, whether the output text contained
+a given string, and 3 fields of the JSON output.
+
+Reference
+---------
+
+These are functions that are defined by the integration test engine and should be used in the test modules.
+
+Launch a test
+*************
+
+run
++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - run <name> <command>
+
+This function runs a new test named ``<name>``, which will execute ``<command>`` on the tester docker.
+Usually ``<command>`` will connect to the target docker (running the bastion code) using one of the test accounts,
+and run a command there.
+
+A few accounts are preconfigured:
+
+- The main account ("account 0"): this one is guaranteed to always exist at all times, and is a bastion admin.
+  There are a few variables that can be referenced to use this account:
+
+  - ``$a0`` is the ssh command-line to connect to the remote bastion as this account
+  - ``$account0`` is the account name, to be used in parameters of ``--osh`` commands where needed
+
+- A few secondary accounts that are created, deleted, modified during the tests:
+
+  - ``$a1``, ``$a2`` and ``$a3`` are the ssh command-lines to connect to the remote bastion as these accounts
+  - ``$account1``, ``$account2`` and ``$account3`` are the accounts names
+
+- Another special non-bastion-account command exists:
+
+  - ``$r0`` is the required command-line to directly connect to the remote docker on which the bastion code is running,
+    as root, with a bash shell. Only use this to modify the remote bastion files, such as config files, between tests
+
+A few examples follow:
+
+.. code-block:: none
+   :caption: running a few test commands
+
+   run test1 $a0 --osh info
+   run test2 $a0 --osh accountInfo --account $account1
+   run test3 $a1 --osh accountDelete --account $account2
+
+Note that the ``run`` function just runs the given command, but doesn't check whether it exited normally, you'll
+need other functions to verify this, see below.
+
+success
++++++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - success <name> <command>
+
+This function is exactly the same as the ``run`` command above, except that it expects the given ``<command>`` to
+return a valid error code (zero). Most of the time, you should be using this instead of ``run``, except if you're
+expecting the command to fail, in which case you should use ``run`` + ``retvalshouldbe``, see below.
+
+plgfail
++++++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - plgfail <name> <command>
+
+This function is exactly the same as the ``run`` command above, except that it expects the given ``<command>`` to
+return an error code of 100, which is the standard exit value when an osh command fails.
+
+This function is equivalent to using ``run`` followed by ``retvalshouldbe 100`` (see below).
+
+Verify a test validity
+**********************
+
+retvalshouldbe
+++++++++++++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - retvalshouldbe <value>
+
+Verify that the return value of a test launched right before with the ``run`` function is ``<value>``.
+You should use this if you expect the previous test to return a non-zero value.
+
+Note that the ``success`` function is equivalent to using ``run`` followed by ``retvalshouldbe 0``.
+
+contain
++++++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - contain <text>
+   - contain REGEX <regex>
+
+This function verifies that the output of the test contains a given ``<text>``. If you need to use a regex
+to match the output, you can use the ``contain REGEX`` construction, followed by the regex.
+
+nocontain
++++++++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - nocontain <text>
+   - nocontain REGEX <regex>
+
+This function does the exact opposite of the ``contain`` function just above, and ensure that a given text
+or regex is NOT present in the output.
+
+json
+++++
+
+.. admonition:: syntax
+   :class: cmdusage
+
+   - json <field1> <value1> [<field2> <value2> ...]
+
+This function checks the JSON API output of the test, and validates that it contains the correct value for each
+specified field. The ``<fieldX>`` entries must be valid `jq` filters.
diff --git a/_sources/faq.rst.txt b/_sources/faq.rst.txt
new file mode 100644
index 000000000..5c7201207
--- /dev/null
+++ b/_sources/faq.rst.txt
@@ -0,0 +1,172 @@
+===
+FAQ
+===
+
+"The Bastion", really?
+======================
+
+We've been using this software for quite a while at OVHcloud, and there it has always been known as "the bastion":
+nobody ever bothered to find a fancy name for it.
+So, when we decided to release it in opensource, the naming problem arose.
+After going through some possible names, we realized that nothing would work, as everybody would keep
+naming it "the bastion" anyway, so, we decided to call it just *The Bastion*.
+
+Why using common::sense?
+========================
+
+Because it's usually a good idea to ensure you use common::sense before writing code!
+On a more serious note, this is almost like using ``strict`` and ``warnings``,
+but with a very reduced memory footprint.
+When you run a bastion with thousands of simultaneous active sessions with that many users, it starts to matter.
+
+Why Perl?
+=========
+
+There is probably and endless list of why it's the perfect language for this,
+and another similarly endless list of why Perl is completely irrelevant and other $COOL_LANGUAGE would be a better fit,
+but some "why" reasons include:
+
+- It works everywhere, and most OSes have it installed by default
+- Perl has this cool "taint" mode that adds security to untrusted program inputs, we use this on sensitive code
+- One of the design choice of The Bastion has always been to be very close to the system,
+  leveraging some low-level Operating System functions, which are easier to interact with using a scripting language
+- The Bastion has a loose origin from an old script written at OVHcloud in the early days,
+  back when the de-facto usual language used internally was Perl
+
+Why not using a PKI?
+====================
+
+Well, you can, of course! However this is a very centralized way of managing your accesses,
+with all the power in the hands of whoever controls your CA.
+It can be a highly successful if done very carefully, with a lot of security and processes around the
+certificates delivery workflows. Managing a CA correctly is no joke and can bite you quite hard if done improperly.
+This also happens to be a somewhat recent addition to OpenSSH, and if you have a lot of heterogeneous
+systems to handle, this might be a no-go.
+You can read more about this topic here: https://blog.ovhcloud.com/the-ovhcloud-bastion-part-1/
+
+What does `osh` mean in ``--osh``?
+==================================
+
+This has long been forgotten. Some people say it used to mean "Ovh SHell" at some point,
+but nobody knows whether it's true or just a legend.
+
+What are the recommended hardware specifications?
+=================================================
+
+They're actually quite low. Down to its basics, the bastion is merely a fancy wrapper around ``ssh``,
+so if you have a device that handles ``ssh`` well, it'll handle the bastion just fine.
+
+Now to give you some data points, we've observed that 250 concurrent users take up 2.5 Gb of RAM (including
+the operating system's own footprint, and the usual daemons such as auditd, syslog, etc.).
+So a rule of thumb would be 1 Gb per 100 simultaneous sessions.
+If you expect to get a lot of new connections per minute (not necessarily long-lived),
+it's advised to use SSD drives however, as the bastion workload pattern for disk I/O is a lot of random seeks
+to write logs and ttyrecs. Mechanical hard drives are very bad at this.
+
+.. _faq_docker:
+
+Can I run it under Docker in production?
+========================================
+
+Technically you can, but you have to think about what are the implications (this is true regardless
+of the containerization technology). What's important to understand is that it adds another layer of abstraction,
+and can give you a false sense of security.
+If you either have the complete control of the host running Docker (and hardened it properly),
+or you fully trust whoever is running the host for you, then this is fine.
+Otherwise, *somebody* might have access to all your keys and you have no way to know or block it.
+
+Note that the provided Dockerfiles are a good start, but no volumes are defined.
+To ensure that all the accounts don't disappear on a ``docker rm``, you would at least need to ensure that
+``/home``, ``/etc/passwd``, ``/etc/shadow``, ``/etc/group``, ``/etc/gshadow`` are stored in a volume,
+in addition to ``/etc/bastion`` and ``/root/.gpg``.
+You'll also need an SSH server, obviously, and probably a ``syslog-ng`` daemon.
+
+.. _faq_existing_server:
+
+Can I install it on my already existing server?
+===============================================
+
+This is discouraged if your server is already doing something else, such as hosting a website,
+handling your e-mails or running a database.
+
+From a security standpoint, it's a bad idea because if your server gets hacked due to one of
+the other services you're hosting, the SSH keys could get compromised even if The Bastion itself has no security issue.
+
+This is also discouraged due to the design of The Bastion: being deeply intertwined with the OS it's running on,
+it might make changes that seem intrusive from the point of view of other running services.
+Such as creating and deleting system accounts and groups from time to time, modifying the PAM configuration,
+or hardening the SSH client and server configurations system-wide,
+which could break other services or workflows that expect to be running on a default (non-hardened) SSH configuration.
+
+.. _faq_jumphost:
+
+How to use The Bastion with the SSH ``ProxyCommand`` option?
+============================================================
+
+**tl;dr**: you can't.
+
+**Fast answer**: you can't, because The Bastion is not a proxy, nor what is often called an "ssh jumphost".
+Granted, sometimes these are also called "bastions", hence the confusion.
+Note that this also applies to the ``-J`` or ``JumpHost`` ssh option, which is just a simplified ``ProxyCommand``.
+
+**Long answer**: The Bastion is acting as a trusted party between you (the admin or the robot) and the server
+of the infrastructure you need to access. To achieve this, when you use the bastion to connect to the server,
+there are two distinct ssh connections present at the same time:
+
+ - The ingress ssh connection, between you and the bastion.
+   For this connection your local private ssh key is used to authenticate yourself to the bastion
+ - The egress ssh connection, between the bastion and the remote server you need to access.
+   For this connection your bastion egress private ssh key (or a group egress private ssh key you're member of)
+   is used to authenticate the bastion to the remote server
+
+Those two connections are distinct, and the bastion logic merges those two so that you're under the impression
+that you're directly connected to the remote server. There is no dynamic port forwarding happening on the bastion
+to enable access to the remote server from your desktop, network-wise (which is what ``JumpHost`` does).
+
+Using ``ProxyCommand`` with the bastion doesn't make sense because with this option, your local ssh client expects
+to talk the SSH dialect on the STDIN of the ProxyCommand you're giving, and it'll try to use your local SSH key
+to authenticate you through it, which won't work as it's only used for the ingress connection.
+However, when you use the usual bastion alias, in STDIN you have the remote server terminal directly,
+all the SSH stuff has already been done.
+
+Attempting to summarize this a bit would be: ``ProxyCommand`` and ``JumpHost`` are useful when the server
+you're trying to connect to can't be accessed *network-wise* from where you stand, and needs to be accessed
+through some kind of proxy instead, where The Bastion's logic is to use two distinct SSH connections,
+and two distinct authentication phases, with two distinct SSH keys (yours for the ingress connection,
+and your bastion egress key for the egress connection).
+
+What is *session locking*?
+==========================
+
+Session locking can be enabled in the global configuration, through the :ref:`idleLockTimeout` option.
+
+When enabled, the interactive SSH session will automatically lock itself after a defined amount of idle time.
+Unlocking such a session can be done, but re-authentication is required, i.e. connecting to the bastion
+from another console, and using the :doc:`/plugins/open/unlock` command.
+Here, idle time is defined as keyboard input idle time, so even if a remote command might be running
+(such as ``tail -f``), the connection will still be considered idle if no input is detected. This is by design.
+
+Such as configuration can be required by policy or regulations, in some sensitive environments,
+to ensure opened connections are automatically cut off when unused.
+Locking such sessions can be an alternative to cutting (see the :ref:`idleKillTimeout` option) as it gives
+a chance to unlock the session before tearing the connection down.
+Both can also be used, such as locking first, then tearing down after more time has passed without the session
+being unlocked. Note that while a session is locked, any potentially running remote command will still be running,
+as locking the session will just hide the normal console output, and prevent any input to be registered.
+Unlocking the session will simply resume display to the console.
+Session locking can be seen as the equivalent of a desktop screensaver, but for SSH interactive sessions.
+
+A locked session looks like this:
+
+.. image:: /img/locked_session.png
+
+Can I use Ansible over The Bastion?
+===================================
+
+Yes, you can, by using a wrapper available `here <https://github.com/ovh/the-bastion-ansible-wrapper>`_.
+
+Please note however that some Ansible modules may not use the builtin SSH command of Ansible,
+which we override with our wrapper, but some other mechanism we can't hook into.
+This is for example the case of the `network_cli` module of Ansible, which underneath uses Paramiko,
+a Python library to handle SSH connections, which prevents our wrapper to be used (see
+`this GitHub issue <https://github.com/ovh/the-bastion/issues/254>`_ for more information).
diff --git a/_sources/index.rst.txt b/_sources/index.rst.txt
new file mode 100644
index 000000000..0160c2115
--- /dev/null
+++ b/_sources/index.rst.txt
@@ -0,0 +1,107 @@
+=====================================
+Welcome to The Bastion documentation!
+=====================================
+
+.. warning::
+
+   This documentation is in a WIP status, some edges might be rough!
+
+Wait, what's a bastion exactly? (in 140-ish characters)
+=======================================================
+
+A so-called **bastion** is a machine used as a single entry point by operational teams (such as sysadmins, developers, devops, database admins, etc.) to securely connect to other machines of an infrastructure, usually using `ssh`.
+
+The bastion provides mechanisms for *authentication*, *authorization*, *traceability* and *auditability* for the whole infrastructure.
+
+Just yet another SSH relayhost/jumphost/gateway?
+************************************************
+
+No, The Bastion is an entirely different beast.
+
+The key technical difference between those and The Bastion is that it strictly stands between you and the remote server, operating a protocol break in the process, which enables unique features such as tty recording, proper access auditability, builtin access and groups management commands, delegation of responsibilities all the way through, etc.
+
+Advanced uses even include doing other things than just SSHing to a remote server.
+
+Those wouldn't be possible with a "simple" jumphost. More technical details on the difference :ref:`here <faq_jumphost>`.
+
+OK, tell me more!
+=================
+
+This documentation is organized in several sections. The first one is a **PRESENTATION** of the main functionalities, principles, and use cases of the bastion.
+
+The second section explains the **INSTALLATION** procedure, including how to set up a quick playground using Docker if you want to get your hands dirty quickly.
+
+The third section focuses on the **USAGE** of the bastion, from the perspective of the different roles, such as bastion users, group owners, bastion admins, etc.
+
+The fourth section is about the proper **ADMINISTRATION** of the bastion itself. If you're about to be the person in charge of managing the bastion for your company, you want to read that one carefully!
+
+The fifth section is about **DEVELOPMENT** and how to write code for the bastion. If you'd like to contribute, this is the section to read!
+
+The sixth section is the complete reference of all the **PLUGINS** that are the commands used to interact with the bastion accounts, groups, accesses, credentials, and more.
+
+The unavoidable and iconic FAQ is also available under the **PRESENTATION** section.
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Presentation
+
+   presentation/principles
+   presentation/features
+   presentation/security
+   faq
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Installation
+
+   installation/basic
+   installation/advanced
+   installation/upgrading
+   installation/docker
+   installation/restoring_from_backup
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Usage
+
+   using/basics/index
+   using/piv
+   using/sftp_scp
+   using/http_proxy
+   using/api
+   using/specific_ssh_clients_tutorials/index
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Administration
+
+   administration/configuration/index
+   administration/logs
+   administration/mfa
+   administration/security_advisories
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Development
+
+   development/setup
+   development/tests
+
+.. _plugins:
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Plugins
+
+   plugins/admin/index.rst
+   plugins/group-aclkeeper/index.rst
+   plugins/group-gatekeeper/index.rst
+   plugins/group-owner/index.rst
+   plugins/open/index.rst
+   plugins/restricted/index.rst
+
+Indices and tables
+==================
+
+* :ref:`genindex`
+* :ref:`search`
diff --git a/_sources/installation/advanced.rst.txt b/_sources/installation/advanced.rst.txt
new file mode 100644
index 000000000..796bb2d45
--- /dev/null
+++ b/_sources/installation/advanced.rst.txt
@@ -0,0 +1,530 @@
+=====================
+Advanced Installation
+=====================
+
+This section goes further in explaining how to setup your bastion.
+You should have completed the :doc:`basic installation<basic>` first.
+
+.. _installadv_gpg:
+
+Encryption & signature GPG keys
+===============================
+
+.. note::
+
+   This section is a prequisite to both the :ref:`installadv_encryptrsync` and the
+   :ref:`installadv_backup` steps further down this documentation
+
+There are 2 pairs of GPG keys being used by the bastion:
+
+- The *bastion GPG key*
+
+  * The **private** key is used by the **bastion** to **sign** the ttyrec files
+  * The **public** key is used by the **admins** to **verify** the signature and prove
+    non-repudiation and non-tampering of the ttyrec files
+
+- The *admins GPG key*
+
+  * The **public** key is used by the **bastion** to **encrypt** the backups and the ttyrec files
+  * The **private** key is used by the **admins** to **decrypt** the backups when
+    a restore operation is needed, and the ttyrec files
+
+Generating the bastion GPG key
+******************************
+
+Generate a GPG key that will be used by the bastion to sign files,
+this might take a while especially if the server is idle:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+    /opt/bastion/bin/admin/setup-gpg.sh --generate
+
+    gpg: directory `/root/.gnupg' created
+    gpg: Generating GPG key, it'll take some time.
+
+    Not enough random bytes available.  Please do some other work to give
+    the OS a chance to collect more entropy! (Need 39 more bytes)
+    ..........+++++
+    gpg: /root/.gnupg/trustdb.gpg: trustdb created
+    gpg: key A4480F26 marked as ultimately trusted
+    gpg: done
+    gpg: checking the trustdb
+    gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
+    gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
+
+    Configuration file /etc/bastion/osh-encrypt-rsync.conf.d/50-gpg-bastion-key.conf updated:
+    8<---8<---8<---8<---8<---8<--
+    # autogenerated with /opt/bastion/bin/admin/setup-gpg.sh at Wed Mar 21 10:03:08 CET 2018
+    {
+        "signing_key_passphrase": "************",
+        "signing_key": "5D3CFDFFA4480F26"
+    }
+    --->8--->8--->8--->8--->8--->8
+
+    Done.
+
+While it's working, you can proceed to the section below.
+
+Generating and importing the admins GPG key
+*******************************************
+
+You should import on the bastion one or more **public** GPG keys that'll be used for encryption.
+If you don't already have a GPG key for this, you can generate one. As this is the admin GPG key,
+don't generate it on the bastion itself, but on the desk of the administrator (you?) instead.
+
+If you're running a reasonably recent GnuPG version (and the bastion does, too),
+i.e. GnuPG >= 2.1.x, then you can generate an Ed25519 key by running:
+
+.. code-block:: shell
+   :emphasize-lines: 1-8
+
+    myname='John Doe'
+    email='jd@example.org'
+    bastion='mybastion4.example.org'
+    pass=$(pwgen -sy 12 1)
+    echo "The passphrase for the key will be: $pass"
+    gpg --batch --pinentry-mode loopback --passphrase-fd 0 --quick-generate-key "$myname <$email>" ed25519 sign 0 <<< "$pass"
+    fpr=$(gpg --list-keys "$myname <$email>" | grep -Eo '[A-F0-9]{40}')
+    gpg --batch --pinentry-mode loopback --passphrase-fd 0 --quick-add-key "$fpr" cv25519 encr 0 <<< "$pass"
+
+    gpg: key 3F379CA7ECDF0537 marked as ultimately trusted
+    gpg: directory '/home/user/.gnupg/openpgp-revocs.d' created
+    gpg: revocation certificate stored as '/home/user/.gnupg/openpgp-revocs.d/3DFB21E3857F562A603BD4F83F379CA7ECDF0537.rev'
+
+
+If you or the bastion is using an older version of GnuPG, or you are unsure and/or prefer compatibility
+over speed or security, you can fallback to an RSA 4096 key:
+
+.. code-block:: shell
+   :emphasize-lines: 1-9
+
+    myname='John Doe'
+    email='jd@example.org'
+    bastion='mybastion4.example.org'
+    pass=`pwgen -sy 12 1`
+    echo "The passphrase for the key will be: $pass"
+    printf "Key-Type: RSA\nKey-Length: 4096\nSubkey-Type: RSA\nSubkey-Length: 4096\n" \
+      "Name-Real: %s\nName-Comment: %s\nName-Email: %s\nExpire-Date: 0\n" \
+      "Passphrase: %s\n%%echo Generating GPG key\n%%commit\n%%echo done\n" \
+      "$myname ($bastion)" $(date +%Y) "$email" "$pass" | gpg --gen-key --batch
+
+    The passphrase for the key will be: ************
+    gpg: Generating GPG key
+
+    Not enough random bytes available.  Please do some other work to give
+    the OS a chance to collect more entropy! (Need 119 more bytes)
+    .....+++++
+
+    gpg: key D2BDF9B5 marked as ultimately trusted
+    gpg: done
+
+Of course, in both snippets above, adjust the ``myname``, ``email`` and ``bastion`` variables accordingly.
+Write down the passphrase in a secure vault. All bastions admins will need it if they are to decrypt ttyrec files
+later for inspection, and also decrypt the backup should a restore be needed.
+When the key is done being generated, get the public key with:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   gpg -a --export "$myname <$email>"
+
+Copy it to your clipboard, then back to the bastion, paste it at the following prompt:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+    /opt/bastion/bin/admin/setup-gpg.sh --import
+
+Also export the private admins GPG key to a secure vault (if you want the same key to be shared by the admins):
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+    gpg --export-secret-keys --armor "$myname <$email>"
+
+.. _installadv_encryptrsync:
+
+Rotation, encryption & backup of ttyrec files
+=============================================
+
+.. note::
+
+   The above section :ref:`installadv_gpg` is a prerequisite to this one
+
+The configuration file is located in ``/etc/bastion/osh-encrypt-rsync.conf``.
+You can ignore the ``signing_key``, ``signing_key_passphrase`` and ``recipients`` options,
+as these have been auto-filled when you generated the GPG keys, by dropping configuration files
+in the ``/etc/bastion/osh-encrypt-rsync.conf.d`` directory.
+Any file there takes precedence over the global configuration file.
+
+Once you are done with your configuration, you might want to test it by running:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+
+Or even go further by starting the script in dry-run mode:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/cron/osh-encrypt-rsync.pl --dry-run
+
+
+.. _installadv_backup:
+
+Configuring keys, accounts & groups remote backup
+=================================================
+
+.. note::
+
+   The above section :ref:`installadv_gpg` is a prerequisite to this one, otherwise your backups will NOT
+   be automatically encrypted, which is something you probably want to avoid.
+
+Everything that is needed to restore a bastion from backup (keys, accounts, groups, etc.) is backed up daily
+in ``/root/backups`` by default.
+
+If you want to push these backups to a remote location, which is warmly advised,
+you have to specify the remote location to ``scp`` the backup archives to.
+The configuration file is ``/etc/bastion/osh-backup-acl-keys.conf``,
+and you should specify the ``PUSH_REMOTE`` and ``PUSH_OPTIONS``.
+
+To verify that the script is correctly able to connect remotely (and also validate the remote hostkey),
+start the script manually:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+    /opt/bastion/bin/cron/osh-backup-acl-keys.sh
+
+    Pushing backup file (/root/backups/backup-2020-05-25.tar.gz.gpg) remotely...
+    backup-2020-05-25.tar.gz.gpg
+    100%   21MB  20.8MB/s   00:00
+
+Also verify that the extension is ``.gpg``, as seen above,
+which indicates that the script successfully encrypted the backup.
+
+Logs/Syslog
+===========
+
+It is advised to use syslog for The Bastion application logs.
+This can be configured in ``/etc/bastion/bastion.conf`` with the parameter ``enableSyslog``.
+
+There is a default ``syslog-ng`` configuration provided, if you happen to use it.
+The file can be found as ``etc/syslog-ng/conf.d/20-bastion.conf.dist`` in the repository.
+Please read the comments in the file to know how to integrate it properly in your system.
+
+.. _installadv_ha:
+
+Clustering (High Availability)
+==============================
+
+The bastions can work in a cluster, with N instances. In that case, there is one *master* instance,
+where any modification command can be used (creating accounts, deleting groups, granting accesses),
+and N-1 *slave* instances, where only *readonly* actions are permitted. Any of these instances may be
+promoted, should the need arise.
+
+Note that any instance can be used to connect to infrastructures, so in effect all instances can always be used
+at the same time. You may set up a DNS round-robin hostname, with all the instances IPs declared,
+so that clients automatically choose a random instance, without having to rely on another external component
+such as a load-balancer. Note that if you do this, you'll need all the instances to share the same SSH host keys.
+
+Before setting up the slave instance, you should have the two bastions up and running
+(follow the normal installation documentation). Then, to set up the synchronization between the
+instances, proceed as explained below.
+
+Allowing the master to connect to the slave
+*******************************************
+
+On the slave, set the ``readOnlySlaveMode`` option in the ``/etc/bastion/bastion.conf`` file to ``true``:
+
+.. code-block:: shell
+   :caption: run this on the SLAVE:
+   :emphasize-lines: 1
+
+   vim /etc/bastion/bastion.conf
+
+This will instruct this bastion instance to deny any modification plugin,
+so that changes can only be done through the master.
+
+Then, append the master bastion synchronization public SSH keyfile,
+found in :file:`~root/.ssh/id_master2slave.pub` on the master instance,
+to :file:`~bastionsync/.ssh/authorized_keys` on the slave,
+with the following prefix: ``from="IP.OF.THE.MASTER",restrict``
+
+Hence the file should look like this:
+
+.. code-block:: shell
+   :caption: run this on the SLAVE:
+   :emphasize-lines: 1
+
+   cat ~bastionsync/.ssh/authorized_keys
+   from="198.51.100.42",restrict ssh-ed25519 AAA[...]
+
+Pushing the accounts and groups files to the slave
+**************************************************
+
+Check that the key setup has been done correctly by launching the following command under the ``root`` account:
+
+.. code-block:: shell
+   :caption: run this on the MASTER:
+   :emphasize-lines: 1
+
+   rsync -v --rsh "ssh -i /root/.ssh/id_master2slave" /etc/passwd /etc/group bastionsync@IP.OF.THE.SLAVE:/root/
+   group
+   passwd
+
+   sent 105,512 bytes  received 8,046 bytes  75,705.33 bytes/sec
+   total size is 1,071,566  speedup is 9.44
+
+If this works correctly, you'll have two new files in the :file:`/root` directory of the slave instance.
+We'll need those for the next step, which is verifying that the UIDs/GIDs of the slave instance are matching
+the master instance's ones. Indeed, the sync of the  ``/etc/passwd`` and ``/etc/group`` files can have adverse effects
+on a newly installed machine where the packages were not installed in the same order than on the master, hence having
+possibly mismatching UIDs/GIDs for the same users/groups.
+
+The next step ensures these are matching between the master and the slave before actually enabling the synchronization.
+
+.. _installadv_ha_uidgidsync:
+
+Ensuring the UIDs/GIDs are in sync
+**********************************
+
+Now that we have the master's :file:`/etc/passwd` and :file:`/etc/group` files in the slave's :file:`/root` folder,
+we can use a helper script to check for the UIDs/GIDs matches between the master and the slave.
+This script's job is to check whether there is any discrepancy, and if this is the case, generate another script,
+tailored to your case, to fix them:
+
+.. code-block:: none
+   :caption: run this on the SLAVE:
+   :emphasize-lines: 1
+
+   /opt/bastion/bin/admin/check_uid_gid_collisions.pl --master-passwd /root/passwd --master-group /root/group --output /root/syncids.sh
+   WARN: local orphan group: local group 50 (with name 'staff') is only present locally, if you want to keep it, create it on the master first or it'll be erased
+
+   There is at least one warning, see above.
+   If you want to handle them, you may still abort now.
+   Type 'YES' to proceed regardless.
+
+In the example above, the script warns us that some accounts or groups are only existing on the slave instance,
+and not at all on the master. In this case, it's up to you to know what you want to do. If you choose to ignore it,
+these accounts and groups will be erased on the first synchronization, as the master will push its own accounts and
+groups to the slave instance. Such a discrepancy shouldn't happen as long as you're using the same OS and distro
+on both sides. It may happen if you have installed more packages on the slave instance than on the master, as some
+packages also create system groups or accounts. A possible fix is to install the same packages on the master, and/or
+simply adding the account(s) and/or group(s) on the master, so that they're synchronized everywhere.
+
+If you type 'YES' or simply don't have any warnings, you should see something like this:
+
+.. code-block:: none
+   :caption: (output continued)
+
+   Name collision on UID: master UID 38 exists on local but with a different name (master=gnats local=list)
+   -> okay, offsetting local UID 38 to 50000038
+   Differing name attached to same UID: master UID 38 doesn't exist on local, but its corresponding name 'gnats' does, with local UID 41
+   Name collision on UID: master UID 39 exists on local but with a different name (master=list local=irc)
+   -> okay, offsetting local UID 39 to 50000039
+   [...]
+   You may now review the generated script (/root/syncids.sh) and launch it when you're ready.
+   Note that you'll have to reboot once the script has completed.
+
+The generated script is found at the location you've specified, which is :file:`/root/syncids.sh` if you used
+the command-line we suggested above. Reviewing this script is important, as this is the one that will be making
+UIDs/GIDs modification to your slave instance, as to sync them to the master's ones, including propagating these
+changes on your filesystem, using ``chmod`` and ``chgrp`` commands.
+
+Once you're ready (note that you'll have to reboot the slave right after), you may run the generated script:
+
+.. code-block:: none
+   :caption: run this on the SLAVE:
+   :emphasize-lines: 1
+
+   bash /root/syncids.sh
+
+   We'll change the UIDs/GIDs of files, when needed, in the following mountpoints: / /home /run /run/lock /run/snapd/ns /run/user/1001 /run/user/1001/doc /run/user/1001/gvfs
+   If you'd like to change this list, please edit this script and change the 'fslist' variable in the header.
+   Otherwise, if this sounds reasonable (e.g. there is no remotely mounted filesystem that you don't want us to touch), say 'YES' below:
+
+Please review the listed mountpoints (obviously, they'll be different than the ones above). As stated you may
+edit the script to adjust them if needed. If any UID/GID needs to be changed to be in sync with the master,
+the script will ensure the changes are propagated to the specified filesystems. You might want to exclude
+network-mounted filesystems and such, if any. The script does its best to do this for you, but you should ensure
+that it has got it right.
+
+Then, the script may list the daemons and running processes that it'll need to kill before doing the changes,
+as Linux forbids changing UIDs/GIDs when they're used by a process. This is why a reboot is needed at the end.
+
+.. code-block:: shell
+   :caption: (output continued)
+
+   The following processes/daemons will need to be killed before swapping the UIDs/GIDs:
+   USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
+   kernoops    2484  0.0  0.0  11264   440 ?        Ss   Apr11   0:04 /usr/sbin/kerneloops
+   whoopsie    2467  0.0  0.0 253440 11860 ?        Ssl  Apr11   0:00 /usr/bin/whoopsie -f
+   colord      2227  0.0  0.0 249220 13180 ?        Ssl  Apr11   0:00 /usr/libexec/colord
+   geoclue     2091  0.0  0.1 905392 20268 ?        Ssl  Apr11   1:09 /usr/libexec/geoclue
+   rtkit       1789  0.0  0.0 153156  2644 ?        SNsl Apr11   0:00 /usr/libexec/rtkit-daemon
+   syslog      1445  0.0  0.0 224548  4572 ?        Ssl  Apr11   0:02 /usr/sbin/rsyslogd -n -iNONE
+   systemd+    1305  0.0  0.0  91016  4088 ?        Ssl  Apr11   0:00 /lib/systemd/systemd-timesyncd
+
+   If you want to stop them manually, you may abort now (CTRL+C) and do so.
+   Press ENTER to continue.
+
+As stated, ensure that it's alright that these daemons are killed. You may want to terminate them manually
+if needed, otherwise the script will simply send a ``SIGTERM`` to these processes.
+
+.. code-block:: shell
+   :caption: (output continued)
+
+   [...]
+   Restoring SUID/SGID flags where needed...
+   [...]
+   UID/GID swapping done, please reboot now.
+
+As instructed, you may now reboot.
+
+.. note::
+
+   If you're currently restoring from a backup, you may stop here and resume
+   the :doc:`/installation/restoring_from_backup` procedure.
+
+Enabling the synchronization
+****************************
+
+Now that the master and the slave UIDs/GIDs are matching, we may enable the synchronization daemon:
+
+.. code-block:: shell
+   :caption: run this on the MASTER:
+   :emphasize-lines: 1
+
+   vim /etc/bastion/osh-sync-watcher.sh
+
+You may review the configuration, but the two main items to review are:
+
+- ``enabled``, which should be set to ``1``
+- ``remotehostlist``, which should contain the hosts/IPs list of the slave instances, separated by spaces
+
+If the synchronization daemon was not already enabled and started (i.e. this is the first slave instance
+you're setting up for this master), then you should configure it to start it on boot, and you may also
+start it manually right now:
+
+.. code-block:: shell
+   :caption: run this on the MASTER:
+   :emphasize-lines: 1-2
+
+   systemctl enable osh-sync-watcher
+   systemctl start osh-sync-watcher
+
+Otherwise, if the daemon is already enabled and active, you can just restart it so it picks up the new configuration:
+
+.. code-block:: shell
+   :caption: run this on the MASTER:
+   :emphasize-lines: 1
+
+   systemctl restart osh-sync-watcher
+
+Now, you can check the logs (if you configured ``syslog`` instead, which is encouraged,
+then the logfile depends on your syslog daemon configuration. If you're using our bundled ``syslog-ng``
+configuration, the output is logged in :file:`/var/log/bastion/bastion-scripts.log`)
+
+.. code-block:: shell
+   :caption: run this on the MASTER:
+   :emphasize-lines: 1
+
+   tail -F /var/log/bastion/osh-sync-watcher.log
+   Apr 12 18:11:25 bastion1.example.org osh-sync-watcher.sh[3346532]: Starting sync!
+   Apr 12 18:11:25 bastion1.example.org osh-sync-watcher.sh[3346532]: 192.0.2.42: [Server 1/1 - Step 1/3] syncing needed data...
+   Apr 12 18:11:27 bastion1.example.org osh-sync-watcher.sh[3346532]: 192.0.2.42: [Server 1/1 - Step 1/3] sync ended with return value 0
+   Apr 12 18:11:27 bastion1.example.org osh-sync-watcher.sh[3346532]: 192.0.2.42: [Server 1/1 - Step 2/3] syncing lastlog files from master to slave, only if master version is newer...
+   Apr 12 18:11:28 bastion1.example.org osh-sync-watcher.sh[3346532]: 192.0.2.42: [Server 1/1 - Step 2/3] sync ended with return value 0
+   Apr 12 18:11:28 bastion1.example.org osh-sync-watcher.sh[3346532]: 192.0.2.42: [Server 1/1 - Step 3/3] syncing lastlog files from slave to master, only if slave version is newer...
+   Apr 12 18:11:30 bastion1.example.org osh-sync-watcher.sh[3346532]: 192.0.2.42: [Server 1/1 - Step 3/3] sync ended with return value 0
+   Apr 12 18:11:39 bastion1.example.org osh-sync-watcher.sh[3346532]: All secondaries have been synchronized successfully
+   Apr 12 18:11:39 bastion1.example.org osh-sync-watcher.sh[3346532]: Watching for changes (timeout: 120)...
+
+Your new slave instance is now ready!
+
+Creating SSHFP DNS records
+==========================
+
+If you want to use ``SSHFP`` to help authenticating your bastion public keys by publishing their checksum
+in your DNS, here is now to generate the correct records:
+
+.. code-block:: shell
+
+    awk 'tolower($1)~/^hostkey$/ {system("ssh-keygen -r bastion.name -f "$2)}' /etc/ssh/sshd_config
+
+You shall then publish them in your DNS. It is also a good idea to secure your DNS zone with DNSSEC,
+but this is out of the scope of this manual.
+
+Hardening the SSH configuration
+===============================
+
+Using our SSH templates is a good start in any case. If you want to go further, there are a lot of online resources
+to help you harden your SSH configuration, and audit a running SSHd server.
+As the field evolves continuously, we don't want to recommend one particularly here,
+as it might get out of date rapidly, but looking for `ssh audit <https://github.com/search?q=ssh+audit>`_ on GitHub
+is probably a good start. Of course, this also depends on your environment, and you might not be able to harden
+your SSHd configuration as much as you would like.
+
+Note that for The Bastion, both sides can be independently hardened:
+the ingress part is handled in ``sshd_config``, and the egress part is handled in ``ssh_config``.
+
+2FA root authentication
+=======================
+
+The bastion supports TOTP (Time-based One Time Password), to further secure high profile accesses.
+This section covers the configuration of 2FA root authentication on the bastion itself.
+TOTP can also be enabled for regular bastion users, but this is covered in another section.
+To enable 2FA root authentication, run on the bastion:
+
+.. code-block:: shell
+
+    script -c "google-authenticator -t -Q UTF8 -r 3 -R 15 -s /var/otp/root -w 2 -e 4 -D" /root/qrcode
+
+Of course, you can check the ``--help`` and adjust the options accordingly.
+The example given above has sane defaults, but you might want to adjust if needed.
+Now, flash this QR code with your phone, using a TOTP application.
+You might want to copy the QR code somewhere safe in case you need to flash it on some other phone,
+by exporting the ``base64`` version of it:
+
+.. code-block:: shell
+
+    gzip -c /root/qrcode | base64 -w150
+
+Copy this in your password manager (for example). You can then delete the :file:`/root/qrcode` file.
+
+You have then two configuration adjustments to do.
+
+- First, ensure you have installed the provided :file:`/etc/pam.d/sshd` file, or at least the corresponding line
+  to enable the TOTP pam plugin in your configuration.
+
+- Second, ensure that your :file:`/etc/ssh/sshd_config` file calls PAM for root authentication.
+  In the provided templates, there is a commented snippet to do it. The uncommented snippet looks like this:
+
+.. code-block:: shell
+
+    # 2FA has been configured for root, so we force pubkey+PAM for it
+    Match User root
+        AuthenticationMethods publickey,keyboard-interactive:pam
+
+Note that first, the usual publickey method will be used, then control will be passed to PAM.
+This is where the :file:`/etc/pam.d/sshd` configuration will apply.
+
+Now, you should be asked for the TOTP the next time you try to login through ssh as root.
+In case something goes wrong with the new configuration, be sure to keep your already opened existing
+connection to be able to fix the problem without falling back to console access.
+
+Once this has been tested, you can (and probably should) also protect the direct root console access
+to your machine with TOTP, including a snippet similar to this one:
+
+.. code-block:: shell
+
+    # TOTP config
+    auth    [success=1 default=ignore]  pam_google_authenticator.so secret=/var/otp/${USER}
+    auth    requisite                   pam_deny.so
+    # End of TOTP Config
+
+inside your :file:`/etc/pam.d/login` file.
+
+Of course, when using TOTP, this is paramount to ensure your server is properly synchronized through NTP.
diff --git a/_sources/installation/basic.rst.txt b/_sources/installation/basic.rst.txt
new file mode 100644
index 000000000..82942415b
--- /dev/null
+++ b/_sources/installation/basic.rst.txt
@@ -0,0 +1,281 @@
+==================
+Basic Installation
+==================
+
+If you are just upgrading from a previous version, please read :doc:`upgrading<upgrading>` instead.
+
+0. Got Puppet?
+==============
+
+We published a Puppet module to handle The Bastion configuration and prerequisites.
+The GitHub repo is `here <https://github.com/ovh/puppet-thebastion>`_ and our module has been published to
+`the Puppet forge <https://forge.puppet.com/modules/goldenkiwi/thebastion>`_.
+Of course, its usage is completely optional, but if you choose to use it,
+some of the below steps will be done by Puppet. Hence, you might want to only consider the following steps:
+
+- :ref:`install-basic_operating-system`
+- :ref:`install-basic_get-the-code`
+- :ref:`install-basic_encrypt-home`
+- (Run Puppet)
+- :ref:`install-basic_first-account`
+
+.. _install-basic_operating-system:
+
+1. Operating system
+===================
+
+.. warning::
+
+   The Bastion expects to be the only main service running on the server,
+   please see :ref:`this FAQ entry <faq_existing_server>` for more information.
+
+The following Linux distros are tested with each release, but as this is a security product,
+you are *warmly* advised to run it on the latest up-to-date stable version of your favorite OS:
+
+- Debian 12 (Bookworm), 11 (Bullseye), 10 (Buster)
+- CentOS 7.x
+- RockyLinux 8.x, 9.x
+- Ubuntu LTS 22.04, 20.04, 18.04, 16.04
+- OpenSUSE Leap 15.5\*
+
+\*: Note that these versions have no out-of-the-box MFA support, as they lack packaged versions of ``pamtester``,
+``pam-google-authenticator``, or both. Of course, you may compile those yourself.
+Any other so-called `modern` Linux version are not tested with each release,
+but should work with no or minor adjustments.
+
+The following OS are also tested with each release:
+
+- FreeBSD/HardenedBSD 13.0\*\*
+
+\*\*: Note that these have partial MFA support, due to their reduced set of available ``pam`` plugins.
+Support for either an additional password or TOTP factor can be configured, but not both at the same time.
+The code is actually known to work on FreeBSD/HardenedBSD 10+, but it's only regularly tested under 13.0.
+
+Other BSD variants, such as OpenBSD and NetBSD, are unsupported as they have a severe limitation over the maximum
+number of supplementary groups, causing problems for group membership and restricted commands checks,
+as well as no filesystem-level ACL support and missing PAM support (hence no MFA).
+
+In any case, you are expected to install this on a properly secured machine (including, but not limited to:
+``iptables``/``pf``, reduced-set of installed software and daemons, general system hardening, etc.).
+If you use Debian, following the `CIS Hardening guidelines <https://www.cisecurity.org/benchmark/debian_linux/>`_ is
+a good start. We have `a tool <https://github.com/ovh/debian-cis>`_ to check for compliance against these guidelines.
+If you use Debian and don't yet have your own hardened template, this script should help you getting up to speed,
+and ensuring your hardened host stays hardened over time, through a daily audit you might want to setup through cron.
+
+Great care has been taken to write secure, tested code, but of course this is worthless if your machine
+is a hacker highway. Ensuring that all the layers below the bastion code (the operating system
+and the hardware it's running on) is your job.
+
+2. Connect to your server as root
+=================================
+
+You'll need to be connected to your server as root to perform the installation. If you're using root password
+authentication through SSH to do so, note that during the installation, as the SSH server configuration
+will be hardened, the SSH password authentication will be disabled server-wide.
+
+Hence, to access your server, please set up an SSH public key authentication instead of a password authentication,
+and do so before proceeding with the next steps. Otherwise you might lose access to your own server once the
+SSH hardening will be in effect, as password authentication will then be disabled.
+
+.. _install-basic_get-the-code:
+
+3. Get the code
+===============
+
+The bastion code usually lives under ``/opt/bastion``.
+You can either use ``git clone`` directly, or get the tarball of the latest release.
+
+- Using :command:`git`:
+
+.. code-block:: shell
+
+  git clone https://github.com/ovh/the-bastion /opt/bastion
+  git -C /opt/bastion checkout $(git -C /opt/bastion tag | tail -1)
+
+- Using the tarball:
+
+Get the tarball of the latest release, which can be found
+`there <https://github.com/ovh/the-bastion/releases/latest>`_, then untar it:
+
+.. code-block:: shell
+
+  mkdir -p /opt/bastion
+  tar -C /opt/bastion -zxf v3.16.01.tar.gz
+
+The code supports being hosted somewhere else on the filesystem hierarchy, but this is discouraged as you might
+need to adjust a lot of configuration files (notably sudoers.d, cron.d, init.d) that needs an absolute path.
+You should end up with directories such as ``bin``, ``lib``, etc. directly under ``/opt/bastion``.
+
+.. _install-basic_install-packages:
+
+4. Install the needed packages
+==============================
+
+For the supported Linux distros (see above), you can simply run:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/packages-check.sh -i
+
+You can add other parameters to install optional packages, depending on your environment:
+
+- ``-s`` to install ``syslog-ng`` (advised, we have templates files for it)
+- ``-d`` to install packages needed for developing the software (useless in production)
+
+You'll also need our version of ttyrec, `ovh-ttyrec <https://github.com/ovh/ovh-ttyrec>`_.
+To get and install the precompiled binary that will work for your OS and architecture, you can use this script:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/install-ttyrec.sh -a
+
+This will detect your distro, then download and either install the ``.deb`` or ``.rpm`` package
+for `ovh-ttyrec <https://github.com/ovh/ovh-ttyrec>`_. If your distro doesn't handle those package types,
+it'll fallback to installing precompiled static binaries.
+Of course you can package it yourself and make it available to your own internal repositories instead of installing it this way.
+
+If you plan to use the PIV functionalities of The Bastion,
+you'll also need to install the ``yubico-piv-checker`` `helper tool <https://github.com/ovh/yubico-piv-checker>`_.
+
+You may also want to install ``the-bastion-mkhash-helper`` `tool <https://github.com/ovh/the-bastion-mkhash-helper>`_
+if you want to be able to generate so-called type 8 and type 9 password hashes.
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/install-yubico-piv-checker.sh -a
+   /opt/bastion/bin/admin/install-mkhash-helper.sh -a
+
+.. _install-basic_encrypt-home:
+
+5. Encrypt /home
+================
+
+Strictly speaking, this step is optional, but if you skip it, know that all the SSH private keys and session
+recordings will be stored unencrypted on the ``/home`` partition.
+Of course, if partition encryption is already handled by the OS template you use,
+or if the storage layer of your OS is encrypted by some other mean, you may skip this section.
+
+First, generate a secure password on your desk (but not too complicated so it can be typed
+on a console over your hypervisor over a VDI over VPN over 4G in the dark at 3am on a Sunday)
+and save it to a secure location: ``pwgen -s 10``.
+
+Then you can use the helper script to do this, it'll guide you through the process.
+When prompted for a passphrase, enter the one chosen just before:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/admin/setup-encryption.sh
+
+If you get a cryptsetup error, you might need to add ``--type luks1`` to the ``cryptsetup luksFormat`` command
+in the script. It can happen if your kernel doesn't have the necessary features enabled for LUKS2.
+
+.. warning::
+
+    Once you have setup encryption, **do not forget** to ensure that the keys backup script has encryption enabled,
+    otherwise the backups will be stored unencrypted in ``/root/backups``,
+    which would make your ``/home`` encryption moot.
+    This is not covered here because you can do it later, just don't forget it:
+    it's in the :doc:`advanced installation<advanced>` section.
+
+.. _install-basic_setup:
+
+6. Setup bastion and system configuration
+=========================================
+
+The following script will do that for you. There are several possibilities here.
+
+- If you're installing a new machine (nobody is using it as a bastion yet), then you can regenerate brand new
+  host keys and directly harden the ssh configuration without any side effect:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/admin/install --new-install
+
+- If you're upgrading an existing machine (from a previous version of this software),
+  and there are already some people using it as a bastion, then if you change the host keys,
+  they'll have to acknowledge the change when connecting, i.e. this is not transparent at all.
+  To avoid doing that and not touching either the ssh config or the host keys, use this:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/admin/install --upgrade
+
+If you used ``--upgrade``, then you are **warmly** advised to harden the configuration yourself,
+using our templates as a basis. For example, if you're under Debian 11:
+
+.. code-block:: shell
+
+    vimdiff /opt/bastion/etc/ssh/ssh_config.debian11 /etc/ssh/ssh_config
+    vimdiff /opt/bastion/etc/ssh/sshd_config.debian11 /etc/ssh/sshd_config
+
+There are other templates available in the same directory, for the other supported distros.
+
+- If you want to have a fine-grained control of what is managed by the installation script,
+  and what is managed by yourself (or any configuration automation system you may have), you can review all the fine-grained options:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/admin/install --help
+
+.. _install-basic_review-config:
+
+7. Review the configuration
+===========================
+
+Base configuration files have been copied, you should review the main configuration and modify it to your needs:
+
+.. code-block:: shell
+
+    vim /etc/bastion/bastion.conf
+
+.. _install-basic_perl-check:
+
+8. Check that the code works on your machine
+============================================
+
+This script will verify that all required modules are installed:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/dev/perl-check.sh
+
+.. note::
+
+   If you're installing this instance to restore a backup, you may stop here and resume the
+   standard :doc:`/installation/restoring_from_backup` procedure.
+
+.. _install-basic_first-account:
+
+9. Manually create our first bastion account
+============================================
+
+Just launch this script, replacing *USERNAME* by the username you want to use:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/setup-first-admin-account.sh USERNAME auto
+
+You'll just need to specify the public SSH key to add to this new account.
+It'll be created as a bastion admin, and all the restricted commands will be granted.
+
+.. note::
+
+   This command will also give you a so-called *bastion alias*, this is the command you'll routinely use to
+   connect to the bastion, and to your infrastructures through it, replacing in effect your previous usage
+   of the `ssh` command. The alias name advertised on account creation is configurable in ``bastion.conf``,
+   and of course the users can rename it as they see fit, but it's advised to keep this command short,
+   as people will use it a lot.
+
+If you want to create other admin accounts, you can repeat the operation.
+All the other accounts should be created by a bastion admin (or more precisely,
+by somebody granted to the *accountCreate* command), using the bastion own commands.
+But more about this in the section *Using the bastion*.
+
+You may head over to the **USAGE** section on the left menu, but please read the warning below first.
+
+.. warning::
+   Note that even if your bastion should now be functional, proper setup for a production-level environment
+   is not done yet: for example, you don't have any backup system in place! Please ensure you follow the
+   :doc:`advanced installation<advanced>` documentation and carely consider each step (by either completing it
+   or deciding that it's not mandatory for your use case), before considering your installation complete.
+
diff --git a/_sources/installation/docker.rst.txt b/_sources/installation/docker.rst.txt
new file mode 100644
index 000000000..c42494775
--- /dev/null
+++ b/_sources/installation/docker.rst.txt
@@ -0,0 +1,78 @@
+====================
+Sandbox using Docker
+====================
+
+This is a good way to test The Bastion within seconds, but :ref:`read the FAQ <faq_docker>`
+if you're serious about using containerization in production.
+
+The sandbox image is available for the following architectures: ``linux/386``, ``linux/amd64``, ``linux/arm/v6``,
+``linux/arm/v7``, ``linux/arm64``, ``linux/ppc64le``, ``linux/s390x``.
+
+- Let's run the docker image:
+
+.. code-block:: shell
+
+    docker run -d -p 22 --name bastiontest ovhcom/the-bastion:sandbox
+
+- Or, if you prefer building the docker image yourself, you can: use the two commands below.
+  Of course, if you already typed the ``docker run`` command above, you can skip the following commands:
+
+.. code-block:: shell
+
+    docker build -f docker/Dockerfile.debian10 -t bastion:debian10 .
+    docker run -d -p 22 --name bastiontest bastion:debian10
+
+- Configure the first administrator account (get your public SSH key ready)
+
+.. code-block:: shell
+
+    docker exec -it bastiontest /opt/bastion/bin/admin/setup-first-admin-account.sh poweruser auto
+
+- We're now up and running with the default configuration!
+  Let's setup a handy bastion alias, and test the ``info`` command:
+
+.. code-block:: shell
+
+    PORT=$(docker port bastiontest | cut -d: -f2)
+    alias bastion="ssh poweruser@127.0.0.1 -tp $PORT -- "
+    bastion --osh info
+
+- It should greet you as being a bastion admin, which means you have access to all commands.
+  Let's enter interactive mode:
+
+.. code-block:: shell
+
+    bastion -i
+
+- This is useful to call several ``--osh`` plugins in a row. Now we can ask for help to see all plugins:
+
+.. code-block:: shell
+
+    $> help
+
+- If you have a remote machine you want to try to connect to through the bastion, fetch your egress key:
+
+.. code-block:: shell
+
+    $> selfListEgressKeys
+
+- Copy this public key to the remote machine's ``authorized_keys`` under the ``.ssh/`` folder
+  of the account you want to connect to, then:
+
+.. code-block:: shell
+
+    $> selfAddPersonalAccess --host <remote_host> --user <remote_account_name> --port-any
+    $> ssh <remote_account_name>@<remote_host>
+
+- Note that you can connect directly without using interactive mode, with:
+
+.. code-block:: shell
+
+    bastion <remote_account_name>@<remote_machine_host_or_ip>
+
+That's it! You can head over to the **USAGE** section on the left menu for more information.
+Be sure to check the help of the bastion with ``bastion --help``,
+along with the help of each osh plugin with ``bastion --osh command --help``.
+
+Also don't forget to customize your ``bastion.conf`` file,
+which can be found in ``/etc/bastion/bastion.conf`` (for Linux).
diff --git a/_sources/installation/restoring_from_backup.rst.txt b/_sources/installation/restoring_from_backup.rst.txt
new file mode 100644
index 000000000..6cd3bc6b0
--- /dev/null
+++ b/_sources/installation/restoring_from_backup.rst.txt
@@ -0,0 +1,149 @@
+=====================
+Restoring from backup
+=====================
+
+In this section, we'll detail how to restore a bastion's main data from a backup.
+
+This can be useful in two main cases:
+
+- When an account with high privileges has deleted or altered by mistake a great amount of accounts or groups, up
+  to a point where it's operationally easier to just restore the settings, accounts, groups and keys from the latest
+  available backup
+
+- When you are not in an :ref:`HA setup <installadv_ha>` and your only
+  instance is down and can't be brought back up in a timely manner.
+
+Note that if you are in a HA setup and you need to add a new node (regardless of the fact that you're replacing
+a failed node or not), you don't need to restore from backup: you can simply follow the HA setup procedure so
+that your new node is synced with your main node.
+
+Prerequisites
+=============
+
+First, you obviously must have a backup at hand, which should be the case if you followed the
+:ref:`installadv_backup` section when you first installed the instance you want to restore.
+
+If the backup is encrypted with GPG (it should be), you must have access to the corresponding GPG private key and
+its passphrase.
+
+You must ensure that the new server you're setting up has the same OS release than the one the backup file
+comes from, as we'll overwrite the new server's accounts and groups files with the backed up versions.
+This could cause adverse effects if the distro or release differ, although the restore script won't stop
+you from doing so (it'll even help you adjust the discrepancies if needed, but again, this is strongly discouraged).
+
+Steps
+=====
+
+Installation
+------------
+
+On the new server you want to deploy the backup to, you must first follow the standard :doc:`/installation/basic`
+procedure, up to and including the *Check that the code works on your machine* step.
+
+Once done, you may proceed to the next steps below.
+
+GPG key and backup archive import
+---------------------------------
+
+On the server you've just installed, you'll need to import the private GPG key that was used to encrypt the backup, and
+you'll also need to fetch the backup archive itself. It's a good practice to NOT decrypt the backup archive prior to
+transferring it to the new server. This way, you're sure that the credentials and keys contained in the backup have
+not been compromised.
+
+To import the GPG key, just run:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   gpg --import
+
+And paste the private GPG key corresponding to the backup so that it gets imported into root's keyring.
+
+Alternatively, you can put the private GPG key in a temporary file, and import it this way:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   gpg --import < /tmp/backupkey.asc
+
+You may now import the backup archive, which usually has a name matching the :file:`backup-YYYY-MM-DD.tar.gz.gpg` format.
+You can use ``scp``, ``sftp`` or any other method to get this file onto the server, at any location you see fit. We'll use
+:file:`/root` as location for the rest of this documentation, as this is guaranteed to only be readable by root,
+hence not compromising the keys and credentials.
+
+Decrypt and extract accounts and groups
+---------------------------------------
+
+Now, you can decrypt the backup archive:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   gpg -d /root/backup-YYYY-MM-DD.tar.gz.gpg > /root/backup-decrypted.tar.gz
+   gpg: encrypted with 4096-bit RSA key, ID F50BFFC49143C821, created 2021-03-27
+      "Bastion Administrators <bastions.admins@example.org>"
+
+You'll have to input the GPG private key passphrase when asked to.
+
+Then, check whether the archive seems okay:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   tar tvzf /root/backup-decrypted.tar.gz
+
+You should see a long list of files, most under the :file:`/home` hierarchy.
+
+We now need to extract the backed up :file:`/etc/passwd` and :file:`/etc/group` files, to ensure the new
+instance we're setting up has its UIDs/GIDs synced with the system we're restoring:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   tar xvzf /root/backup-decrypted.tar.gz -C /root --strip-components=1 etc/passwd etc/group
+   etc/group
+   etc/passwd
+
+We now have the two original accounts and groups lists in :file:`/root`, and we can proceed to check
+whether the UIDs and GIDs are in sync.
+
+Ensuring the UIDs/GIDs are in sync
+----------------------------------
+
+This procedure is the same than when setting up a slave instance bastion,
+please follow the corresponding :ref:`step there<installadv_ha_uidgidsync>` and come
+back to this documentation when it's done.
+
+.. note::
+
+   The referenced step above asks you to reboot at the end, please ensure you've done it before
+   continuing with the rest of the procedure below.
+
+Restoring
+---------
+
+Now that we know the UIDs/GIDs are synced, we can proceed with the full restore:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   tar -C / --preserve-permissions --preserve-order --overwrite --acls --numeric-owner -xzvf /root/backup-decrypted.tar.gz
+
+.. note::
+
+   If you're getting errors such as 'Warning: Cannot acl_from_text: Invalid argument', please ensure that your
+   filesystem supports ACLs and is mounted with ACL support, otherwise ``tar`` can't restore ACLs from the backup.
+
+Back to production
+------------------
+
+As the configuration of the SSH daemon has also been restored, you might want to restart it so that it
+picks up the new configuration:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   service ssh restart
+
+Once this is done, all the accounts that were present in the backup should be working. After ensuring this is the case,
+you may put the server put back in production.
diff --git a/_sources/installation/upgrading.rst.txt b/_sources/installation/upgrading.rst.txt
new file mode 100644
index 000000000..bdaf07106
--- /dev/null
+++ b/_sources/installation/upgrading.rst.txt
@@ -0,0 +1,532 @@
+=========
+Upgrading
+=========
+
+General upgrade instructions
+============================
+
+- First, check below if there are specific upgrade instructions for your version.
+
+- When you're ready, update the code, if you're using ``git``, you can checkout the latest tag:
+
+.. code-block:: shell
+
+    ( umask 0022 && cd /opt/bastion && git fetch && git checkout $(git tag | tail -1) )
+
+- Run the install script in upgrade mode, so it can make adjustments to the system needed for the new version:
+
+.. code-block:: shell
+
+    /opt/bastion/bin/admin/install --upgrade
+
+Note that if you're using an infrastructure automation tool such as Puppet, Ansible, Chef,
+and don't want the update script to touch some files that you manage yourself,
+you can use ``--managed-upgrade`` instead of ``--upgrade``.
+See the ``--help`` for a more fine-grained upgrade path if needed.
+
+Version-specific upgrade instructions
+=====================================
+
+v3.16.01 - 2024/04/17
+*********************
+
+No specific upgrade instructions.
+
+v3.16.00 - 2024/04/10
+*********************
+
+This version adds support for Secure Keys (FIDO2) for ingress authentication. It requires at least OpenSSH 8.2
+installed on the server hosting The Bastion, as support for FIDO2 was added in this version.
+Of the currently supported OS versions, the following are known to have a recent-enough version:
+
+- Debian 11
+- Debian 12
+- Ubuntu 20.04
+- Ubuntu 22.04
+- OpenSUSE Leap 15.5
+- Rocky Linux 9
+
+Note that if you are upgrading, you'll need to enable the new ingress algorithms in the ``/etc/bastion/bastion.conf``
+file, under the ``allowedIngressSshAlgorithms`` option. You may want to add ``ecdsa-sk`` and ``ed25519-sk`` to the list
+if you want to support the FIDO2-backed versions of these two algorithms.
+You may also refer to the distributed default configuration file in ``etc/bastion/bastion.conf.dist``,
+which enables them by default.
+
+v3.15.00 - 2024/03/22
+*********************
+
+No specific upgrade instructions.
+
+v3.14.16 - 2024/02/20
+*********************
+
+No specific upgrade instructions.
+
+v3.14.15 - 2023/11/08
+*********************
+
+This release fixes the :doc:`/administration/security_advisories/cve_2023_45140` with severity 4.8 (CVSS V3).
+Please refer to its page for impact and mitigation details.
+
+The changes introduced to fix this vulnerability imply that if you're using the ``scp`` or ``sftp`` plugins,
+you'll need to update your wrappers using the new versions provided by this release. The old helpers will still
+work, but only for remote hosts that don't require MFA.
+
+To get the new wrappers for your account on a given bastion, just call ``--osh scp`` or ``--osh sftp`` without
+specifying any host, which will give you your script, and examples of use.
+As you'll notice, the new scripts are no longer helpers (that were to be used through ``scp -S`` and
+``sftp -S``), but wrappers, that will call  ``scp`` and ``sftp`` themselves.
+
+As outlined above, the old helpers will still work for the foreseeable future, but as they're not able to
+request MFA when this is configured for a remote host, they'll simply fail for such hosts on an updated
+version of the bastion.
+
+If you have some accounts that use automated accesses through the bastion and use ``scp`` or ``sftp`` on
+hosts that have JIT MFA configured through their group, you'll need to set these accounts as immune to JIT MFA,
+which can be done through :doc:`/plugins/restricted/accountModify`'s ``--mfa-password-required bypass``
+and/or ``accountModify --mfa-totp-required bypass``, as has always been the case for classic SSH access.
+
+An HMAC shared secret is automatically generated when this release is deployed, this secret must be shared
+by all the instances of the same cluster. Hence, you should start by deploying this release on the primary
+node, which will generate the secret automatically during the standard upgrading procedure, so that this
+node can push the shared-secret to the other nodes. The other nodes don't have to be upgraded beforehand,
+they'll just not use the secret until they're upgraded to this version, and JIT MFA for ``scp`` and ``sftp``
+will not work through them until this is the case.
+
+Once the primary node is upgraded, you should ensure the new file containing the HMAC shared secret is part
+of the synchronization list. If you did not customize your synchronization list, you can apply the new one
+over the old one directly:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   cat /opt/bastion/etc/bastion/osh-sync-watcher.rsyncfilter.dist > /etc/bastion/osh-sync-watcher.rsyncfilter
+
+Then, you need to restart the synchronization daemon, so that it takes into consideration the new file
+(containing the shared secret) to push to the other nodes. This is usually done this way:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   systemctl restart osh-sync-watcher
+
+You can verify on the other nodes that the ``/etc/bastion/mfa-token.conf`` file is now present.
+
+v3.14.00 - 2023/09/19
+*********************
+
+A new helper is required to support the so-called "type 8" and "type 9" password hash types, used on some
+network devices. This helper is optional, and these hashes types will simply not be generated if the helper is
+missing. The plugins concerned by this change are ``selfGeneratePassword``, ``selfListPasswords``,
+``accountGeneratePassword``, ``accountListPasswords``, ``groupGeneratePassword``, ``groupListPasswords``.
+
+New installations will get this helper installed automatically. When upgrading, if you'd like to install
+this helper, you'll need to install it by running the following command as ``root``:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/install-mkhash-helper.sh -a
+
+This will detect your OS and either install a ``.deb`` file, an ``.rpm`` file, or a static binary.
+
+If you want to ensure that the helper has installed correctly, you can call it manually for testing purposes:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   echo test | the-bastion-mkhash-helper
+   {"Type8":"$8$EpvF1cVVzoEQFE$L3ZBWzfH9MTPo4WLX29Jd8LTM5sKlfEjtRZ//XMys2U","Type9":"$9$yRlXzt0T7WBs3E$YdKk8WMvLvAVcbglx.bMZoRlwBa6l5EhwLhBh1o0u4g","PasswordLen":4}
+
+If you're not generating passwords for use with network devices using type 8 or type 9 hash types, installation of this
+helper is not required.
+
+v3.13.01 - 2023/08/22
+*********************
+
+No specific upgrade instructions.
+
+v3.13.00 - 2023/07/28
+*********************
+
+Plugins output is now recorded using ttyrec, as the connections are, instead of being stored in sqlite format
+within the home folder of the account. This helps avoiding the sqlite databases growing too much in size when
+accounts are using osh commands very intensively.
+
+v3.12.00 - 2023/06/27
+*********************
+
+Support for Debian 9 has been dropped. This doesn't mean that the code will suddenly stop working under this version,
+but that tests no longer include this OS. Please consider upgrading to a more recent OS, as ensuring the underlying
+OS is up to date and still supported is paramount to the security of The Bastion (or any other software).
+
+Support of Debian "Bookworm" 12 is now official, as this is now Debian stable.
+
+v3.11.02 - 2023/04/18
+*********************
+
+No specific upgrade instructions.
+
+v3.11.01 - 2023/03/27
+*********************
+
+No specific upgrade instructions.
+
+v3.11.00 - 2023/03/23
+*********************
+
+The upgrade path from the preceding version is straightforward, however there is a change
+that you might want to be aware of before hitting the upgrade button:
+
+The previously implicitly assumed ``--port-any`` and ``--user-any`` options
+to the ``(self|account)(Add|Del)PersonalAccess`` commands, when either ``--user`` or ``--port`` were omitted,
+now require to be stated explicitly, to be consistent with the behaviour of ``group(Add|Del)Server``,
+which always required it. Note that using this mechanism always emitted a deprecation warning,
+since the first publicly released version, encouraging the explicit use of ``--user-any`` and/or ``--port-any``
+when this was desired. Now, omitting these options will simply return an error,
+as this has always been the case with ``group(Add|Del)Server``.
+
+Example of previous behaviour::
+
+   $ bssh --osh selfAddPersonalAccess --host 127.0.0.5 --force
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.10.00───
+   │ ▶ adding personal access to a server on your account
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ ❗ You didn't specify --user or --user-any, defaulting to --user-any, this will no longer be implicit in future versions
+   │ ❗ You didn't specify --port or --port-any, defaulting to --port-any, this will no longer be implicit in future versions
+   │ Forcing add as asked, we didn't test the SSH connection, maybe it won't work!
+   │ Access to 127.0.0.5 was added to account jdoe
+   ╰────────────────────────────────────────────────────</selfAddPersonalAccess>───
+
+Example of new behaviour::
+
+   $ bssh --osh selfAddPersonalAccess --host 127.0.0.5 --force
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.11.00───
+   │ ▶ adding personal access to a server on your account
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Add a personal server access on your account
+   │
+   │ Usage: --osh selfAddPersonalAccess --host HOST [OPTIONS]
+   │
+   │   --host IP|HOST|IP/MASK   Server to add access to
+   │   --user USER              Remote login to use, if you want to allow any login, use --user-any
+   │   --user-any               Allow access with any remote login
+   │   --port PORT              Remote SSH port to use, if you want to allow any port, use --port-any
+   │   --port-any               Allow access to all remote ports
+   │   --scpup                  Allow SCP upload, you--bastion-->server (omit --user in this case)
+   │   --scpdown                Allow SCP download, you<--bastion--server (omit --user in this case)
+   │   --sftp                   Allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+   │   --force                  Add the access without checking that the public SSH key is properly installed remotely
+   │   --force-key FINGERPRINT  Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)
+   │   --force-password HASH    Only use the password with the specified hash to connect to the server (cf selfListPasswords)
+   │   --ttl SECONDS|DURATION   Specify a number of seconds (or a duration string, such as "1d7h8m") after which the access will automatically expire
+   │   --comment "'ANY TEXT'"   Add a comment alongside this server. Quote it twice as shown if you're under a shell.
+   │
+   │ ⛔ No user specified, if you want to add this server with any user, use --user-any
+   ╰────────────────────────────────────────────────────</selfAddPersonalAccess>───
+
+v3.10.00 - 2023/02/17
+*********************
+
+No specific upgrade instructions.
+
+v3.09.02 - 2022/11/15
+*********************
+
+No specific upgrade instructions.
+
+v3.09.01 - 2022/10/10
+*********************
+
+No specific upgrade instructions.
+
+v3.09.00 - 2022/09/21
+*********************
+
+This version has changes around the satellite system scripts that should be reviewed:
+
+- The ``osh-encrypt-rsync.pl`` script now also handles the account's access log and sql logs,
+  in addition to the ttyrec files.
+  A number of new options have been added to this script's config file, these options have sane defaults but you
+  might still want to review those, namely `encrypt_and_move_user_logs_delay_days <https://ovh.github.io/the-bastion/administration/configuration/osh-encrypt-rsync_conf.html#encrypt-and-move-user-logs-delay-days>`_
+  and `encrypt_and_move_user_sqlites_delay_days <https://ovh.github.io/the-bastion/administration/configuration/osh-encrypt-rsync_conf.html#encrypt-and-move-user-sqlites-delay-days>`_.
+
+- As a result of the previous feature, the ``compress-old-logs.sh`` script has been retired.
+
+- A new script, ``osh-cleanup-guest-key-access.pl``, has been added. It is enabled by default, though it can
+  be disabled if you have a good reason to do so. Please refer to its `documentation <https://ovh.github.io/thge-bastion/administration/configuration/osh-cleanup-guest-key-access_conf.html>`_ for more
+  information.
+
+- All scripts that are automatically run by cron and reside under the ``bin/cron`` subfolder now have their own
+  configuration file in ``/etc/bastion``, even for simple scripts that only have two configuration knobs: their
+  logging facility and whether they should be enabled or not. It is now recommended to use these configuration knobs
+  to disable the scripts you don't want to see running, instead of removing their corresponding file in the
+  ``/etc/cron.d`` folder, as any future update of the bastion would install them back.
+
+- The logging format has been standardized across these scripts, to ensure the newly included NRPE probes can detect
+  errors in the scripts more easily. By default the logs are going through syslog, using the ``local6`` facility,
+  which ends up in the ``/var/log/bastion/bastion-scripts.log`` folder if you're using our stock ``syslog-ng``
+  configuration. The NRPE probes are available in the ``contrib/nrpe`` directory.
+
+Additionally, NRPE probes have been added, and should be used to monitor your bastion instances / clusters.
+More information is available in the `NRPE probes readme file <https://github.com/ovh/the-bastion/blob/master/contrib/nrpe/README.md>`_.
+
+Last but not least, CentOS 8 support has been dropped (whereas RockyLinux 8 will remain supported),
+and Ubuntu 22.04 LTS support has been added.
+
+v3.08.01 - 2022/01/19
+*********************
+
+The upgrade path from the preceding version is straightforward, however you might want to know that there is
+a new satellite script: ``osh-remove-empty-folders.sh``, run by cron and enabled by default,
+whose job is to garbage-collect empty folders that may be piling up in busy users' homes,
+under their ``ttyrec`` folder.
+
+You can find more information in `the documentation 
+<https://ovh.github.io/the-bastion/administration/configuration/osh-remove-empty-folders_conf.html>`_, the script
+is enabled by default because it can do no harm.
+
+v3.08.00 - 2022/01/04
+*********************
+
+This version replaces usage of GnuPG 1.x by GnuPG 2.x for the backup/encrypt/rsync satellite scripts, namely:
+
+- ``bin/cron/osh-backup-acl-keys.sh``
+- ``bin/cron/osh-encrypt-rsync.pl``
+
+These are optionally used to help you backup your system, and encrypt/move out ttyrec files.
+If you don't use these scripts and never configured them as seen in the :doc:`/installation/advanced` section,
+then you have nothing to do.
+
+The script ``setup-gpg.sh`` will now create an Ed25519 key by default, instead of a 4K RSA key.
+This type of key is usually seen as more secure (elliptic curve cryptography), and faster than RSA keys.
+If you have already configured your system, then the above scripts will continue using the previously generated
+RSA key, unless you generate a new key and reference it in the scripts configuration files.
+
+If you want to generate new Ed25519 keys instead of using your preexisting RSA keys, you may proceed
+to the :ref:`Ed25519 section below <upgrading_ed25519>`.
+
+Otherwise, on the first run, GnuPG 2.x should transparently import the 1.x keyring.
+To verify that it worked correctly, you may want to try:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+
+If you see *Config test passed*, and you're okay using your preexisting 4K RSA key, then you may stop here.
+
+If the test fails, and you know that before upgrading, this script worked correctly, then you might need to
+manually import the GnuPG 1.x public keys:
+
+.. code-block:: shell
+
+   gpg1 --armor --export | gpg --import
+
+Then, try again:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+
+If you don't see any errors here, you're done.
+
+If you still see errors, then you might need to manually import the private key:
+
+.. code-block:: shell
+
+   gpg1 --armor --export-secret-keys | gpg --import
+
+You may get asked for a password for the bastion secret key, which should be found in
+``/etc/bastion/osh-encrypt-rsync.conf.d/50-gpg-bastion-key.conf`` if you previously used the script to generate it.
+
+A last config test should now work:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+
+If you prefer to generate Ed25519 keys instead, then you can proceed to the next section.
+
+.. _upgrading_ed25519:
+
+Ed25519
+-------
+
+If you want to replace your RSA key by an Ed25519 one (which is optional), then you don't need to import the
+GnuPG 1.x keys as outlined above but you may run instead:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/setup-gpg.sh generate --overwrite
+
+Once the key has been generated, you may also want to generate a new admin key, by following this
+:ref:`section <installation/advanced:Generating and importing the admins GPG key>` of the Advanced Installation documentation.
+Note that you'll need to use the ``--overwrite`` parameter when importing:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/admin/setup-gpg.sh import --overwrite
+
+Once done, a config test should work:
+
+.. code-block:: shell
+
+   /opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+
+v3.07.00 - 2021/12/13
+*********************
+
+No specific upgrade instructions.
+
+v3.06.00 - 2021/10/15
+*********************
+
+The ``sshd_config`` templates have been modified to reflect the changes needed to use
+the new ``--pubkey-auth-optional`` parameter of :doc:`/plugins/restricted/accountModify`
+(`#237 <https://github.com/ovh/the-bastion/pull/237>`_).
+If you want to use it, don't forget to review your ``sshd_config`` and modify it accordingly:
+the templates can be found in ``etc/ssh/``.
+
+Note that misconfiguring `sshd` and `pam` together could at worst entirely disable sshd authentication.
+If you have a custom configuration, different from the templates we provide, please double-check
+that such corner case is not possible by design.
+A good way to ensure this is to review the `pam` configuration and ensure that there is no execution
+flow that pushes a `pam_success` value to the pam stack without requiring any form of authentication.
+
+v3.05.01 - 2021/09/22
+*********************
+
+In the configuration of the ``osh-backup-acl-keys`` script, a signing key can now be specified so that the backups
+are signed by the bastion key in addition to being encrypted to the admin(s) key(s).
+By default, the behaviour is the same as before: encrypt but don't sign.
+
+v3.05.00 - 2021/09/14
+*********************
+
+The maximum length of accounts is now 28 characters up from 18 characters previously.
+If you have setup a HA cluster with several bastion instances synchronized together, note that accounts longer
+than 18 characters will not be deemed as valid on not-yet upgraded instances of a cluster.
+
+v3.04.00 - 2021/07/02
+*********************
+
+The upgrade path from the preceding version is straightforward, however there are a few changes
+that you might want to be aware of before hitting the upgrade button:
+
+- Some EOL OSes have been dropped: Debian 8, Ubuntu 14.04, OpenSUSE 15.0 and 15.1.
+  This means that while the software might still work, theses OSes are no longer part of the tests
+  and might break in any future upgrade.
+
+- The default logging level of the :doc:`/using/http_proxy` has been decreased. If you want to keep full requests
+  and responses logging, check the :doc:`log_request_response and log_request_response_max_size
+  </administration/configuration/osh-http-proxy_conf>` configuration options.
+
+v3.03.01 - 2021/03/25
+*********************
+
+No specific upgrade instructions.
+
+v3.03.00 - 2021/02/22
+*********************
+
+No specific upgrade instructions.
+
+v3.02.00 - 2021/02/01
+*********************
+
+The upgrade path from the preceding version is straightforward, however there are a few changes
+that you might want to be aware of before hitting the upgrade button:
+
+The main configuration file now supports proper booleans
+--------------------------------------------------------
+
+For a lot of configuration options, previously you would specify "1" to enable a feature, and "0" to disable it.
+This has been changed to use proper *true* and *false* json values in :file:`/etc/bastion/bastion.conf`.
+Of course, backward compatibility with "0" and "1" will always be kept, so no breakage is to be expected
+for this version or future ones even if you keep your configuration untouched.
+
+Logs have been enhanced
+-----------------------
+
+All connections and plugin executions emit two logs, an *open* and a *close* log.
+We now add all the details of the connection to the *close* logs, those that were previously only available
+in the corresponding *open* log. This way, it is no longer required to correlate both logs with their uniqid
+to have all the data: the *close* log should suffice.
+The *open* log is still there if for some reason the *close* log can't be emitted (kill -9, system crash, etc.),
+or if the *open* and the *close* log are several hours, days or months appart.
+
+An additional field **duration** has been added to the *close* logs,
+this represents the number of seconds (with millisecond precision) the connection lasted.
+
+Two new fields **globalsql** and **accountsql** have been added to the *open*-type logs.
+These will contain either `ok` if we successfully logged to the corresponding log database,
+`no` if it is disabled, or `error $aDetailedMessage` if we got an error trying to insert the row.
+The *close*-type log also has the new **accountsql_close** field, but misses the **globalsql_close** field as
+we never update the global database on this event.
+On the *close* log, we can also have the value **missing**, indicating that we couldn't update the access log row
+in the database, as the corresponding *open* log couldn't insert it.
+
+The **ttyrecsize** log field for the *close*-type logs has been removed, as it was never completely implemented,
+and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases.
+
+The *open* and *close* events are now pushed to our own log files, in addition to syslog, if logging to those files
+is enabled (see :ref:`enableGlobalAccessLog` and :ref:`enableAccountAccessLog`),
+previously the *close* events were only pushed to syslog.
+
+The :file:`/home/osh.log` file is no longer used for :ref:`enableGlobalAccessLog`, the global log
+is instead written to :file:`/home/logkeeper/global-log-YYYYMM.log`.
+
+The global sql file, enabled with :ref:`enableGlobalSqlLog`, is now split by year-month instead of by year,
+to :file:`/home/logkeeper/global-log-YYYYMM.sqlite`.
+
+v3.01.03 - 2020/12/15
+*********************
+
+No specific upgrade instructions.
+
+v3.01.02 - 2020/12/08
+*********************
+
+No specific upgrade instructions.
+
+v3.01.01 - 2020/12/04
+*********************
+
+No specific upgrade instructions.
+
+v3.01.00 - 2020/11/20
+*********************
+
+A new bastion.conf option was introduced: *interactiveModeByDefault*. If not present in your config file,
+its value defaults to 1 (true), which changes the behavior of The Bastion when a user connects
+without specifying any command.
+When this happens, it'll now display the help then drop the user into interactive mode (if this mode is enabled),
+instead of displaying the help and aborting with an error message.
+Set it to 0 (false) if you want to keep the previous behavior.
+
+An SELinux module has been added in this version, to ensure TOTP MFA works correctly under systems where SELinux
+is on enforcing mode. This module will be installed automatically whenever SELinux is detected on the system.
+If you don't want to use this module, specify `--no-install-selinux-module` on your `/opt/bastion/bin/admin/install`
+upgrade call (please refer to the generic upgrade instructions for more details).
+
+v3.00.02 - 2020/11/16
+*********************
+
+No specific upgrade instructions.
+
+v3.00.01 - 2020/11/06
+*********************
+
+If you previously installed ``ttyrec`` using the now deprecated ``build-and-install-ttyrec.sh`` script,
+you might want to know that since this version, the script has been replaced by ``install-ttyrec.sh``,
+which no longer builds in-place, but prefers downloading and installing prebuild ``rpm`` or ``deb`` packages.
+
+If you previously built and installed ``ttyrec`` manually, and want to use the new packages instead,
+you might want to manually uninstall your previously built ttyrec program (remove the binaries that were installed
+in ``/usr/local/bin``), and call ``install-ttyrec.sh -a`` to download and install the proper package instead.
+
+This is not mandatory and doesn't change anything from the software point of view.
+
+v3.00.00 - 2020/10/30
+*********************
+
+Initial public version, no specific upgrade instructions.
diff --git a/_sources/plugins/admin/adminMaintenance.rst.txt b/_sources/plugins/admin/adminMaintenance.rst.txt
new file mode 100644
index 000000000..e17c921c1
--- /dev/null
+++ b/_sources/plugins/admin/adminMaintenance.rst.txt
@@ -0,0 +1,28 @@
+=================
+adminMaintenance
+=================
+
+Manage the bastion maintenance mode
+===================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh adminMaintenance <--lock [--message "'reason for maintenance'"]|--unlock>
+
+.. program:: adminMaintenance
+
+
+.. option:: --lock
+
+   Set maintenance mode: new logins will be disallowed
+
+.. option:: --unlock
+
+   Unset maintenance mode: new logins are allowed and the bastion functions normally
+
+.. option:: --message MESSAGE
+
+   Optionally set a maintenance reason, if you're in a shell, quote it twice.
+
diff --git a/_sources/plugins/admin/adminSudo.rst.txt b/_sources/plugins/admin/adminSudo.rst.txt
new file mode 100644
index 000000000..4ef867463
--- /dev/null
+++ b/_sources/plugins/admin/adminSudo.rst.txt
@@ -0,0 +1,31 @@
+==========
+adminSudo
+==========
+
+Impersonate another user
+========================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh adminSudo -- --sudo-as ACCOUNT <--sudo-cmd PLUGIN -- [PLUGIN specific options...]>
+
+.. program:: adminSudo
+
+
+.. option:: --sudo-as ACCOUNT
+
+   Specify which bastion account we want to impersonate
+
+.. option:: --sudo-cmd PLUGIN
+
+   --osh command we want to launch as the user (see --osh help)
+
+
+Example::
+
+  --osh adminSudo -- --sudo-as user12 --sudo-cmd info -- --name somebodyelse
+
+Don't forget the double-double-dash as seen in the example above: one after the plugin name,
+and another one to separate adminSudo options from the options of the plugin to be called.
diff --git a/_sources/plugins/admin/index.rst.txt b/_sources/plugins/admin/index.rst.txt
new file mode 100644
index 000000000..52632b5b4
--- /dev/null
+++ b/_sources/plugins/admin/index.rst.txt
@@ -0,0 +1,8 @@
+==============
+admin plugins
+==============
+
+.. toctree::
+
+   adminMaintenance
+   adminSudo
diff --git a/_sources/plugins/group-aclkeeper/groupAddServer.rst.txt b/_sources/plugins/group-aclkeeper/groupAddServer.rst.txt
new file mode 100644
index 000000000..cc7e9dfc7
--- /dev/null
+++ b/_sources/plugins/group-aclkeeper/groupAddServer.rst.txt
@@ -0,0 +1,78 @@
+===============
+groupAddServer
+===============
+
+Add an IP or IP block to a group's servers list
+===============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupAddServer --group GROUP [OPTIONS]
+
+.. program:: groupAddServer
+
+
+.. option:: --group GROUP
+
+   Specify which group this machine should be added to (it should have the public group key of course)
+
+.. option:: --host HOST|IP|NET/CIDR
+
+   Host(s) to add access to, either a HOST which will be resolved to an IP immediately, or an IP,
+
+                             or a whole network using the NET/CIDR notation
+.. option:: --user USER
+
+   Specify which remote user should be allowed (root, run, etc...)
+
+.. option:: --user-any
+
+   Allow any remote user (the remote user should still have the public group key in all cases)
+
+.. option:: --port PORT
+
+   Only allow access to this port (e.g. 22)
+
+.. option:: --port-any
+
+   Allow access to any port
+
+.. option:: --scpup
+
+   Allow SCP upload, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   Allow SCP download, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   Allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
+.. option:: --force
+
+   Don't try the ssh connection, just add the host to the group blindly
+
+.. option:: --force-key FINGERPRINT
+
+   Only use the key with the specified fingerprint to connect to the server (cf groupInfo)
+
+.. option:: --force-password HASH
+
+   Only use the password with the specified hash to connect to the server (cf groupListPasswords)
+
+.. option:: --ttl SECONDS|DURATION
+
+   Specify a number of seconds (or a duration string, such as "1d7h8m") after which the access will automatically expire
+
+.. option:: --comment '"ANY TEXT'"
+
+   Add a comment alongside this server
+
+
+Examples::
+
+  --osh groupAddServer --group grp1 --host 203.0.113.0/24 --user-any --port-any --force --comment '"a whole network"'
+  --osh groupAddServer --group grp2 --host srv1.example.org --user root --port 22
diff --git a/_sources/plugins/group-aclkeeper/groupDelServer.rst.txt b/_sources/plugins/group-aclkeeper/groupDelServer.rst.txt
new file mode 100644
index 000000000..72e5b21db
--- /dev/null
+++ b/_sources/plugins/group-aclkeeper/groupDelServer.rst.txt
@@ -0,0 +1,52 @@
+===============
+groupDelServer
+===============
+
+Remove an IP or IP block from a group's server list
+===================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelServer --group GROUP [OPTIONS]
+
+.. program:: groupDelServer
+
+
+.. option:: --group GROUP
+
+   Specify which group this machine should be removed from
+
+.. option:: --host HOST|IP|NET/CIDR
+
+   Host(s) we want to remove access to
+
+.. option:: --user USER
+
+   Remote user that was allowed, if any user was allowed, use --user-any
+
+.. option:: --user-any
+
+   Use if any remote login was allowed
+
+.. option:: --port PORT
+
+   Remote SSH port that was allowed, if any port was allowed, use --port-any
+
+.. option:: --port-any
+
+   Use if any remote port was allowed
+
+.. option:: --scpup
+
+   Remove SCP upload right, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   Remove SCP download right, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   Remove usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
diff --git a/_sources/plugins/group-aclkeeper/index.rst.txt b/_sources/plugins/group-aclkeeper/index.rst.txt
new file mode 100644
index 000000000..b3007d6a0
--- /dev/null
+++ b/_sources/plugins/group-aclkeeper/index.rst.txt
@@ -0,0 +1,8 @@
+========================
+group-aclkeeper plugins
+========================
+
+.. toctree::
+
+   groupAddServer
+   groupDelServer
diff --git a/_sources/plugins/group-gatekeeper/groupAddGuestAccess.rst.txt b/_sources/plugins/group-gatekeeper/groupAddGuestAccess.rst.txt
new file mode 100644
index 000000000..be9a99edf
--- /dev/null
+++ b/_sources/plugins/group-gatekeeper/groupAddGuestAccess.rst.txt
@@ -0,0 +1,77 @@
+====================
+groupAddGuestAccess
+====================
+
+Add a specific group server access to an account
+================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupAddGuestAccess --group GROUP --account ACCOUNT [OPTIONS]
+
+.. program:: groupAddGuestAccess
+
+
+.. option:: --group GROUP
+
+   group to add guest access to
+
+.. option:: --account ACCOUNT
+
+   name of the other bastion account to add access to, they'll be given access to the GROUP key
+
+.. option:: --host HOST|IP
+
+   add access to this HOST (which must belong to the GROUP)
+
+.. option:: --user USER
+
+   allow connecting to HOST only with remote login USER
+
+.. option:: --user-any
+
+   allow connecting to HOST with any remote login
+
+.. option:: --port PORT
+
+   allow connecting to HOST only to remote port PORT
+
+.. option:: --port-any
+
+   allow connecting to HOST with any remote port
+
+.. option:: --scpup
+
+   allow SCP upload, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   allow SCP download, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
+.. option:: --ttl SECONDS|DURATION
+
+   specify a number of seconds after which the access will automatically expire
+
+.. option:: --comment '"ANY TEXT"'
+
+   add a comment alongside this access.
+
+                            If omitted, we'll use the closest preexisting group access' comment as seen in groupListServers
+
+This command adds, to an existing bastion account, access to the egress keys of a group,
+but only to accessing one or several given servers, instead of all the servers of this group.
+
+If you want to add complete access to an account to all the present and future servers
+of the group, using the group key, please use ``groupAddMember`` instead.
+
+If you want to add access to an account to a group server but using his personal bastion
+key instead of the group key, please use ``accountAddPersonalAccess`` instead (his public key
+must be on the remote server).
+
+This command is the opposite of ``groupDelGuestAccess``.
diff --git a/_sources/plugins/group-gatekeeper/groupAddMember.rst.txt b/_sources/plugins/group-gatekeeper/groupAddMember.rst.txt
new file mode 100644
index 000000000..074b53e18
--- /dev/null
+++ b/_sources/plugins/group-gatekeeper/groupAddMember.rst.txt
@@ -0,0 +1,29 @@
+===============
+groupAddMember
+===============
+
+Add an account to the member list
+=================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupAddMember --group GROUP --account ACCOUNT
+
+.. program:: groupAddMember
+
+
+.. option:: --group GROUP
+
+   which group to set ACCOUNT as a member of
+
+.. option:: --account ACCOUNT
+
+   which account to set as a member of GROUP
+
+
+The specified account will be able to access all present and future servers
+pertaining to this group.
+If you need to give a specific and/or temporary access instead,
+see ``groupAddGuestAccess``
diff --git a/_sources/plugins/group-gatekeeper/groupDelGuestAccess.rst.txt b/_sources/plugins/group-gatekeeper/groupDelGuestAccess.rst.txt
new file mode 100644
index 000000000..8e293ec72
--- /dev/null
+++ b/_sources/plugins/group-gatekeeper/groupDelGuestAccess.rst.txt
@@ -0,0 +1,64 @@
+====================
+groupDelGuestAccess
+====================
+
+Remove a specific group server access from an account
+=====================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelGuestAccess --group GROUP --account ACCOUNT [OPTIONS]
+
+.. program:: groupDelGuestAccess
+
+
+.. option:: --group GROUP
+
+   group to remove guest access from
+
+  --account ACCOUNT name of the other bastion account to remove access from
+.. option:: --host HOST|IP
+
+   remove access from this HOST (which must belong to the GROUP)
+
+.. option:: --user USER
+
+   allow connecting to HOST only with remote login USER
+
+.. option:: --user-any
+
+   allow connecting to HOST with any remote login
+
+.. option:: --port PORT
+
+   allow connecting to HOST only to remote port PORT
+
+.. option:: --port-any
+
+   allow connecting to HOST with any remote port
+
+.. option:: --scpup
+
+   allow SCP upload, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   allow SCP download, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
+
+This command removes, from an existing bastion account, access to a given server, using the
+egress keys of the group. The list of such servers is given by ``groupListGuestAccesses``
+
+If you want to remove member access from an account to all the present and future servers
+of the group, using the group key, please use ``groupDelMember`` instead.
+
+If you want to remove access from an account from a group server but using his personal bastion
+key instead of the group key, please use ``accountDelPersonalAccess`` instead.
+
+This command is the opposite of ``groupAddGuestAccess``.
diff --git a/_sources/plugins/group-gatekeeper/groupDelMember.rst.txt b/_sources/plugins/group-gatekeeper/groupDelMember.rst.txt
new file mode 100644
index 000000000..1e2ee8431
--- /dev/null
+++ b/_sources/plugins/group-gatekeeper/groupDelMember.rst.txt
@@ -0,0 +1,29 @@
+===============
+groupDelMember
+===============
+
+Remove an account from the members list
+=======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelMember --group GROUP --account ACCOUNT
+
+.. program:: groupDelMember
+
+
+.. option:: --group GROUP
+
+   which group to remove ACCOUNT as a member of
+
+.. option:: --account ACCOUNT
+
+   which account to remove as a member of GROUP
+
+
+The specified account will no longer be able to access all present and future servers
+pertaining to this group.
+Note that if this account also had specific guest accesses to this group, they may
+still apply, see ``groupListGuestAccesses``
diff --git a/_sources/plugins/group-gatekeeper/groupListGuestAccesses.rst.txt b/_sources/plugins/group-gatekeeper/groupListGuestAccesses.rst.txt
new file mode 100644
index 000000000..33548147d
--- /dev/null
+++ b/_sources/plugins/group-gatekeeper/groupListGuestAccesses.rst.txt
@@ -0,0 +1,43 @@
+=======================
+groupListGuestAccesses
+=======================
+
+List the guest accesses to servers of a group specifically granted to an account
+================================================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupListGuestAccesses --group GROUP --account ACCOUNT
+
+.. program:: groupListGuestAccesses
+
+
+.. option:: --group GROUP
+
+   Look for accesses to servers of this GROUP
+
+.. option:: --account ACCOUNT
+
+   Which account to check
+
+.. option:: --reverse-dns
+
+   Attempt to resolve the reverse hostnames (SLOW!)
+
+.. option:: --include PATTERN
+
+   Only include servers matching the given PATTERN (see below)
+
+                        This option can be used multiple times to refine results
+.. option:: --exclude PATTERN
+
+   Omit servers matching the given PATTERN (see below)
+
+                        This option can be used multiple times.
+                        Note that --exclude takes precedence over --include
+
+**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.
diff --git a/_sources/plugins/group-gatekeeper/index.rst.txt b/_sources/plugins/group-gatekeeper/index.rst.txt
new file mode 100644
index 000000000..0d3e4c4d4
--- /dev/null
+++ b/_sources/plugins/group-gatekeeper/index.rst.txt
@@ -0,0 +1,11 @@
+=========================
+group-gatekeeper plugins
+=========================
+
+.. toctree::
+
+   groupAddGuestAccess
+   groupAddMember
+   groupDelGuestAccess
+   groupDelMember
+   groupListGuestAccesses
diff --git a/_sources/plugins/group-owner/groupAddAclkeeper.rst.txt b/_sources/plugins/group-owner/groupAddAclkeeper.rst.txt
new file mode 100644
index 000000000..0f86dbbab
--- /dev/null
+++ b/_sources/plugins/group-owner/groupAddAclkeeper.rst.txt
@@ -0,0 +1,26 @@
+==================
+groupAddAclkeeper
+==================
+
+Add the group aclkeeper role to an account
+==========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupAddAclkeeper --group GROUP --account ACCOUNT
+
+.. program:: groupAddAclkeeper
+
+
+.. option:: --group GROUP
+
+   which group to set ACCOUNT as an aclkeeper of
+
+.. option:: --account ACCOUNT
+
+   which account to set as an aclkeeper of GROUP
+
+
+The specified account will be able to manage the server list of this group
diff --git a/_sources/plugins/group-owner/groupAddGatekeeper.rst.txt b/_sources/plugins/group-owner/groupAddGatekeeper.rst.txt
new file mode 100644
index 000000000..1e2614f9c
--- /dev/null
+++ b/_sources/plugins/group-owner/groupAddGatekeeper.rst.txt
@@ -0,0 +1,27 @@
+===================
+groupAddGatekeeper
+===================
+
+Add the group gatekeeper role to an account
+===========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupAddGatekeeper --group GROUP --account ACCOUNT
+
+.. program:: groupAddGatekeeper
+
+
+.. option:: --group GROUP
+
+   which group to set ACCOUNT as a gatekeeper of
+
+.. option:: --account ACCOUNT
+
+   which account to set as a gatekeeper of GROUP
+
+
+The specified account will be able to manage the members list of this group,
+along with the guests list
diff --git a/_sources/plugins/group-owner/groupAddOwner.rst.txt b/_sources/plugins/group-owner/groupAddOwner.rst.txt
new file mode 100644
index 000000000..0dc14a6ff
--- /dev/null
+++ b/_sources/plugins/group-owner/groupAddOwner.rst.txt
@@ -0,0 +1,29 @@
+==============
+groupAddOwner
+==============
+
+Add the group owner role to an account
+======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupAddOwner --group GROUP --account ACCOUNT
+
+.. program:: groupAddOwner
+
+
+.. option:: --group GROUP
+
+   which group to set ACCOUNT as an owner of
+
+.. option:: --account ACCOUNT
+
+   which account to set as an owner of GROUP
+
+
+The specified account will be able to manage the owner, gatekeeper
+and aclkeeper list of this group. In other words, this account will
+have all possible rights to manage the group and delegate some or all
+of the rights to other accounts
diff --git a/_sources/plugins/group-owner/groupDelAclkeeper.rst.txt b/_sources/plugins/group-owner/groupDelAclkeeper.rst.txt
new file mode 100644
index 000000000..e52f62653
--- /dev/null
+++ b/_sources/plugins/group-owner/groupDelAclkeeper.rst.txt
@@ -0,0 +1,26 @@
+==================
+groupDelAclkeeper
+==================
+
+Remove the group aclkeeper role from an account
+===============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelAclkeeper --group GROUP --account ACCOUNT
+
+.. program:: groupDelAclkeeper
+
+
+.. option:: --group GROUP
+
+   which group to remove ACCOUNT as an aclkeeper of
+
+.. option:: --account ACCOUNT
+
+   which account to remove as an aclkeeper of GROUP
+
+
+The specified account will no longer be able to manage the server list of this group
diff --git a/_sources/plugins/group-owner/groupDelEgressKey.rst.txt b/_sources/plugins/group-owner/groupDelEgressKey.rst.txt
new file mode 100644
index 000000000..6b76062e9
--- /dev/null
+++ b/_sources/plugins/group-owner/groupDelEgressKey.rst.txt
@@ -0,0 +1,24 @@
+==================
+groupDelEgressKey
+==================
+
+Remove a bastion group egress key
+=================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelEgressKey <--group GROUP> <--id ID>
+
+.. program:: groupDelEgressKey
+
+
+.. option:: --group GROUP
+
+   Name of the group to delete the egress key from
+
+.. option:: --id ID
+
+   Specify the key ID to delete, you can get it with groupInfo
+
diff --git a/_sources/plugins/group-owner/groupDelGatekeeper.rst.txt b/_sources/plugins/group-owner/groupDelGatekeeper.rst.txt
new file mode 100644
index 000000000..1da1893f9
--- /dev/null
+++ b/_sources/plugins/group-owner/groupDelGatekeeper.rst.txt
@@ -0,0 +1,27 @@
+===================
+groupDelGatekeeper
+===================
+
+Remove the group gatekeeper role from an account
+================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelGatekeeper --group GROUP --account ACCOUNT
+
+.. program:: groupDelGatekeeper
+
+
+.. option:: --group GROUP
+
+   which group to remove ACCOUNT as a gatekeeper of
+
+.. option:: --account ACCOUNT
+
+   which account to remove as a gatekeeper of GROUP
+
+
+The specified account will no longer be able to manager the members nor
+the guest list of this group
diff --git a/_sources/plugins/group-owner/groupDelOwner.rst.txt b/_sources/plugins/group-owner/groupDelOwner.rst.txt
new file mode 100644
index 000000000..9fabe2a53
--- /dev/null
+++ b/_sources/plugins/group-owner/groupDelOwner.rst.txt
@@ -0,0 +1,27 @@
+==============
+groupDelOwner
+==============
+
+Remove the group owner role from an account
+===========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelOwner --group GROUP --account ACCOUNT
+
+.. program:: groupDelOwner
+
+
+.. option:: --group GROUP
+
+   which group to set ACCOUNT as an owner of
+
+.. option:: --account ACCOUNT
+
+   which account to set as an owner of GROUP
+
+
+The specified account will no longer be able to manage the owner,
+gatekeeper and aclkeeper lists of this group
diff --git a/_sources/plugins/group-owner/groupDestroy.rst.txt b/_sources/plugins/group-owner/groupDestroy.rst.txt
new file mode 100644
index 000000000..73de12614
--- /dev/null
+++ b/_sources/plugins/group-owner/groupDestroy.rst.txt
@@ -0,0 +1,27 @@
+=============
+groupDestroy
+=============
+
+Delete a group
+==============
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDestroy --group GROUP
+
+.. program:: groupDestroy
+
+
+.. option:: --group GROUP
+
+   Group name to delete
+
+.. option:: --no-confirm
+
+   Skip group name confirmation, but blame yourself if you deleted the wrong group!
+
+
+This command is able to delete any group you're an owner of.
+Granted users to the sibling restricted command `groupDelete` can delete any group.
diff --git a/_sources/plugins/group-owner/groupGenerateEgressKey.rst.txt b/_sources/plugins/group-owner/groupGenerateEgressKey.rst.txt
new file mode 100644
index 000000000..2b803e45c
--- /dev/null
+++ b/_sources/plugins/group-owner/groupGenerateEgressKey.rst.txt
@@ -0,0 +1,50 @@
+=======================
+groupGenerateEgressKey
+=======================
+
+Create a new public + private key pair for a group
+==================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupGenerateEgressKey --group GROUP --algo ALGO --size SIZE [--encrypted]
+
+.. program:: groupGenerateEgressKey
+
+
+.. option:: --group GROUP
+
+   Group name to generate a new egress key for.
+
+
+.. option:: --algo ALGO
+
+   Specifies the algo of the key, either rsa, ecdsa or ed25519.
+
+
+.. option:: --size SIZE
+
+   Specifies the size of the key to be generated.
+
+                   For RSA, choose between 2048 and 8192 (4096 is good).
+                   For ECDSA, choose either 256, 384 or 521.
+                   For Ed25519, size is always 256.
+
+.. option:: --encrypted
+
+   If specified, a passphrase will be prompted for the new key
+
+
+
+A quick overview of the different algorithms:
+
+.. code-block:: none
+
+   Ed25519      : robustness[###] speed[###]
+   ECDSA        : robustness[##.] speed[###]
+   RSA          : robustness[#..] speed[#..]
+
+This table is meant as a quick cheat-sheet, you're warmly advised to do
+your own research, as other constraints may apply to your environment.
diff --git a/_sources/plugins/group-owner/groupGeneratePassword.rst.txt b/_sources/plugins/group-owner/groupGeneratePassword.rst.txt
new file mode 100644
index 000000000..c01687f91
--- /dev/null
+++ b/_sources/plugins/group-owner/groupGeneratePassword.rst.txt
@@ -0,0 +1,40 @@
+======================
+groupGeneratePassword
+======================
+
+Generate a new egress password for the group
+============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupGeneratePassword --group GROUP [--size SIZE] --do-it
+
+.. program:: groupGeneratePassword
+
+
+.. option:: --group GROUP
+
+   Specify which group you want to generate a password for
+
+.. option:: --size  SIZE
+
+   Specify the number of characters of the password to generate
+
+.. option:: --do-it
+
+   Required for the password to actually be generated, BEWARE: please read the note below
+
+
+Generate a new egress password to be used for ssh or telnet
+
+NOTE: this is only needed for devices that don't support key-based SSH,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access only support telnet or password-based SSH.
+
+BEWARE: once a new password is generated this way, it'll be set as the new
+egress password to use right away for the group, for any access that requires it.
+A fallback mechanism exists that will auto-try the previous password if this one
+doesn't work, but please ensure that this new password is deployed on the remote
+devices as soon as possible.
diff --git a/_sources/plugins/group-owner/groupModify.rst.txt b/_sources/plugins/group-owner/groupModify.rst.txt
new file mode 100644
index 000000000..d173d6fe4
--- /dev/null
+++ b/_sources/plugins/group-owner/groupModify.rst.txt
@@ -0,0 +1,41 @@
+============
+groupModify
+============
+
+Modify the configuration of a group
+===================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupModify --group GROUP [--mfa-required password|totp|any|none] [--guest-ttl-limit DURATION]
+
+.. program:: groupModify
+
+
+.. option:: --group             GROUP
+
+   Name of the group to modify
+
+.. option:: --mfa-required      password|totp|any|none
+
+   Enforce UNIX password requirement, or TOTP requirement, or any MFA requirement, when connecting to a server of the group
+
+  --idle-lock-timeout DURATION|0|-1            Overrides the global setting (`idleLockTimeout`), to the specified duration. If set to 0, disables `idleLockTimeout` for
+                                                 this group. If set to -1, remove this group override and use the global setting instead.
+  --idle-kill-timeout DURATION|0|-1            Overrides the global setting (`idleKillTimeout`), to the specified duration. If set to 0, disables `idleKillTimeout` for
+                                                 this group. If set to -1, remove this group override and use the global setting instead.
+.. option:: --guest-ttl-limit   DURATION
+
+   This group will enforce TTL setting, on guest access creation, to be set, and not to a higher value than DURATION,
+
+                                                 set to zero to allow guest accesses creation without any TTL set (default)
+
+Note that `--idle-lock-timeout` and `--idle-kill-timeout` will NOT be applied for catch-all groups (having 0.0.0.0/0 in their server list).
+
+If a server is in exactly one group an account is a member of, then its values of `--idle-lock-timeout` and `--idle-kill-timeout`, if set,
+will prevail over the global setting. The global setting can be seen with `--osh info`.
+
+Otherwise, the most restrictive setting (i.e. the one with the lower strictly positive duration) between
+all the considered groups and the global setting, will be used.
diff --git a/_sources/plugins/group-owner/groupTransmitOwnership.rst.txt b/_sources/plugins/group-owner/groupTransmitOwnership.rst.txt
new file mode 100644
index 000000000..5f1257562
--- /dev/null
+++ b/_sources/plugins/group-owner/groupTransmitOwnership.rst.txt
@@ -0,0 +1,27 @@
+=======================
+groupTransmitOwnership
+=======================
+
+Transmit your group ownership to somebody else
+==============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupTransmitOwnership --group GROUP --account ACCOUNT
+
+.. program:: groupTransmitOwnership
+
+
+.. option:: --group GROUP
+
+   which group to set ACCOUNT as an owner of
+
+.. option:: --account ACCOUNT
+
+   which account to set as an owner of GROUP
+
+
+Note that this command has the same net effect than using ``groupAddOwner``
+to add ACCOUNT as an owner, then removing yourself with ``groupDelOwner``
diff --git a/_sources/plugins/group-owner/index.rst.txt b/_sources/plugins/group-owner/index.rst.txt
new file mode 100644
index 000000000..387be6936
--- /dev/null
+++ b/_sources/plugins/group-owner/index.rst.txt
@@ -0,0 +1,18 @@
+====================
+group-owner plugins
+====================
+
+.. toctree::
+
+   groupAddAclkeeper
+   groupAddGatekeeper
+   groupAddOwner
+   groupDelAclkeeper
+   groupDelEgressKey
+   groupDelGatekeeper
+   groupDelOwner
+   groupDestroy
+   groupGenerateEgressKey
+   groupGeneratePassword
+   groupModify
+   groupTransmitOwnership
diff --git a/_sources/plugins/open/alive.rst.txt b/_sources/plugins/open/alive.rst.txt
new file mode 100644
index 000000000..ee5c944e9
--- /dev/null
+++ b/_sources/plugins/open/alive.rst.txt
@@ -0,0 +1,23 @@
+======
+alive
+======
+
+Ping a host and exit as soon as it answers
+==========================================
+
+
+This command can be used to monitor a host that is expected to go back online soon.
+Note that if you want to ssh to it afterwards, you can simply use the ``--wait`` main option.
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh alive [--host] HOSTNAME
+
+.. program:: alive
+
+
+.. option:: --host HOSTNAME
+
+   hostname or IP to ping
+
diff --git a/_sources/plugins/open/batch.rst.txt b/_sources/plugins/open/batch.rst.txt
new file mode 100644
index 000000000..c69f485c8
--- /dev/null
+++ b/_sources/plugins/open/batch.rst.txt
@@ -0,0 +1,37 @@
+======
+batch
+======
+
+Run a batch of osh commands fed through STDIN
+=============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh batch
+
+.. program:: batch
+
+
+**Examples:**
+
+(replace ``bssh`` by your bastion alias)
+
+- run 3 simple commands in a oneliner:
+
+::
+
+  printf "%b\n%b\n%b" info selfListIngressKeys selfListEgressKeys | bssh --osh batch
+
+- run a lot of commands written out line by line in a file:
+
+::
+
+  bssh --osh batch < cmdlist.txt
+
+- add 3 users to a group:
+
+::
+
+  for i in user1 user2 user3; do echo "groupAddMember --account $i --group grp4"; done | bssh --osh batch
diff --git a/_sources/plugins/open/clush.rst.txt b/_sources/plugins/open/clush.rst.txt
new file mode 100644
index 000000000..9ec8919d5
--- /dev/null
+++ b/_sources/plugins/open/clush.rst.txt
@@ -0,0 +1,44 @@
+======
+clush
+======
+
+Launch a remote command on several machines sequentially (clush-like)
+=====================================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh clush [OPTIONS] --command '"remote command"'
+
+.. program:: clush
+
+
+.. option:: --list HOSTLIST
+
+   Comma-separated list of the hosts (hostname or IP) to run the command on
+
+.. option:: --user USER
+
+   Specify which remote user should we use to connect (default: BASTION_ACCOUNT)
+
+.. option:: --port PORT
+
+   Specify which port to connect to (default: 22)
+
+.. option:: --step-by-step
+
+   Pause before running the command on each host
+
+.. option:: --no-pause-on-failure
+
+   Don't pause if the remote command failed (returned exit code != 0)
+
+.. option:: --no-confirm
+
+   Skip confirmation of the host list and command
+
+.. option:: --command '"remote cmd"'
+
+   Command to be run on the remote hosts. If you're in a shell, quote it twice as shown.
+
diff --git a/_sources/plugins/open/groupInfo.rst.txt b/_sources/plugins/open/groupInfo.rst.txt
new file mode 100644
index 000000000..a3eb3886e
--- /dev/null
+++ b/_sources/plugins/open/groupInfo.rst.txt
@@ -0,0 +1,70 @@
+==========
+groupInfo
+==========
+
+Print some basic information about a group
+==========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupInfo <--group GROUP|--all> [OPTIONS]
+
+.. program:: groupInfo
+
+
+.. option:: --group GROUP
+
+   Specify the group to display the info of
+
+.. option:: --all
+
+   Dump info for all groups (auditors only), use with ``--json``
+
+
+.. option:: --with[out]-everything
+
+   Include or exclude all below options, including future ones
+
+.. option:: --with[out]-keys
+
+   Whether to include the group keys list (slow-ish, default: yes)
+
+Usage examples
+==============
+
+Show info about a specific group::
+
+    --osh groupInfo --group mygroup2
+
+Gather info about all groups, with no extra data except their keys::
+
+    --osh groupInfo --all --without-everything --with-keys --json
+
+Gather info about all groups, including all extra data (and possibly future options)::
+
+    --osh groupInfo --all --with-everything --json
+
+Output example
+==============
+
+.. code-block: none
+
+  | Group mygroup's Owners are: user1
+  | Group mygroup's GateKeepers (managing the members/guests list) are: user2
+  | Group mygroup's ACLKeepers (managing the group servers list) are: user3
+  | Group mygroup's Members (with access to ALL the group servers) are: user4
+  | Group mygroup's Guests (with access to SOME of the group servers) are: user5
+  |
+  | The public key of this group is:
+  |
+  | fingerprint: SHA256:r/PQS4wLdSWqjYsDca8ReKjhq0l9EX+zQgiUR5qKdlc (ED25519-256) [2018/04/16]
+  | keyline follows, please copy the *whole* line:
+  from="203.0.113.4/32,192.0.2.0/26" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdD60bA3NgaOpRLgcACWfKcAMRQQRyFMppwp5GpHLTB mygroup@testbastion:1523886640
+
+The first paragraph of the output lists the different roles along with the people having these roles.
+
+You can also see the public egress key of this group, i.e. the key that needs to be added to the remote servers' ``authorized_keys`` files, so that ``members`` of this group can access these servers.
+
+Note that if you want to see the list of servers pertaining to this group, you can use the command ``groupListServers``.
diff --git a/_sources/plugins/open/groupList.rst.txt b/_sources/plugins/open/groupList.rst.txt
new file mode 100644
index 000000000..02fe221bd
--- /dev/null
+++ b/_sources/plugins/open/groupList.rst.txt
@@ -0,0 +1,34 @@
+==========
+groupList
+==========
+
+List the groups available on this bastion
+=========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupList [--all] [--exclude|--include PATTERN [--exclude|--include PATTERN ..]]
+
+.. program:: groupList
+
+
+.. option:: --all
+
+   List all groups, even those to which you don't have access
+
+.. option:: --include PATTERN
+
+   Only list groups that match the given PATTERN (see below)
+
+                        This option can be used multiple times to refine results
+.. option:: --exclude PATTERN
+
+   Omit groups that match the given PATTERN string (see below)
+
+                        This option can be used multiple times.
+                        Note that --exclude takes precedence over --include
+
+**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
diff --git a/_sources/plugins/open/groupListPasswords.rst.txt b/_sources/plugins/open/groupListPasswords.rst.txt
new file mode 100644
index 000000000..ed436413a
--- /dev/null
+++ b/_sources/plugins/open/groupListPasswords.rst.txt
@@ -0,0 +1,22 @@
+===================
+groupListPasswords
+===================
+
+List the hashes and metadata of egress passwords of a group
+===========================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupListPasswords --group GROUP
+
+.. program:: groupListPasswords
+
+
+.. option:: --group GROUP
+
+   Show the data for this group
+
+
+The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH
diff --git a/_sources/plugins/open/groupListServers.rst.txt b/_sources/plugins/open/groupListServers.rst.txt
new file mode 100644
index 000000000..83b9318ac
--- /dev/null
+++ b/_sources/plugins/open/groupListServers.rst.txt
@@ -0,0 +1,39 @@
+=================
+groupListServers
+=================
+
+List the servers (IPs and IP blocks) pertaining to a group
+==========================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupListServers --group GROUP [--reverse-dns]
+
+.. program:: groupListServers
+
+
+.. option:: --group GROUP
+
+   List the servers of this group
+
+.. option:: --reverse-dns
+
+   Attempt to resolve the reverse hostnames (SLOW!)
+
+.. option:: --include PATTERN
+
+   Only include servers matching the given PATTERN (see below)
+
+                        This option can be used multiple times to refine results
+.. option:: --exclude PATTERN
+
+   Omit servers matching the given PATTERN (see below)
+
+                        This option can be used multiple times.
+                        Note that --exclude takes precedence over --include
+
+**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.
diff --git a/_sources/plugins/open/help.rst.txt b/_sources/plugins/open/help.rst.txt
new file mode 100644
index 000000000..5ed31b840
--- /dev/null
+++ b/_sources/plugins/open/help.rst.txt
@@ -0,0 +1,31 @@
+=====
+help
+=====
+
+I'm So Meta, Even This Acronym
+==============================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh help
+
+.. program:: help
+
+Displays help about the available plugins callable with ``--osh``.
+
+If you need help on a specific plugin, you can use ``--osh PLUGIN --help``, replacing ``PLUGIN`` with the actual plugin name.
+
+Note that if you want some help about the bastion (and not specifically about the plugins), you should use ``--help`` (without ``--osh``).
+
+Colors
+======
+
+You'll notice that plugins are highlighted in different colors, these indicate the access level needed to run the plugin. Note that plugins you don't have access to are simply omitted.
+
+- green (``open``): these plugins can be called by anybody
+- blue (``restricted``): these plugins can only be called by users having the specific right to call them. This right is granted per plugin by the ``accountGrantCommand`` plugin
+- orange (``group-gatekeeper`` and ``group-aclkeeper``): these plugins can either be called by group gatekeepers or group aclkeepers. For clarity, the same color has been used for both cases
+- purple (``group-owner``): these plugins can only be called by group owners
+- red (``admin``): these plugins can only be called by bastion admins
diff --git a/_sources/plugins/open/index.rst.txt b/_sources/plugins/open/index.rst.txt
new file mode 100644
index 000000000..3ef7dd6f3
--- /dev/null
+++ b/_sources/plugins/open/index.rst.txt
@@ -0,0 +1,38 @@
+=============
+open plugins
+=============
+
+.. toctree::
+
+   alive
+   batch
+   clush
+   groupInfo
+   groupList
+   groupListPasswords
+   groupListServers
+   help
+   info
+   lock
+   mtr
+   nc
+   ping
+   scp
+   selfAddIngressKey
+   selfDelIngressKey
+   selfForgetHostKey
+   selfGenerateEgressKey
+   selfGeneratePassword
+   selfGenerateProxyPassword
+   selfListAccesses
+   selfListEgressKeys
+   selfListIngressKeys
+   selfListPasswords
+   selfListSessions
+   selfMFAResetPassword
+   selfMFAResetTOTP
+   selfMFASetupPassword
+   selfMFASetupTOTP
+   selfPlaySession
+   sftp
+   unlock
diff --git a/_sources/plugins/open/info.rst.txt b/_sources/plugins/open/info.rst.txt
new file mode 100644
index 000000000..e0b664e3c
--- /dev/null
+++ b/_sources/plugins/open/info.rst.txt
@@ -0,0 +1,86 @@
+=====
+info
+=====
+
+Displays some information about this bastion instance
+=====================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh info
+
+.. program:: info
+
+Output example
+==============
+
+::
+
+  ~ You are user1
+  ~ 
+  ~ Your alias to connect to this bastion is:
+  ~ alias bastion='ssh user1@testbastion.example.org -p 22 -t -- '
+  ~ Your alias to connect to this bastion with MOSH is:
+  ~ alias bastionm='mosh --ssh="ssh -p 22 -t" user1@testbastion.example.org -- '
+  ~ 
+  ~ Multi-Factor Authentication (MFA) on your account:
+  ~ - Additional password authentication is not required
+  ~ - Additional password authentication bypass is disabled
+  ~ - Additional password authentication is enabled and active
+  ~ - Additional TOTP authentication is not required
+  ~ - Additional TOTP authentication bypass is disabled
+  ~ - Additional TOTP authentication is disabled
+  ~ 
+  ~ I am testbastion-a.example.org, aka bastion
+  ~ I have 42 registered accounts and 46 groups
+  ~ I am a MASTER, which means I accept modifications
+  ~ The networks I'm able to connect you to on the egress side are: all
+  ~ The networks that are explicitly forbidden on the egress side are: none
+  ~ My egress connection IP to remote servers is 192.0.2.45/32
+  ~ ...don't forget to whitelist me in your firewalls!
+  ~ 
+  ~ The following policy applies on this bastion:
+  ~ - The interactive mode (-i) is ENABLED
+  ~ - The support of mosh is ENABLED
+  ~ - Account expiration is DISABLED
+  ~ - Keyboard input idle time for session locking is DISABLED
+  ~ - Keyboard input idle time for session killing is DISABLED
+  ~ - The forced "from" prepend on ingress keys is DISABLED
+  ~ - The following algorithms are allowed for ingress SSH keys: rsa, ecdsa, ed25519
+  ~ - The RSA key size for ingress SSH keys must be between 2048 and 8192 bits
+  ~ - The following algorithms are allowed for egress SSH keys: rsa, ecdsa, ed25519
+  ~ - The RSA key size for egress SSH keys must be between 2048 and 8192 bits
+  ~ - The Multi-Factor Authentication (MFA) policy is ENABLED
+  ~ 
+  ~ Here is your excuse for anything not working today:
+  ~ BOFH excuse #444:
+  ~ overflow error in /dev/null
+
+
+Plugin configuration
+====================
+
+Options
+-------
+
+.. option:: admin_show_system_info (optional, boolean)
+
+    If enabled, bastion admins get more output regarding information of the
+    underlying OS. When omitted, this is enabled by default.
+
+.. option:: show_fortune (optional, boolean)
+
+    If enabled, and if the ``fortune`` package is installed on your OS,
+    shows a fortune. When omitted, this is enabled by default.
+
+Example
+-------
+
+Configuration, in JSON format, must be in :file:`/etc/bastion/plugin.info.conf`:
+
+.. code-block:: json
+   :emphasize-lines: 1
+
+   { "admin_show_system_info": false, "show_fortune": false }
diff --git a/_sources/plugins/open/lock.rst.txt b/_sources/plugins/open/lock.rst.txt
new file mode 100644
index 000000000..f0dfa81eb
--- /dev/null
+++ b/_sources/plugins/open/lock.rst.txt
@@ -0,0 +1,18 @@
+=====
+lock
+=====
+
+Manually lock all your current sessions
+=======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh lock
+
+.. program:: lock
+
+This command will lock all your current sessions on this bastion instance. Note that this only applies to the bastion instance you're launching this command on, not on the whole bastion cluster (if you happen to have one).
+
+To undo this action, you can use ``--osh unlock`` on the same instance.
diff --git a/_sources/plugins/open/mtr.rst.txt b/_sources/plugins/open/mtr.rst.txt
new file mode 100644
index 000000000..9e2dccf55
--- /dev/null
+++ b/_sources/plugins/open/mtr.rst.txt
@@ -0,0 +1,20 @@
+====
+mtr
+====
+
+Runs the mtr tool to traceroute a host
+======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh mtr [--host] HOST [--report]
+
+.. program:: mtr
+
+
+.. option:: --report
+
+   Don't run mtr interactively, output a text report once done
+
diff --git a/_sources/plugins/open/nc.rst.txt b/_sources/plugins/open/nc.rst.txt
new file mode 100644
index 000000000..9d6f6d6cb
--- /dev/null
+++ b/_sources/plugins/open/nc.rst.txt
@@ -0,0 +1,29 @@
+===
+nc
+===
+
+Check whether a remote TCP port is open
+=======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh nc [--host] HOST [--port] PORT [-w TIMEOUT]
+
+.. program:: nc
+
+
+.. option:: --host HOST
+
+   Host or IP to attempt to connect to
+
+.. option:: --port PORT
+
+   TCP port to attempt to connect to
+
+.. option:: -w SECONDS
+
+   Timeout in seconds (default: 3)
+
+Note that this is not a full-featured ``netcat``, we just test whether a remote port is open. There is no way to exchange data using this command.
diff --git a/_sources/plugins/open/ping.rst.txt b/_sources/plugins/open/ping.rst.txt
new file mode 100644
index 000000000..a82b15cb2
--- /dev/null
+++ b/_sources/plugins/open/ping.rst.txt
@@ -0,0 +1,36 @@
+=====
+ping
+=====
+
+Ping a remote host from the bastion
+===================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh ping [--host HOST] [-c COUNT] [-s PKTSZ] [-t TTL] [-w TIMEOUT]
+
+.. program:: ping
+
+
+.. option:: --host HOST
+
+   Remote host to ping
+
+.. option:: -c COUNT
+
+   Number of pings to send (default: infinite)
+
+.. option:: -s SIZE
+
+   Specify the packet size to send
+
+.. option:: -t TTL
+
+   TTL to set in the ICMP packet (default: OS dependent)
+
+.. option:: -w TIMEOUT
+
+   Exit unconditionally after this amount of seconds (default & max: 86400)
+
diff --git a/_sources/plugins/open/scp.rst.txt b/_sources/plugins/open/scp.rst.txt
new file mode 100644
index 000000000..e91b21c48
--- /dev/null
+++ b/_sources/plugins/open/scp.rst.txt
@@ -0,0 +1,32 @@
+====
+scp
+====
+
+Transfer files from/to remote servers using scp through the bastion
+===================================================================
+
+.. note::
+
+   This plugin generates a valid helper script for you to use the bastion over scp, read below to learn how to use it.
+
+To be able to use ``scp`` over the bastion, you need to have a helper script that is specific
+to your account on the bastion. This plugin's job is to generate it for you.
+You can simply run it, and follow the guidelines.
+
+Once this is done, you'll be able to ``scp`` through the bastion by adding ``-S SCP_SCRIPT`` to your
+regular ``scp`` command, where ``SCP_SCRIPT`` is the location of the script you've just generated.
+
+For example, to upload a file::
+
+   scp -S ~/scp_bastion localfile login@server:/dest/folder/
+
+Or to recursively download a folder contents::
+
+   scp -S ~/scp_bastion -r login@server:/src/folder/ /tmp/
+
+Please note that you need to be granted for uploading or downloading files
+with scp to/from the remote host, in addition to having the right to SSH to it.
+For a group, the right should be added with ``--scpup``/``--scpdown`` of the :doc:`/plugins/group-aclkeeper/groupAddServer` command.
+For a personal access, the right should be added with ``--scpup``/``--scpdown`` of the :doc:`/plugins/restricted/selfAddPersonalAccess` command.
+
+You'll find more information and examples in :doc:`/using/sftp_scp`.
diff --git a/_sources/plugins/open/selfAddIngressKey.rst.txt b/_sources/plugins/open/selfAddIngressKey.rst.txt
new file mode 100644
index 000000000..80fa5a8fe
--- /dev/null
+++ b/_sources/plugins/open/selfAddIngressKey.rst.txt
@@ -0,0 +1,30 @@
+==================
+selfAddIngressKey
+==================
+
+Add a new ingress public key to your account
+============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfAddIngressKey [--public-key '"ssh key text"'] [--piv]
+
+.. program:: selfAddIngressKey
+
+
+.. option:: --public-key KEY
+
+   Your new ingress public SSH key to deposit on the bastion, use double-quoting if your're under a shell.
+
+                      If this option is not specified, you'll be prompted interactively for your public SSH key. Note that you
+                      can also pass it through STDIN directly. If the policy of this bastion allows it, you may prefix the key
+                      with a 'from="IP1,IP2,..."' snippet, a la authorized_keys. However the policy might force a configured
+                      'from' prefix that will override yours, or be used if you don't specify it yourself.
+.. option:: --piv
+
+   Add a public SSH key from a PIV-compatible hardware token, along with its attestation certificate and key
+
+                      certificate, both in PEM format. If you specified --public-key, then the attestation and key certificate are
+                      expected on STDIN only, otherwise the public SSH key, the attestation and key certificate are expected on STDIN.
diff --git a/_sources/plugins/open/selfDelIngressKey.rst.txt b/_sources/plugins/open/selfDelIngressKey.rst.txt
new file mode 100644
index 000000000..433ed221c
--- /dev/null
+++ b/_sources/plugins/open/selfDelIngressKey.rst.txt
@@ -0,0 +1,26 @@
+==================
+selfDelIngressKey
+==================
+
+Remove an ingress public key from your account
+==============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfDelIngressKey [--id-to-delete|-l ID] [--fingerprint-to-delete|-f FP]
+
+.. program:: selfDelIngressKey
+
+
+.. option:: -l, --id-to-delete ID
+
+   Directly specify key id to delete (CAUTION!), you can get id with selfListIngressKeys
+
+.. option:: -f, --fingerprint-to-delete FP
+
+   Directly specify the fingerprint of the key to delete (CAUTION!)
+
+
+If none of these options are specified, you'll be prompted interactively.
diff --git a/_sources/plugins/open/selfForgetHostKey.rst.txt b/_sources/plugins/open/selfForgetHostKey.rst.txt
new file mode 100644
index 000000000..ca1f3b6b6
--- /dev/null
+++ b/_sources/plugins/open/selfForgetHostKey.rst.txt
@@ -0,0 +1,28 @@
+==================
+selfForgetHostKey
+==================
+
+Forget a known host key from your bastion account
+=================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfForgetHostKey [--host HOST] [--port PORT]
+
+.. program:: selfForgetHostKey
+
+
+.. option:: --host HOST
+
+   Host to remove from the known_hosts file
+
+.. option:: --port PORT
+
+   Port to look for in the known_hosts file (default: 22)
+
+
+This command is useful to remove the man-in-the-middle warning when a key has changed,
+however please verify that the host key change is legit before using this command.
+The warning SSH gives is there for a reason.
diff --git a/_sources/plugins/open/selfGenerateEgressKey.rst.txt b/_sources/plugins/open/selfGenerateEgressKey.rst.txt
new file mode 100644
index 000000000..2c9c2ae82
--- /dev/null
+++ b/_sources/plugins/open/selfGenerateEgressKey.rst.txt
@@ -0,0 +1,45 @@
+======================
+selfGenerateEgressKey
+======================
+
+Create a new public + private key pair on your bastion account
+==============================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfGenerateEgressKey --algo ALGO --size SIZE [--encrypted]
+
+.. program:: selfGenerateEgressKey
+
+
+.. option:: --algo ALGO
+
+   Specifies the algo of the key, either rsa, ecdsa or ed25519.
+
+
+.. option:: --size SIZE
+
+   Specifies the size of the key to be generated.
+
+               For RSA, choose between 2048 and 8192 (4096 is good).
+               For ECDSA, choose either 256, 384 or 521.
+               For ED25519, size is always 256.
+
+.. option:: --encrypted
+
+   if specified, a passphrase will be prompted for the new key
+
+
+
+A quick overview of the different algorithms:
+
+.. code-block:: none
+
+   Ed25519      : robustness[###] speed[###]
+   ECDSA        : robustness[##.] speed[###]
+   RSA          : robustness[#..] speed[#..]
+
+This table is meant as a quick cheat-sheet, you're warmly advised to do
+your own research, as other constraints may apply to your environment.
diff --git a/_sources/plugins/open/selfGeneratePassword.rst.txt b/_sources/plugins/open/selfGeneratePassword.rst.txt
new file mode 100644
index 000000000..4e37c33a0
--- /dev/null
+++ b/_sources/plugins/open/selfGeneratePassword.rst.txt
@@ -0,0 +1,36 @@
+=====================
+selfGeneratePassword
+=====================
+
+Generate a new egress password for your account
+===============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfGeneratePassword [--size SIZE] --do-it
+
+.. program:: selfGeneratePassword
+
+
+.. option:: --size SIZE
+
+   Specify the number of characters of the password to generate
+
+.. option:: --do-it
+
+   Required for the password to actually be generated, BEWARE: please read the note below
+
+
+This plugin generates a new egress password to be used for ssh or telnet
+
+NOTE: this is only needed for devices that don't support key-based SSH,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access only support telnet or password-based SSH.
+
+BEWARE: once a new password is generated this way, it'll be set as the new
+egress password to use right away for your account, for any access that requires it.
+A fallback mechanism exists that will auto-try the previous password if this one
+doesn't work, but please ensure that this new password is deployed on the remote
+devices as soon as possible.
diff --git a/_sources/plugins/open/selfGenerateProxyPassword.rst.txt b/_sources/plugins/open/selfGenerateProxyPassword.rst.txt
new file mode 100644
index 000000000..eb03a9041
--- /dev/null
+++ b/_sources/plugins/open/selfGenerateProxyPassword.rst.txt
@@ -0,0 +1,33 @@
+==========================
+selfGenerateProxyPassword
+==========================
+
+Generate a new ingress password to use the bastion HTTPS proxy
+==============================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfGenerateProxyPassword [--size SIZE] --do-it
+
+.. program:: selfGenerateProxyPassword
+
+
+.. option:: --size SIZE
+
+   Size of the password to generate
+
+.. option:: --do-it
+
+   Required for the password to actually be generated, BEWARE: please read the note below
+
+
+This plugin generates a new ingress password to use the bastion HTTPS proxy.
+
+NOTE: this is only needed for devices that only support HTTPS API and not ssh,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access are using an HTTPS API.
+
+BEWARE: once a new password is generated this way, it'll be set as the new
+HTTPS proxy ingress password to use right away for your account.
diff --git a/_sources/plugins/open/selfListAccesses.rst.txt b/_sources/plugins/open/selfListAccesses.rst.txt
new file mode 100644
index 000000000..af32b42c6
--- /dev/null
+++ b/_sources/plugins/open/selfListAccesses.rst.txt
@@ -0,0 +1,40 @@
+=================
+selfListAccesses
+=================
+
+Show the list of servers you have access to
+===========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfListAccesses [--hide-groups] [--reverse-dns]
+
+.. program:: selfListAccesses
+
+
+.. option:: --hide-groups
+
+   Don't show the machines you have access to through group rights.
+
+                       In other words, list only your personal accesses.
+.. option:: --reverse-dns
+
+   Attempt to resolve the reverse hostnames (SLOW!)
+
+.. option:: --include PATTERN
+
+   Only include accesses matching the given PATTERN (see below)
+
+                        This option can be used multiple times to refine results
+.. option:: --exclude PATTERN
+
+   Omit accesses matching the given PATTERN (see below)
+
+                        This option can be used multiple times.
+                        Note that --exclude takes precedence over --include
+
+**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.
diff --git a/_sources/plugins/open/selfListEgressKeys.rst.txt b/_sources/plugins/open/selfListEgressKeys.rst.txt
new file mode 100644
index 000000000..95933301f
--- /dev/null
+++ b/_sources/plugins/open/selfListEgressKeys.rst.txt
@@ -0,0 +1,20 @@
+===================
+selfListEgressKeys
+===================
+
+List the public egress keys of your account
+===========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfListEgressKeys
+
+.. program:: selfListEgressKeys
+
+
+The keys listed are the public egress SSH keys tied to your account.
+They can be used to gain access to another machine from this bastion,
+by putting one of those keys in the remote machine's ``authorized_keys`` file,
+and adding yourself access to this machine with ``selfAddPersonalAccess``.
diff --git a/_sources/plugins/open/selfListIngressKeys.rst.txt b/_sources/plugins/open/selfListIngressKeys.rst.txt
new file mode 100644
index 000000000..d8f3170d0
--- /dev/null
+++ b/_sources/plugins/open/selfListIngressKeys.rst.txt
@@ -0,0 +1,19 @@
+====================
+selfListIngressKeys
+====================
+
+List the public ingress keys of your account
+============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfListIngressKeys
+
+.. program:: selfListIngressKeys
+
+
+The keys listed are the public ingress SSH keys tied to your account.
+Their private counterpart should be detained only by you, and used
+to authenticate yourself to this bastion.
diff --git a/_sources/plugins/open/selfListPasswords.rst.txt b/_sources/plugins/open/selfListPasswords.rst.txt
new file mode 100644
index 000000000..0d36c40ec
--- /dev/null
+++ b/_sources/plugins/open/selfListPasswords.rst.txt
@@ -0,0 +1,17 @@
+==================
+selfListPasswords
+==================
+
+List the hashes and metadata of the egress passwords associated to your account
+===============================================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfListPasswords
+
+.. program:: selfListPasswords
+
+
+The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH
diff --git a/_sources/plugins/open/selfListSessions.rst.txt b/_sources/plugins/open/selfListSessions.rst.txt
new file mode 100644
index 000000000..325fed2f4
--- /dev/null
+++ b/_sources/plugins/open/selfListSessions.rst.txt
@@ -0,0 +1,73 @@
+=================
+selfListSessions
+=================
+
+List the few past sessions of your account
+==========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfListSessions [OPTIONS]
+
+.. program:: selfListSessions
+
+
+.. option:: --detailed
+
+   Display more information about each session
+
+.. option:: --limit LIMIT
+
+   Limit to LIMIT results
+
+.. option:: --id ID
+
+   Only sessions having this ID
+
+.. option:: --type TYPE
+
+   Only sessions of specified type (ssh, osh, ...)
+
+.. option:: --allowed
+
+   Only sessions that have been allowed by the bastion
+
+.. option:: --denied
+
+   Only sessions that have been denied by the bastion
+
+.. option:: --after WHEN
+
+   Only sessions that started after WHEN,
+
+                           WHEN can be a TIMESTAMP, or YYYY-MM-DD[@HH:MM:SS]
+.. option:: --before WHEN
+
+   Only sessions that started before WHEN,
+
+                           WHEN can be a TIMESTAMP, or YYYY-MM-DD[@HH:MM:SS]
+.. option:: --host HOST
+
+   Only sessions connecting to remote HOST
+
+.. option:: --to-port PORT
+
+   Only sessions connecting to remote PORT
+
+.. option:: --user USER
+
+   Only sessions connecting using remote USER
+
+.. option:: --via HOST
+
+   Only sessions that connected through bastion IP HOST
+
+.. option:: --via-port PORT
+
+   Only sessions that connected through bastion PORT
+
+
+Note that only the sessions that happened on this precise bastion instance will be shown,
+not the sessions from its possible cluster siblings.
diff --git a/_sources/plugins/open/selfMFAResetPassword.rst.txt b/_sources/plugins/open/selfMFAResetPassword.rst.txt
new file mode 100644
index 000000000..dacff4d49
--- /dev/null
+++ b/_sources/plugins/open/selfMFAResetPassword.rst.txt
@@ -0,0 +1,18 @@
+=====================
+selfMFAResetPassword
+=====================
+
+Remove the UNIX password of your account
+========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfMFAResetPassword
+
+.. program:: selfMFAResetPassword
+
+
+Note that if your password is set, you'll be prompted for it.
+Also note that this doesn't remove your UNIX password requirement, if set (see ``accountModify`` for this).
diff --git a/_sources/plugins/open/selfMFAResetTOTP.rst.txt b/_sources/plugins/open/selfMFAResetTOTP.rst.txt
new file mode 100644
index 000000000..dbeca4922
--- /dev/null
+++ b/_sources/plugins/open/selfMFAResetTOTP.rst.txt
@@ -0,0 +1,18 @@
+=================
+selfMFAResetTOTP
+=================
+
+Remove the TOTP configuration of your account
+=============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfMFAResetTOTP
+
+.. program:: selfMFAResetTOTP
+
+
+Note that if your TOTP is set, you'll be prompted for it.
+Also note that this doesn't remove your TOTP requirement, if set (see accountModify for this).
diff --git a/_sources/plugins/open/selfMFASetupPassword.rst.txt b/_sources/plugins/open/selfMFASetupPassword.rst.txt
new file mode 100644
index 000000000..d6d4d6295
--- /dev/null
+++ b/_sources/plugins/open/selfMFASetupPassword.rst.txt
@@ -0,0 +1,20 @@
+=====================
+selfMFASetupPassword
+=====================
+
+Setup an additional credential (UNIX password) to access your account
+=====================================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfMFASetupPassword [--yes]
+
+.. program:: selfMFASetupPassword
+
+
+.. option:: --yes
+
+   Don't ask for confirmation
+
diff --git a/_sources/plugins/open/selfMFASetupTOTP.rst.txt b/_sources/plugins/open/selfMFASetupTOTP.rst.txt
new file mode 100644
index 000000000..9136f7c61
--- /dev/null
+++ b/_sources/plugins/open/selfMFASetupTOTP.rst.txt
@@ -0,0 +1,20 @@
+=================
+selfMFASetupTOTP
+=================
+
+Setup an additional credential (TOTP) to access your account
+============================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfMFASetupTOTP [--no-confirm]
+
+.. program:: selfMFASetupTOTP
+
+
+.. option:: --no-confirm
+
+   Bypass the confirmation step for TOTP enrollment phase
+
diff --git a/_sources/plugins/open/selfPlaySession.rst.txt b/_sources/plugins/open/selfPlaySession.rst.txt
new file mode 100644
index 000000000..42500b3bd
--- /dev/null
+++ b/_sources/plugins/open/selfPlaySession.rst.txt
@@ -0,0 +1,20 @@
+================
+selfPlaySession
+================
+
+Replay the ttyrec of a past session
+===================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfPlaySession --id ID
+
+.. program:: selfPlaySession
+
+
+.. option:: --id ID
+
+   ID of the session to replay, use ``selfListSessions`` to find it.
+
diff --git a/_sources/plugins/open/sftp.rst.txt b/_sources/plugins/open/sftp.rst.txt
new file mode 100644
index 000000000..72b658b2d
--- /dev/null
+++ b/_sources/plugins/open/sftp.rst.txt
@@ -0,0 +1,35 @@
+=====
+sftp
+=====
+
+Transfer files from/to remote servers using sftp through the bastion
+====================================================================
+
+.. note::
+
+   This plugin generates a valid helper script for you to use the bastion over scp, read below to learn how to use it.
+
+To be able to use ``sftp`` over the bastion, you need to have a helper script that is specific
+to your account on the bastion. This plugin's job is to generate it for you.
+You can simply run it, and follow the guidelines.
+
+Once this is done, you'll be able to ``sftp`` through the bastion by adding ``-S SFTP_SCRIPT`` to your
+regular ``sftp`` command, where ``SFTP_SCRIPT`` is the location of the script you've just generated.
+
+For example::
+
+   sftp -S ~/sftp_bastion login@server
+
+.. note::
+
+   If you're getting the 'subsystem request failed on channel 0' error, it usually means that
+   sftp is not enabled on the remote server, as this is not always enabled by default, depending
+   on the distro you're using.
+
+Please note that you need to be granted for uploading or downloading files
+with SFTP to/from the remote host, in addition to having the right to SSH to it.
+For a group, the right should be added with ``--sftp`` of the :doc:`/plugins/group-aclkeeper/groupAddServer` command.
+For a personal access, the right should be added with ``--sftp`` of the :doc:`/plugins/restricted/selfAddPersonalAccess` command.
+:doc:`/plugins/open/selfListEgressKeys`
+
+You'll find more information and examples in :doc:`/using/sftp_scp`.
diff --git a/_sources/plugins/open/unlock.rst.txt b/_sources/plugins/open/unlock.rst.txt
new file mode 100644
index 000000000..e2b4aa378
--- /dev/null
+++ b/_sources/plugins/open/unlock.rst.txt
@@ -0,0 +1,20 @@
+=======
+unlock
+=======
+
+Unlock all your current sessions
+================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh unlock
+
+.. program:: unlock
+
+
+This command will unlock all your current sessions on this bastion instance,
+that were either locked for inactivity timeout or manually locked by you with ``lock``.
+Note that this only applies to the bastion instance you're launching this
+command on, not on the whole bastion cluster (if you happen to have one).
diff --git a/_sources/plugins/restricted/accountAddPersonalAccess.rst.txt b/_sources/plugins/restricted/accountAddPersonalAccess.rst.txt
new file mode 100644
index 000000000..cf47a11b6
--- /dev/null
+++ b/_sources/plugins/restricted/accountAddPersonalAccess.rst.txt
@@ -0,0 +1,103 @@
+=========================
+accountAddPersonalAccess
+=========================
+
+Add a personal server access to an account
+==========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountAddPersonalAccess --account ACCOUNT --host HOST [OPTIONS]
+
+.. program:: accountAddPersonalAccess
+
+
+.. option:: --account
+
+   Bastion account to add the access to
+
+.. option:: --host IP|HOST|IP/MASK
+
+   Server to add access to
+
+.. option:: --user USER
+
+   Remote login to use, if you want to allow any login, use --user-any
+
+.. option:: --user-any
+
+   Allow access with any remote login
+
+.. option:: --port PORT
+
+   Remote SSH port to use, if you want to allow any port, use --port-any
+
+.. option:: --port-any
+
+   Allow access to all remote ports
+
+.. option:: --scpup
+
+   Allow SCP upload, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   Allow SCP download, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   Allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
+.. option:: --force-key FINGERPRINT
+
+   Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)
+
+.. option:: --force-password HASH
+
+   Only use the password with the specified hash to connect to the server (cf accountListPasswords)
+
+.. option:: --ttl SECONDS|DURATION
+
+   Specify a number of seconds (or a duration string, such as "1d7h8m") after which the access will automatically expire
+
+.. option:: --comment "'ANY TEXT'"
+
+   Add a comment alongside this server. Quote it twice as shown if you're under a shell.
+
+
+The access will work only if one of the account's personal egress public key has been copied to the remote server.
+To get the list of an account's personal egress public keys, see ``accountListEgressKeyss`` and ``selfListEgressKeys``.
+
+Plugin configuration
+====================
+
+Options
+-------
+
+.. option:: widest_v4_prefix (optional, integer, between 0 and 32)
+
+    When specified, this limits the size of prefixes that can be added to an
+    ACL, e.g. 24 would not allow prefixes wider than /24 (such as /20 or
+    /16).
+    Note that this doesn't prevent users from adding thousands of ACLs to
+    cover a wide range of networks, but this helps ensuring ACLs such as
+    0.0.0.0/0 can't be added in a single command.
+
+.. option:: self_remote_user_only (optional, boolean)
+
+    When true, this only allows to add ACLs with the remote user being the
+    same than the account name, i.e. adding an access to a bastion account
+    named "johndoe" can only be done specifying this very account name as
+    the remote user name, with ``accountAddPersonalAccess --user johndoe``.
+
+Example
+-------
+
+Configuration, in JSON format, must be in :file:`/etc/bastion/plugin.accountAddPersonalAccess.conf`:
+
+.. code-block:: json
+   :emphasize-lines: 1
+
+   { "widest_v4_prefix": 24, "self_remote_user_only": true }
diff --git a/_sources/plugins/restricted/accountCreate.rst.txt b/_sources/plugins/restricted/accountCreate.rst.txt
new file mode 100644
index 000000000..e86615d38
--- /dev/null
+++ b/_sources/plugins/restricted/accountCreate.rst.txt
@@ -0,0 +1,63 @@
+==============
+accountCreate
+==============
+
+Create a new bastion account
+============================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountCreate --account ACCOUNT <--uid UID|--uid-auto> [OPTIONS]
+
+.. program:: accountCreate
+
+
+.. option:: --account NAME
+
+   Account name to create, NAME must contain only valid UNIX account name characters
+
+.. option:: --uid UID
+
+   Account system UID, also see --uid-auto
+
+.. option:: --uid-auto
+
+   Auto-select an UID from the allowed range (the upper available one will be used)
+
+.. option:: --always-active
+
+   This account's activation won't be challenged on connection, even if the bastion is globally
+
+                              configured to check for account activation
+.. option:: --osh-only
+
+   This account will only be able to use ``--osh`` commands, and can't connect anywhere through the bastion
+
+.. option:: --max-inactive-days DAYS
+
+   Set account expiration policy, overriding the global bastion configuration 'accountMaxInactiveDays',
+
+                              setting this option to zero disables account expiration.
+.. option:: --immutable-key
+
+   Deny any subsequent modification of the account key (selfAddKey and selfDelKey are denied)
+
+.. option:: --comment '"STRING"'
+
+   An optional comment when creating the account. Quote it twice as shown if you're under a shell.
+
+.. option:: --public-key '"KEY"'
+
+   Account public SSH key to deposit on the bastion, if not present,
+
+                              you'll be prompted interactively for it. Quote it twice as shown if your're under a shell.
+.. option:: --no-key
+
+   Don't prompt for an SSH key, no ingress public key will be installed
+
+.. option:: --ttl SECONDS|DURATION
+
+   Time after which the account will be deactivated (amount of seconds, or duration string such as "4d12h15m")
+
diff --git a/_sources/plugins/restricted/accountDelPersonalAccess.rst.txt b/_sources/plugins/restricted/accountDelPersonalAccess.rst.txt
new file mode 100644
index 000000000..a18562330
--- /dev/null
+++ b/_sources/plugins/restricted/accountDelPersonalAccess.rst.txt
@@ -0,0 +1,52 @@
+=========================
+accountDelPersonalAccess
+=========================
+
+Remove a personal server access from an account
+===============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountDelPersonalAccess --account ACCOUNT --host HOST [OPTIONS]
+
+.. program:: accountDelPersonalAccess
+
+
+.. option:: --account
+
+   Bastion account to remove access from
+
+.. option:: --host IP|HOST|IP/MASK
+
+   Server to remove access from
+
+.. option:: --user USER
+
+   Remote user that was allowed, if any user was allowed, use --user-any
+
+.. option:: --user-any
+
+   Use if any remote login was allowed
+
+.. option:: --port PORT
+
+   Remote SSH port that was allowed, if any port was allowed, use --port-any
+
+.. option:: --port-any
+
+   Use if any remote port was allowed
+
+.. option:: --scpup
+
+   Remove SCP upload right, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   Remove SCP download right, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   Remove usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
diff --git a/_sources/plugins/restricted/accountDelete.rst.txt b/_sources/plugins/restricted/accountDelete.rst.txt
new file mode 100644
index 000000000..dbacf0d35
--- /dev/null
+++ b/_sources/plugins/restricted/accountDelete.rst.txt
@@ -0,0 +1,24 @@
+==============
+accountDelete
+==============
+
+Delete an account from the bastion
+==================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountDelete --account ACCOUNT
+
+.. program:: accountDelete
+
+
+.. option:: --account ACCOUNT
+
+   Account name to delete
+
+.. option:: --no-confirm
+
+   Don't ask for confirmation, and blame yourself if you deleted the wrong account
+
diff --git a/_sources/plugins/restricted/accountFreeze.rst.txt b/_sources/plugins/restricted/accountFreeze.rst.txt
new file mode 100644
index 000000000..a4e4a46ae
--- /dev/null
+++ b/_sources/plugins/restricted/accountFreeze.rst.txt
@@ -0,0 +1,25 @@
+==============
+accountFreeze
+==============
+
+Freeze an account, to prevent it from connecting
+================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountFreeze --account ACCOUNT [--reason "'SOME REASON'"]
+
+.. program:: accountFreeze
+
+
+.. option:: --account ACCOUNT
+
+   Account to freeze
+
+.. option:: --reason  "'SOME REASON'"
+
+   Optional reason for the account to be frozen (will be displayed to the user),
+
+                               if you are in a shell (and not in interactive mode), quote it twice as shown.
diff --git a/_sources/plugins/restricted/accountGeneratePassword.rst.txt b/_sources/plugins/restricted/accountGeneratePassword.rst.txt
new file mode 100644
index 000000000..b4a897b3e
--- /dev/null
+++ b/_sources/plugins/restricted/accountGeneratePassword.rst.txt
@@ -0,0 +1,40 @@
+========================
+accountGeneratePassword
+========================
+
+Generate a new egress password for an account
+=============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountGeneratePassword --account ACCOUNT [--size SIZE] --do-it
+
+.. program:: accountGeneratePassword
+
+
+.. option:: --account ACCOUNT
+
+   Specify which account you want to generate a password for
+
+.. option:: --size    SIZE
+
+   Specify the number of characters of the password to generate
+
+.. option:: --do-it
+
+   Required for the password to actually be generated, BEWARE: please read the note below
+
+
+This plugin generates a new egress password to be used for ssh or telnet
+
+NOTE: this is only needed for devices that don't support key-based SSH,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access only support telnet or password-based SSH.
+
+BEWARE: once a new password is generated this way, it'll be set as the new
+egress password to use right away for the account, for any access that requires it.
+A fallback mechanism exists that will auto-try the previous password if this one
+doesn't work, but please ensure that this new password is deployed on the remote
+devices as soon as possible.
diff --git a/_sources/plugins/restricted/accountGrantCommand.rst.txt b/_sources/plugins/restricted/accountGrantCommand.rst.txt
new file mode 100644
index 000000000..83895d3cb
--- /dev/null
+++ b/_sources/plugins/restricted/accountGrantCommand.rst.txt
@@ -0,0 +1,31 @@
+====================
+accountGrantCommand
+====================
+
+Grant access to a restricted command
+====================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountGrantCommand --account ACCOUNT --command COMMAND
+
+.. program:: accountGrantCommand
+
+
+.. option:: --account ACCOUNT
+
+   Bastion account to work on
+
+.. option:: --command COMMAND
+
+   The name of the OSH plugin to grant (omit to get the list)
+
+
+Note that accountGrantCommand being a restricted command as any other, you can grant it to somebody else,
+but then they'll be able to grant themselves or anybody else to this or any other restricted command.
+
+A specific command that can be granted is ``auditor``, it is not an osh plugin per-se, but activates
+more verbose output for several other commands, suitable to audit rights or grants without needing
+to be granted (e.g. to groups).
diff --git a/_sources/plugins/restricted/accountInfo.rst.txt b/_sources/plugins/restricted/accountInfo.rst.txt
new file mode 100644
index 000000000..387853085
--- /dev/null
+++ b/_sources/plugins/restricted/accountInfo.rst.txt
@@ -0,0 +1,112 @@
+============
+accountInfo
+============
+
+Display some information about an account
+=========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountInfo <--account ACCOUNT|--all> [OPTIONS]
+
+.. program:: accountInfo
+
+
+.. option:: --account ACCOUNT
+
+   The account name to work on
+
+.. option:: --all
+
+   Dump info for all accounts (auditors only), use with ``--json``
+
+
+.. option:: --with[out]-everything
+
+   Include or exclude all below options, including future ones
+
+.. option:: --with[out]-groups
+
+   Whether to include the groups the account has a role on (SLOW, default: no)
+
+.. option:: --with[out]-mfa-password-info
+
+   Whether to include MFA password info of the account (SLOW, auditors only, default: no)
+
+.. option:: --with[out]-egress-keys
+
+   Whether to include the account's egress keys (SLOW, auditors only, default: no)
+
+Usage examples
+==============
+
+Show info about a specific account::
+
+    --osh accountInfo --account jdoe12
+
+Gather info about all accounts, with no extra data except their egress keys::
+
+    --osh accountInfo --all --without-everything --with-egress-keys --json
+
+Gather info about all accounts, including all extra data (and possibly future options)::
+
+    --osh accountInfo --all --with-everything --json
+
+Output example
+==============
+
+::
+
+  │ user1 is a bastion admin
+  │ user1 is a bastion superowner
+  │ user1 is a bastion auditor
+  │
+  │ user1 has access to the following restricted commands:
+  │ - accountCreate
+  │ - accountDelete
+  │ - groupCreate
+  │ - groupDelete
+  │
+  │ This account is part of the following groups:
+  │         testgroup1 Owner GateKeeper ACLKeeper Member     -
+  │    gatekeeper-grp2 Owner GateKeeper         -      -     -
+  │
+  │ This account is active
+  │ This account has no TTL set
+  │ This account is not frozen
+  │ This account has seen recent-enough activity to not be activity-expired
+  │ As a consequence, this account can connect to this bastion
+  │
+  │ Last seen on Thu 2023-03-16 07:51:49 UTC (00:00:00 ago)
+  │ Created on Fri 2022-06-17 09:52:50 UTC (271d+21:58:59 ago)
+  │ Created by jdoe
+  │ Created using The Bastion v3.08.01
+  │
+  │ Account egress SSH config:
+  │ - (default)
+  │
+  │ PIV-enforced policy for ingress keys on this account is enabled
+  │
+  │ Account Multi-Factor Authentication status:
+  │ - Additional password authentication is not required for this account
+  │ - Additional password authentication bypass is disabled for this account
+  │ - Additional password authentication is enabled and active
+  │ - Additional TOTP authentication is not required for this account
+  │ - Additional TOTP authentication bypass is disabled for this account
+  │ - Additional TOTP authentication is disabled
+  │ - PAM authentication bypass is disabled
+  │ - Optional public key authentication is disabled
+  │ - MFA policy on personal accesses (using personal keys) on egress side is: password
+  │
+  │ - Account is immune to idle counter-measures: no
+  │ - Maximum number of days of inactivity before account is disabled: (default)
+  │
+  │ Account PAM UNIX password information (used for password MFA):
+  │ - Password is set
+  │ - Password was last changed on 2023-01-27
+  │ - Password must be changed every 90 days at least
+  │ - A warning is displayed 75 days before expiration
+  │ - Account will not be disabled after password expiration
+
diff --git a/_sources/plugins/restricted/accountList.rst.txt b/_sources/plugins/restricted/accountList.rst.txt
new file mode 100644
index 000000000..0ddeb086a
--- /dev/null
+++ b/_sources/plugins/restricted/accountList.rst.txt
@@ -0,0 +1,50 @@
+============
+accountList
+============
+
+List the bastion accounts
+=========================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountList [OPTIONS]
+
+.. program:: accountList
+
+
+.. option:: --account ACCOUNT
+
+   Only list the specified account. This is an easy way to check whether the account exists
+
+.. option:: --inactive-only
+
+   Only list inactive accounts
+
+.. option:: --audit
+
+   Show more verbose information (SLOW!), you need to be a bastion auditor
+
+.. option:: --no-password-info
+
+   Don't gather password info in audit mode (makes --audit way faster)
+
+.. option:: --no-output
+
+   Don't print human-readable output (faster, use with --json)
+
+.. option:: --include PATTERN
+
+   Only show accounts whose name match the given PATTERN (see below)
+
+                         This option can be used multiple times to refine results
+.. option:: --exclude PATTERN
+
+   Omit accounts whose name match the given PATTERN (see below)
+
+                         This option can be used multiple times.
+                         Note that --exclude takes precedence over --include
+
+**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
diff --git a/_sources/plugins/restricted/accountListAccesses.rst.txt b/_sources/plugins/restricted/accountListAccesses.rst.txt
new file mode 100644
index 000000000..68cf4ca5d
--- /dev/null
+++ b/_sources/plugins/restricted/accountListAccesses.rst.txt
@@ -0,0 +1,44 @@
+====================
+accountListAccesses
+====================
+
+View the expanded access list of a given bastion account
+========================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountListAccesses --account ACCOUNT [--hide-groups] [--reverse-dns]
+
+.. program:: accountListAccesses
+
+
+.. option:: --account ACCOUNT
+
+   The account to work on
+
+.. option:: --hide-groups
+
+   Don't show the machines the accouns has access to through group rights.
+
+                       In other words, list only the account's personal accesses.
+.. option:: --reverse-dns
+
+   Attempt to resolve the reverse hostnames (SLOW!)
+
+.. option:: --include PATTERN
+
+   Only include accesses matching the given PATTERN (see below)
+
+                        This option can be used multiple times to refine results
+.. option:: --exclude PATTERN
+
+   Omit accesses matching the given PATTERN (see below)
+
+                        This option can be used multiple times.
+                        Note that --exclude takes precedence over --include
+
+**Note:** PATTERN supports the ``*`` and ``?`` wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.
diff --git a/_sources/plugins/restricted/accountListEgressKeys.rst.txt b/_sources/plugins/restricted/accountListEgressKeys.rst.txt
new file mode 100644
index 000000000..1827683ae
--- /dev/null
+++ b/_sources/plugins/restricted/accountListEgressKeys.rst.txt
@@ -0,0 +1,25 @@
+======================
+accountListEgressKeys
+======================
+
+List the public egress keys of an account
+=========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountListEgressKeys --account ACCOUNT
+
+.. program:: accountListEgressKeys
+
+
+.. option:: --account ACCOUNT
+
+   Account to display the public egress keys of
+
+
+The keys listed are the public egress SSH keys tied to this account.
+They can be used to gain access to another machine from this bastion,
+by putting one of those keys in the remote machine's ``authorized_keys`` file,
+and adding this account access to this machine with ``accountAddPersonalAccess``.
diff --git a/_sources/plugins/restricted/accountListIngressKeys.rst.txt b/_sources/plugins/restricted/accountListIngressKeys.rst.txt
new file mode 100644
index 000000000..4b6902d2d
--- /dev/null
+++ b/_sources/plugins/restricted/accountListIngressKeys.rst.txt
@@ -0,0 +1,24 @@
+=======================
+accountListIngressKeys
+=======================
+
+List the public ingress keys of an account
+==========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountListIngressKeys --account ACCOUNT
+
+.. program:: accountListIngressKeys
+
+
+.. option:: --account ACCOUNT
+
+   Account to list the keys of
+
+
+The keys listed are the public ingress SSH keys tied to this account.
+Their private counterpart should be detained only by this account's user,
+so that they can to authenticate themselves to this bastion.
diff --git a/_sources/plugins/restricted/accountListPasswords.rst.txt b/_sources/plugins/restricted/accountListPasswords.rst.txt
new file mode 100644
index 000000000..476b20e4b
--- /dev/null
+++ b/_sources/plugins/restricted/accountListPasswords.rst.txt
@@ -0,0 +1,22 @@
+=====================
+accountListPasswords
+=====================
+
+List the hashes and metadata of the egress passwords associated to an account
+=============================================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountListPasswords --account ACCOUNT
+
+.. program:: accountListPasswords
+
+
+.. option:: --account ACCOUNT
+
+   The account name to work on
+
+
+The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH
diff --git a/_sources/plugins/restricted/accountMFAResetPassword.rst.txt b/_sources/plugins/restricted/accountMFAResetPassword.rst.txt
new file mode 100644
index 000000000..81cd43f9a
--- /dev/null
+++ b/_sources/plugins/restricted/accountMFAResetPassword.rst.txt
@@ -0,0 +1,22 @@
+========================
+accountMFAResetPassword
+========================
+
+Remove the UNIX password of an account
+======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountMFAResetPassword --account ACCOUNT
+
+.. program:: accountMFAResetPassword
+
+
+.. option:: --account ACCOUNT
+
+   Specify which account you want to remove the UNIX password of
+
+
+Note that if doesn't remove the account UNIX password requirement, if set (see ``accountModify`` for this)
diff --git a/_sources/plugins/restricted/accountMFAResetTOTP.rst.txt b/_sources/plugins/restricted/accountMFAResetTOTP.rst.txt
new file mode 100644
index 000000000..cc56d22a6
--- /dev/null
+++ b/_sources/plugins/restricted/accountMFAResetTOTP.rst.txt
@@ -0,0 +1,22 @@
+====================
+accountMFAResetTOTP
+====================
+
+Remove the TOTP configuration of an account
+===========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountMFAResetTOTP --account ACCOUNT
+
+.. program:: accountMFAResetTOTP
+
+
+.. option:: --account ACCOUNT
+
+   Specify which account you want to remove the TOTP configuration of
+
+
+Note that if doesn't remove the TOTP requirement, if set (see ``accountModify`` for this).
diff --git a/_sources/plugins/restricted/accountModify.rst.txt b/_sources/plugins/restricted/accountModify.rst.txt
new file mode 100644
index 000000000..47f5452ee
--- /dev/null
+++ b/_sources/plugins/restricted/accountModify.rst.txt
@@ -0,0 +1,80 @@
+==============
+accountModify
+==============
+
+Modify an account configuration
+===============================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountModify --account ACCOUNT [--option value [--option value [...]]]
+
+.. program:: accountModify
+
+
+.. option:: --account ACCOUNT
+
+   Bastion account to work on
+
+.. option:: --pam-auth-bypass yes|no
+
+   Enable or disable PAM auth bypass for this account in addition to pubkey auth (default is 'no'),
+
+                                               in that case sshd will not rely at all on PAM auth and /etc/pam.d/sshd configuration. This
+                                               does not change the behaviour of the code, just the PAM auth handled by SSH itself
+.. option:: --mfa-password-required yes|no|bypass
+
+   Enable or disable UNIX password requirement for this account in addition to pubkey auth (default is 'no'),
+
+                                               this overrides the global bastion configuration 'accountMFAPolicy'. If 'bypass' is specified,
+                                               no password will ever be asked, even for groups or plugins explicitly requiring it
+.. option:: --mfa-totp-required yes|no|bypass
+
+   Enable or disable TOTP requirement for this account in addition to pubkey auth (default is 'no'),
+
+                                               this overrides the global bastion configuration 'accountMFAPolicy'. If 'bypass' is specified,
+                                               no OTP will ever be asked, even for groups or plugins explicitly requiring it
+.. option:: --egress-strict-host-key-checking POLICY
+
+   Modify the egress SSH behavior of this account regarding ``StrictHostKeyChecking`` (see `man ssh_config`),
+
+                                               POLICY can be 'yes', 'accept-new', 'no', 'ask', 'default' or 'bypass'.
+                                               'bypass' means setting ``StrictHostKeyChecking=no`` and ``UserKnownHostsFile=/dev/null``,
+                                               which will permit egress connections in all cases, even when host keys change all the time on the same target.
+                                               This effectively suppress the host key checking entirely. Please don't enable this blindly.
+                                               'default' will remove this account's ``StrictHostKeyChecking`` setting override.
+                                               All the other policies carry the same meaning that what is documented in `man ssh_config`.
+.. option:: --personal-egress-mfa-required POLICY
+
+   Enforce UNIX password requirement, or TOTP requirement, or any MFA requirement, when connecting to a server
+
+                                               using the personal keys of the account, POLICY can be 'password', 'totp', 'any' or 'none'
+.. option:: --always-active yes|no
+
+   Set or unset the account as always active (i.e. disable the check of the 'active' status on this account)
+
+.. option:: --idle-ignore yes|no
+
+   If enabled, this account is immune to the idleLockTimeout and idleKillTimeout bastion-wide policy
+
+.. option:: --max-inactive-days DAYS
+
+   Set account expiration policy, overriding the global bastion configuration 'accountMaxInactiveDays'.
+
+                                               Setting this option to zero disables account expiration. Setting this option to -1 removes this account
+                                               expiration policy, i.e. the global bastion setting will apply.
+.. option:: --osh-only yes|no
+
+   If enabled, this account can only use ``--osh`` commands, and can't connect anywhere through the bastion
+
+.. option:: --pubkey-auth-optional yes|no
+
+   Make the public key optional on ingress for the account (default is 'no').
+
+                                               When enabled the public key part of the authentication becomes optional when a password and/or TOTP is defined,
+                                               allowing to login with just the password/TOTP. If no password/TOTP is defined then the public key is the only way to authenticate,
+                                               because some form of authentication is always required.
+                                               When disabled, the public key is always required.
+                                               Egress is not affected.
diff --git a/_sources/plugins/restricted/accountPIV.rst.txt b/_sources/plugins/restricted/accountPIV.rst.txt
new file mode 100644
index 000000000..5ac30c884
--- /dev/null
+++ b/_sources/plugins/restricted/accountPIV.rst.txt
@@ -0,0 +1,51 @@
+===========
+accountPIV
+===========
+
+Modify the PIV policy for the ingress keys of an account
+========================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountPIV --account ACCOUNT --policy <default|enforce|never|grace --ttl SECONDS|DURATION>
+
+.. program:: accountPIV
+
+
+.. option:: --account ACCOUNT
+
+   Bastion account to work on
+
+.. option:: --policy  POLICY
+
+   Changes the PIV policy of account. See below for a description of available policies.
+
+.. option:: --ttl SECONDS|DURATION
+
+   For the ``grace`` policy, amount of time after which the account will automatically revert
+
+                            to its previous policy (amount of seconds, or duration string such as "4d12h15m").
+
+Possible POLICY values:
+-----------------------
+
+default
+   No specific policy is defined for this account, the default bastion policy applies (see the :ref:`ingressRequirePIV` global option).
+
+enforce
+   Only verified PIV keys can be added as ingress SSH keys for this account. Note that setting the policy to ``enforce`` also immediately
+   disables any non-PIV keys from the account's ingress keys. If no valid PIV key is found, this in effect disables all the keys of said
+   account, preventing connection. The disabled keys are still kept so that setting back the policy to ``default`` or ``never`` does restore
+   the non-PIV keys.
+
+never
+   Regardless of the global configuration of the bastion (see the :ref:`ingressRequirePIV` global option), this account will never be required
+   to use only PIV keys. This can be needed for a non-human account if PIV is enabled bastion-wide.
+
+grace
+   enables temporary deactivation of PIV enforcement on this account. This is only meaningful when the policy is already set to ``enforce``
+   for this account, or if the global :ref:`ingressRequirePIV` option is set to true. This policy requires the use of the ``--ttl`` option to
+   specify how much time the policy will be relaxed for this account before going back to its previous policy automatically. This can be
+   useful when people forget their PIV-enabled hardware token and you don't want to send them back home.
diff --git a/_sources/plugins/restricted/accountRevokeCommand.rst.txt b/_sources/plugins/restricted/accountRevokeCommand.rst.txt
new file mode 100644
index 000000000..0b7fe1287
--- /dev/null
+++ b/_sources/plugins/restricted/accountRevokeCommand.rst.txt
@@ -0,0 +1,24 @@
+=====================
+accountRevokeCommand
+=====================
+
+Revoke access to a restricted command
+=====================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountRevokeCommand --account ACCOUNT --command COMMAND
+
+.. program:: accountRevokeCommand
+
+
+.. option:: --account ACCOUNT
+
+   Bastion account to work on
+
+.. option:: --command COMMAND
+
+   The name of the OSH plugin to revoke access to (omit to get the list)
+
diff --git a/_sources/plugins/restricted/accountUnexpire.rst.txt b/_sources/plugins/restricted/accountUnexpire.rst.txt
new file mode 100644
index 000000000..4b0ea70f6
--- /dev/null
+++ b/_sources/plugins/restricted/accountUnexpire.rst.txt
@@ -0,0 +1,23 @@
+================
+accountUnexpire
+================
+
+Unexpire an inactivity-expired account
+======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountUnexpire --account ACCOUNT
+
+.. program:: accountUnexpire
+
+
+.. option:: --account ACCOUNT
+
+   Account to work on
+
+
+When the bastion is configured to expire accounts that haven't been seen in a while,
+this command can be used to activate them back.
diff --git a/_sources/plugins/restricted/accountUnfreeze.rst.txt b/_sources/plugins/restricted/accountUnfreeze.rst.txt
new file mode 100644
index 000000000..82f6a99ab
--- /dev/null
+++ b/_sources/plugins/restricted/accountUnfreeze.rst.txt
@@ -0,0 +1,20 @@
+================
+accountUnfreeze
+================
+
+Unfreeze a frozen account
+=========================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountUnfreeze --account ACCOUNT
+
+.. program:: accountUnfreeze
+
+
+.. option:: --account ACCOUNT
+
+   Account to unfreeze
+
diff --git a/_sources/plugins/restricted/accountUnlock.rst.txt b/_sources/plugins/restricted/accountUnlock.rst.txt
new file mode 100644
index 000000000..0f25efe10
--- /dev/null
+++ b/_sources/plugins/restricted/accountUnlock.rst.txt
@@ -0,0 +1,20 @@
+==============
+accountUnlock
+==============
+
+Unlock an account locked by pam_tally, pam_tally2 or pam_faillock
+=================================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh accountUnlock --account ACCOUNT
+
+.. program:: accountUnlock
+
+
+.. option:: --account ACCOUNT
+
+   Account to work on
+
diff --git a/_sources/plugins/restricted/groupCreate.rst.txt b/_sources/plugins/restricted/groupCreate.rst.txt
new file mode 100644
index 000000000..f7625d060
--- /dev/null
+++ b/_sources/plugins/restricted/groupCreate.rst.txt
@@ -0,0 +1,60 @@
+============
+groupCreate
+============
+
+Create a group
+==============
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupCreate --group GROUP --owner ACCOUNT <--algo ALGO --size SIZE [--encrypted]|--no-key>
+
+.. program:: groupCreate
+
+
+.. option:: --group
+
+   Group name to create
+
+
+.. option:: --owner
+
+   Preexisting bastion account to assign as owner (can be you)
+
+
+.. option:: --encrypted
+
+   Add a passphrase to the key. Beware that you'll have to enter it for each use.
+
+                  Do NOT add the passphrase after this option, you'll be prompted interactively for it.
+
+.. option:: --algo
+
+   Specifies the algo of the key, either rsa, ecdsa or ed25519.
+
+.. option:: --size
+
+   Specifies the size of the key to be generated.
+
+                  For RSA, choose between 2048 and 8192 (4096 is good).
+                  For ECDSA, choose either 256, 384 or 521.
+                  For ED25519, size is always 256.
+
+.. option:: --no-key
+
+   Don't generate an egress SSH key at all for this group
+
+
+
+A quick overview of the different algorithms:
+
+.. code-block:: none
+
+   Ed25519      : robustness[###] speed[###]
+   ECDSA        : robustness[##.] speed[###]
+   RSA          : robustness[#..] speed[#..]
+
+This table is meant as a quick cheat-sheet, you're warmly advised to do
+your own research, as other constraints may apply to your environment.
diff --git a/_sources/plugins/restricted/groupDelete.rst.txt b/_sources/plugins/restricted/groupDelete.rst.txt
new file mode 100644
index 000000000..61a0ead74
--- /dev/null
+++ b/_sources/plugins/restricted/groupDelete.rst.txt
@@ -0,0 +1,27 @@
+============
+groupDelete
+============
+
+Delete a group
+==============
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh groupDelete --group GROUP
+
+.. program:: groupDelete
+
+
+.. option:: --group GROUP
+
+   Group name to delete
+
+.. option:: --no-confirm
+
+   Skip group name confirmation, but blame yourself if you deleted the wrong group!
+
+
+This restricted command is able to delete any group. Group owners can however delete
+their own groups using the sibling `groupDestroy` command.
diff --git a/_sources/plugins/restricted/index.rst.txt b/_sources/plugins/restricted/index.rst.txt
new file mode 100644
index 000000000..05c091769
--- /dev/null
+++ b/_sources/plugins/restricted/index.rst.txt
@@ -0,0 +1,37 @@
+===================
+restricted plugins
+===================
+
+.. toctree::
+
+   accountAddPersonalAccess
+   accountCreate
+   accountDelPersonalAccess
+   accountDelete
+   accountFreeze
+   accountGeneratePassword
+   accountGrantCommand
+   accountInfo
+   accountList
+   accountListAccesses
+   accountListEgressKeys
+   accountListIngressKeys
+   accountListPasswords
+   accountMFAResetPassword
+   accountMFAResetTOTP
+   accountModify
+   accountPIV
+   accountRevokeCommand
+   accountUnexpire
+   accountUnfreeze
+   accountUnlock
+   groupCreate
+   groupDelete
+   realmCreate
+   realmDelete
+   realmInfo
+   realmList
+   rootListIngressKeys
+   selfAddPersonalAccess
+   selfDelPersonalAccess
+   whoHasAccessTo
diff --git a/_sources/plugins/restricted/realmCreate.rst.txt b/_sources/plugins/restricted/realmCreate.rst.txt
new file mode 100644
index 000000000..5294e2524
--- /dev/null
+++ b/_sources/plugins/restricted/realmCreate.rst.txt
@@ -0,0 +1,34 @@
+============
+realmCreate
+============
+
+Declare and create a new trusted realm
+======================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh realmCreate --realm REALM --from IP1,IP2 [OPTIONS]
+
+.. program:: realmCreate
+
+
+.. option:: --realm   REALM
+
+   Realm name to create
+
+.. option:: --comment STRING
+
+   An optional comment when creating the realm. Double-quote if you're under a shell.
+
+.. option:: --from
+
+   IP1,IP2   Comma-separated list of outgoing IPs used by the realm we're declaring (i.e. IPs used by the bastion(s) on the other side)
+
+                      the expected format is the one used by the from="" directive on SSH keys (IP and prefixes are supported)
+.. option:: --public-key KEY
+
+   Public SSH key to deposit on the bastion to access this realm. If not present,
+
+                      you'll be prompted interactively for it. Use double-quoting if your're under a shell.
diff --git a/_sources/plugins/restricted/realmDelete.rst.txt b/_sources/plugins/restricted/realmDelete.rst.txt
new file mode 100644
index 000000000..4bab9646f
--- /dev/null
+++ b/_sources/plugins/restricted/realmDelete.rst.txt
@@ -0,0 +1,20 @@
+============
+realmDelete
+============
+
+Delete a bastion realm
+======================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh realmDelete --realm REALM
+
+.. program:: realmDelete
+
+
+.. option:: --realm REALM
+
+   Name of the realm to delete
+
diff --git a/_sources/plugins/restricted/realmInfo.rst.txt b/_sources/plugins/restricted/realmInfo.rst.txt
new file mode 100644
index 000000000..ff1bcedd3
--- /dev/null
+++ b/_sources/plugins/restricted/realmInfo.rst.txt
@@ -0,0 +1,20 @@
+==========
+realmInfo
+==========
+
+Display information about a bastion realm
+=========================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh realmInfo --realm REALM
+
+.. program:: realmInfo
+
+
+.. option:: --realm REALM
+
+   Name of the realm to show info about
+
diff --git a/_sources/plugins/restricted/realmList.rst.txt b/_sources/plugins/restricted/realmList.rst.txt
new file mode 100644
index 000000000..ccad425fc
--- /dev/null
+++ b/_sources/plugins/restricted/realmList.rst.txt
@@ -0,0 +1,20 @@
+==========
+realmList
+==========
+
+List the bastions realms
+========================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh realmList [--realm REALM]
+
+.. program:: realmList
+
+
+.. option:: --realm REALM
+
+   Only list the specified realm (mainly: check if it exists)
+
diff --git a/_sources/plugins/restricted/rootListIngressKeys.rst.txt b/_sources/plugins/restricted/rootListIngressKeys.rst.txt
new file mode 100644
index 000000000..b85df9353
--- /dev/null
+++ b/_sources/plugins/restricted/rootListIngressKeys.rst.txt
@@ -0,0 +1,19 @@
+====================
+rootListIngressKeys
+====================
+
+List the public keys to connect as root on this bastion
+=======================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh rootListIngressKeys
+
+.. program:: rootListIngressKeys
+
+
+This command is mainly useful for auditability purposes.
+As it gives some information as to who can be root on the underlying system,
+please grant this command only to accounts that need to have this information.
diff --git a/_sources/plugins/restricted/selfAddPersonalAccess.rst.txt b/_sources/plugins/restricted/selfAddPersonalAccess.rst.txt
new file mode 100644
index 000000000..ac674c736
--- /dev/null
+++ b/_sources/plugins/restricted/selfAddPersonalAccess.rst.txt
@@ -0,0 +1,99 @@
+======================
+selfAddPersonalAccess
+======================
+
+Add a personal server access on your account
+============================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfAddPersonalAccess --host HOST [OPTIONS]
+
+.. program:: selfAddPersonalAccess
+
+
+.. option:: --host IP|HOST|IP/MASK
+
+   Server to add access to
+
+.. option:: --user USER
+
+   Remote login to use, if you want to allow any login, use --user-any
+
+.. option:: --user-any
+
+   Allow access with any remote login
+
+.. option:: --port PORT
+
+   Remote SSH port to use, if you want to allow any port, use --port-any
+
+.. option:: --port-any
+
+   Allow access to all remote ports
+
+.. option:: --scpup
+
+   Allow SCP upload, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   Allow SCP download, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   Allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
+.. option:: --force
+
+   Add the access without checking that the public SSH key is properly installed remotely
+
+.. option:: --force-key FINGERPRINT
+
+   Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)
+
+.. option:: --force-password HASH
+
+   Only use the password with the specified hash to connect to the server (cf selfListPasswords)
+
+.. option:: --ttl SECONDS|DURATION
+
+   Specify a number of seconds (or a duration string, such as "1d7h8m") after which the access will automatically expire
+
+.. option:: --comment "'ANY TEXT'"
+
+   Add a comment alongside this server. Quote it twice as shown if you're under a shell.
+
+
+Plugin configuration
+====================
+
+Options
+-------
+
+.. option:: widest_v4_prefix (optional, integer, between 0 and 32)
+
+    When specified, this limits the size of prefixes that can be added to an
+    ACL, e.g. 24 would not allow prefixes wider than /24 (such as /20 or
+    /16).
+    Note that this doesn't prevent users from adding thousands of ACLs to
+    cover a wide range of networks, but this helps ensuring ACLs such as
+    0.0.0.0/0 can't be added in a single command.
+
+.. option:: self_remote_user_only (optional, boolean)
+
+    When true, this only allows to add ACLs with the remote user being the
+    same than the account name, i.e. a bastion account named "johndoe" would
+    only be able to use ``selfAddPersonalAccess --user johndoe``.
+
+Example
+-------
+
+Configuration, in JSON format, must be in :file:`/etc/bastion/plugin.selfAddPersonalAccess.conf`:
+
+.. code-block:: json
+   :emphasize-lines: 1
+
+   { "widest_v4_prefix": 24, "self_remote_user_only": true }
diff --git a/_sources/plugins/restricted/selfDelPersonalAccess.rst.txt b/_sources/plugins/restricted/selfDelPersonalAccess.rst.txt
new file mode 100644
index 000000000..a059a2fea
--- /dev/null
+++ b/_sources/plugins/restricted/selfDelPersonalAccess.rst.txt
@@ -0,0 +1,48 @@
+======================
+selfDelPersonalAccess
+======================
+
+Remove a personal server access from your account
+=================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh selfDelPersonalAccess --host HOST [OPTIONS]
+
+.. program:: selfDelPersonalAccess
+
+
+.. option:: --host IP|HOST|IP/MASK
+
+   Server to remove access from
+
+.. option:: --user USER
+
+   Remote user that was allowed, if any user was allowed, use --user-any
+
+.. option:: --user-any
+
+   Use if any remote login was allowed
+
+.. option:: --port PORT
+
+   Remote SSH port that was allowed, if any port was allowed, use --port-any
+
+.. option:: --port-any
+
+   Use if any remote port was allowed
+
+.. option:: --scpup
+
+   Remove SCP upload right, you--bastion-->server (omit --user in this case)
+
+.. option:: --scpdown
+
+   Remove SCP download right, you<--bastion--server (omit --user in this case)
+
+.. option:: --sftp
+
+   Remove usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)
+
diff --git a/_sources/plugins/restricted/whoHasAccessTo.rst.txt b/_sources/plugins/restricted/whoHasAccessTo.rst.txt
new file mode 100644
index 000000000..24ba23a10
--- /dev/null
+++ b/_sources/plugins/restricted/whoHasAccessTo.rst.txt
@@ -0,0 +1,47 @@
+===============
+whoHasAccessTo
+===============
+
+List the accounts that have access to a given server
+====================================================
+
+
+.. admonition:: usage
+   :class: cmdusage
+
+   --osh whoHasAccessTo --host SERVER [OPTIONS]
+
+.. program:: whoHasAccessTo
+
+
+.. option:: --host SERVER
+
+   List declared accesses to this server
+
+.. option:: --user USER
+
+   Remote user allowed (if not specified, ignore user specifications)
+
+.. option:: --port PORT
+
+   Remote port allowed (if not specified, ignore port specifications)
+
+.. option:: --ignore-personal
+
+   Don't check accounts' personal accesses (i.e. only check groups)
+
+.. option:: --ignore-group GROUP
+
+   Ignore accesses by this group, if you know GROUP public key is in fact
+
+                          not present on remote server but bastion thinks it is
+.. option:: --show-wildcards
+
+   Also list accesses that match because 0.0.0.0/0 is listed in a group or private access,
+
+                          this is disabled by default because this is almost always just noise (see Note below)
+
+Note: This list is what the bastion THINKS is true, which means that if some group has 0.0.0.0/0 in its list,
+then it'll show all the members of that group as having access to the machine you're specifying, through this group key.
+This is only true if the remote server does have the group key installed, of course, which the bastion
+can't tell without trying to connect "right now" (which it won't do).
diff --git a/_sources/presentation/features.rst.txt b/_sources/presentation/features.rst.txt
new file mode 100644
index 000000000..436c0d095
--- /dev/null
+++ b/_sources/presentation/features.rst.txt
@@ -0,0 +1,31 @@
+========
+Features
+========
+
+.. note::
+   This aims to be a quick overview of the main supported features of The Bastion, focusing on use cases.
+   For a better introduction about the basic features, please refer to the front page of the documentation.
+
+.. warning::
+   Documentation might not be present yet for all the features below.
+
+- Personal and group access schemes with group roles delegation to ensure teams autonomy without security trade-offs
+- SSH protocol break between the ingress and egress connections (see other :doc:`security measures<security>`)
+- Self-reliance achieved through virtually no external dependencies (see other :doc:`security measures<security>`)
+- Interactive session recording (in standard ``ttyrec`` files)
+- Non-interactive session recording (`stdout` and `stderr` through ``ttyrec``)
+- Extensive logging support through `syslog` for easy SIEM consumption
+- Supports `MOSH <https://github.com/mobile-shell/mosh>`_ on the ingress connection side
+- Supports ``scp`` passthrough, to upload and/or download files from/to remote servers
+- Supports ``netconf`` SSH subsystem passthrough
+- Supports Yubico PIV keys
+  `attestation checking <https://developers.yubico.com/PIV/Introduction/Yubico_extensions.html>`_ and enforcement
+  on the ingress connection side
+- Supports realms, to create a trust between two bastions of possibly two different companies,
+  splitting the authentication and authorization phases while still enforcing local policies
+- Supports SSH password autologin on the egress side for legacy devices not supporting pubkey authentication,
+  while still forcing proper pubkey authentication on the ingress side
+- Supports telnet password autologin on the egress side for ancient devices not supporting SSH,
+  while still forcing proper SSH pubkey authentication on the ingress side
+- Supports HTTPS proxying with man-in-the-middle authentication and authorization handling,
+  for ingress and egress password decoupling (mainly useful for network device APIs)
diff --git a/_sources/presentation/principles.rst.txt b/_sources/presentation/principles.rst.txt
new file mode 100644
index 000000000..c2a6e5aff
--- /dev/null
+++ b/_sources/presentation/principles.rst.txt
@@ -0,0 +1,12 @@
+==========
+Principles
+==========
+
+.. note::
+   Most of the principles of The Bastion are well explained in the **Part 2** of the blog post
+   that announced the release. The links are below.
+
+- `Part 1 - Genesis <https://blog.ovhcloud.com/the-ovhcloud-bastion-part-1/>`_
+- `Part 2 - Delegation Dizziness <https://blog.ovhcloud.com/the-ovhcloud-ssh-bastion-part-2-delegation-dizziness/>`_
+- `Part 3 - Security at the Core <https://blog.ovhcloud.com/the-bastion-part-3-security-at-the-core/>`_
+- `Part 4 - A new era <https://blog.ovhcloud.com/the-bastion-part-4-a-new-era/>`_
diff --git a/_sources/presentation/security.rst.txt b/_sources/presentation/security.rst.txt
new file mode 100644
index 000000000..6407d8905
--- /dev/null
+++ b/_sources/presentation/security.rst.txt
@@ -0,0 +1,61 @@
+========
+Security
+========
+
+Security principles at the core
+===============================
+
+Even with the most conservative, precautionous and paranoid coding process, code has bugs,
+so it shouldn't be trusted blindly. Hence the bastion doesn't trust its own code.
+It leverages the operating system security primitives to get additional security, as seen below.
+
+- Uses the well-known and trusted UNIX Discretionary Access Control:
+
+    - Bastion users are mapped to actual system users
+    - Bastion groups are mapped to actual system groups
+    - All the code is constantly checking rights before allowing any action
+    - UNIX DAC is used as a safety belt to prevent an action from succeeding even if the code
+      is tricked into allowing it
+
+- The bastion main script is declared as the bastion user's system shell:
+
+    - No user has real (``bash``-like) shell access on the system
+    - All code is ran under the unprivileged user's system account rights
+    - Even if a user could escape to a real shell, they wouldn't be able to connect to machines they don't have
+      access to, because they don't have filesystem-level read access to the SSH keys
+
+- The code is modular
+
+    - The main code mainly checks rights, logs actions, and enable ``ssh`` access to other machines
+    - All side commands, called **plugins**, are in modules separated from the main code
+    - The modules can either be **open** or **restricted**
+
+        - Only accounts that have been specifically granted on a need-to-use basis can run a specific restricted plugin
+        - This is checked by the code, and also enforced by UNIX DAC (the plugin is only readable and
+          executable by the system group specific to the plugin)
+
+- All the code needing extended system privileges is separated from the main code, in modules called **helpers**
+
+    - Helpers are run exclusively under ``sudo``
+    - The ``sudoers`` configuration is attached to a system group specific to the command,
+      which is granted to accounts on a need-to-use basis
+    - The helpers are only readable and executable by the system group specific to the command
+    - The helpers path and some of their immutable parameters are hardcoded in the ``sudoers`` configuration
+    - Perl tainted mode (``-T``) is used for all code running under ``sudo``, preventing any user-input to
+      interfere with the logic, by halting execution immediately
+    - Code running under ``sudo`` doesn't trust its caller and re-checks every input
+    - Communication between unprivileged and privileged-code are done using JSON
+
+Auditability
+============
+
+- Bastion administrators must use the bastion's logic to connect to itself to administer it (or better,
+  use another bastion to do so), this ensures auditability in all cases
+
+- Every access and action (whether allowed or denied) is logged with:
+
+    - ``syslog``, which should also be sent to a remote syslog server to ensure even
+      bastion administrators can't tamper their tracks, and/or
+    - local ``sqlite3`` databases for easy searching
+
+- This code is used in production in several PCI-DSS, ISO 27001, SOC1 and SOC2 certified environments
diff --git a/_sources/using/api.rst.txt b/_sources/using/api.rst.txt
new file mode 100644
index 000000000..756101ae2
--- /dev/null
+++ b/_sources/using/api.rst.txt
@@ -0,0 +1,266 @@
+========
+JSON API
+========
+
+.. contents::
+
+Introduction
+============
+
+The Bastion has a JSON API that can be used to interact with :ref:`plugins`.
+
+Instead of exposing a specific HTTPS port for this API, The Bastion leverages its already exposed protocol, SSH,
+to expose its API through it. The rationale is:
+
+- Avoid exposing a new port and a new protocol (HTTPS) to avoid widening the attack surface
+- Leverage the pre-existing authentication and user isolation mechanisms implemented by The Bastion behind SSH
+
+This API is implemented for all :ref:`plugins <plugins>`, and can be enabled by the ``--json*`` series of options.
+
+.. note::
+
+   Within this page, the ``bssh`` bastion alias we usually use through the documentation is replaced by
+   explicit ``ssh`` commands, to emphasize the fact that as we're doing M2M calls,
+   there would be no terminal involved, hence we shouldn't use the ``-t`` SSH option to connect to the bastion
+   (as is the case with the ``bssh`` alias).
+
+Adding either ``--json``, ``--json-pretty`` or ``--json-greppable`` to your ``--osh`` commands enable
+the JSON API output. Here is an example of each one below.
+
+Examples
+========
+
+Using --json-pretty
+-------------------
+
+Let's start with ``--json-pretty``:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json-pretty
+   ╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+   │ ▶ list of servers pertaining to the group
+   ├───────────────────────────────────────────────────────────────────────────────
+   │        IP PORT  USER      ACCESS-BY ADDED-BY   ADDED-AT
+   │ --------- ---- ----- -------------- -------- ----------
+   │ 127.1.2.3   22 (any) mygroup(group)  johndoe 2023-07-31
+   │
+   │ 1 accesses listed
+
+   JSON_START
+   {
+      "command" : "groupListServers",
+      "value" : [
+         {
+            "port" : "22",
+            "expiry" : null,
+            "forcePassword" : null,
+            "forceKey" : null,
+            "addedBy" : "johndoe",
+            "userComment" : null,
+            "comment" : null,
+            "user" : null,
+            "ip" : "127.1.2.3",
+            "addedDate" : "2023-07-31 08:56:05",
+            "reverseDns" : null
+         }
+      ],
+      "error_code" : "OK",
+      "error_message" : "OK"
+   }
+
+   JSON_END
+   ╰─────────────────────────────────────────────────────────</groupListServers>───
+
+As you see, adding ``--json-pretty`` to the command enables output of additional text that can be parsed as JSON.
+This option is the most human-readable one, and encloses the JSON output between two anchors, namely
+``JSON_START`` and ``JSON_END``. All the text output out of these anchors can be ignored for the JSON API parsing.
+
+Here is an example of parsing using simple shell commands:
+
+.. code-block:: shell
+   :emphasize-lines: 1,2
+
+   ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json-pretty --quiet | \
+     awk '/^JSON_END\r?$/ {if(P==1){exit}} { if(P==1){print} } /^JSON_START\r?$/ {P=1}' | jq .
+   {
+     "error_code": "OK",
+     "error_message": "OK",
+     "value": [
+       {
+         "userComment": null,
+         "reverseDns": null,
+         "expiry": null,
+         "user": null,
+         "forceKey": null,
+         "addedDate": "2023-07-31 08:56:05",
+         "port": "22",
+         "addedBy": "johndoe",
+         "ip": "127.1.2.3",
+         "forcePassword": null,
+         "comment": null
+       }
+     ],
+     "command": "groupListServers"
+   }
+
+Note that we use ``--quiet``, which removes some text that is only useful to humans, and it also disables colors
+in the output. In any case, the JSON API output between the anchors never has colors enabled.
+
+Using --json
+------------
+
+This option uses the same anchors than ``--json-pretty``, but doesn't prettify the JSON, so the output
+is more compact:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json
+   ---ac777d06bec9-------------------------------------------the-bastion-3.12.00---
+   => list of servers pertaining to the group
+   --------------------------------------------------------------------------------
+   ~        IP PORT  USER          ACCESS-BY ADDED-BY   ADDED-AT
+   ~ --------- ---- ----- ------------------ -------- ----------
+   ~ 127.1.2.3   22 (any)     mygroup(group)  johndoe 2023-07-31
+   ~ 
+   ~ 1 accesses listed
+
+   JSON_START
+   {"error_code":"OK","error_message":"OK","value":[{"forcePassword":null,"expiry":null,"port":"22","addedBy":"johndoe","ip":"127.1.2.3","userComment":null,"addedDate":"2023-07-31 08:56:05","user":null,"reverseDns":null,"comment":null,"forceKey":null}],"command":"groupListServers"}
+   JSON_END
+
+As the anchors are the same, the parsing can be done with the same logic as above:
+
+.. code-block:: shell
+   :emphasize-lines: 1,2
+
+   ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json --quiet | \
+     awk '/^JSON_END\r?$/ {if(P==1){exit}} { if(P==1){print} } /^JSON_START\r?$/ {P=1}' | jq .
+   {
+     "error_code": "OK",
+     "error_message": "OK",
+     "value": [
+       {
+         "userComment": null,
+         "reverseDns": null,
+         "expiry": null,
+         "user": null,
+         "forceKey": null,
+         "addedDate": "2023-07-31 08:56:05",
+         "port": "22",
+         "addedBy": "johndoe",
+         "ip": "127.1.2.3",
+         "forcePassword": null,
+         "comment": null
+       }
+     ],
+     "command": "groupListServers"
+   }
+
+Using --json-greppable
+----------------------
+
+This is a variant of the ``--json`` option, but instead of relying on ``JSON_START`` and ``JSON_END`` anchors,
+which works for both ``--json`` and ``--json-pretty`` modes, here the JSON output is packed on one line,
+starting with the ``JSON_OUTPUT=`` anchor.
+You may use the option that is the easier for you to parse in your script or calling program.
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json--greppable
+   ---ac777d06bec9-------------------------------------------the-bastion-3.12.00---
+   => list of servers pertaining to the group
+   --------------------------------------------------------------------------------
+   ~        IP PORT  USER          ACCESS-BY ADDED-BY   ADDED-AT
+   ~ --------- ---- ----- ------------------ -------- ----------
+   ~ 127.1.2.3   22 (any)     mygroup(group)  johndoe 2023-07-31
+   ~ 
+   ~ 1 accesses listed
+
+   JSON_OUTPUT={"error_code":"OK","command":"groupListServers","error_message":"OK","value":[{"reverseDns":null,"userComment":null,"user":null,"forceKey":null,"port":"22","addedDate":"2023-07-31 08:56:05","expiry":null,"addedBy":"johndoe","ip":"127.1.2.3","comment":null,"forcePassword":null}]}
+   ----------------------------------------------------------</groupListServers>---
+
+Here is an example of parsing using simple shell commands:
+
+.. code-block:: shell
+   :emphasize-lines: 1,2
+
+   ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json-greppable --quiet | \
+     grep ^JSON_OUTPUT= | cut -d= -f2- | jq .
+   {
+     "error_code": "OK",
+     "error_message": "OK",
+     "value": [
+       {
+         "userComment": null,
+         "reverseDns": null,
+         "expiry": null,
+         "user": null,
+         "forceKey": null,
+         "addedDate": "2023-07-31 08:56:05",
+         "port": "22",
+         "addedBy": "johndoe",
+         "ip": "127.1.2.3",
+         "forcePassword": null,
+         "comment": null
+       }
+     ],
+     "command": "groupListServers"
+   }
+
+
+JSON payload format
+===================
+
+The JSON payload is always a hash with 4 keys: ``error_code``, ``error_message``, ``value`` and ``command``,
+as you may have witnessed from the examples above.
+
+These keys are detailed below.
+
+command
+-------
+
+The associated value is a string, containing the name of the command (plugin) that generated this output.
+
+error_code
+----------
+
+The associated value is an always-uppercase string. You should look at the prefix of this string to know
+whether the command was a success or not. The value is never ``null`` and always matches the following regex:
+``^(OK|KO|ERR)[A-Z0-9_]*$``. The possible prefixes are either:
+
+- ``OK``: the command has succeeded
+- ``KO``: the command did not succeed
+- ``ERR``: the command encountered an error, more information should be available in the ``error_message`` field,
+  the ``value`` field will most likely be ``null``
+
+Examples of such values include: ``KO_ACCESS_DENIED``, ``OK``, ``OK_NO_CHANGE``, ``ERR_MEMBER_CANNOT_BE_GUEST``.
+
+You should rely on these error codes in the code using The Bastion's API to take decisions.
+
+error_message
+-------------
+
+The associated value is a string, intended for human reading. It gives more details about the returned ``error_code``,
+but is not intended to be parsed by your code, as it may change without notice from version to version. If there is no
+specific ``error_message`` for a given case, the value will be the same than the one for ``error_code``, hence this
+field is guaranteed to always exist and never be ``null``.
+
+value
+-----
+
+The data associated to the key ``value`` is entirely dependent on ``command``, and can be a nested structure of
+hashes and/or arrays. This is the actual data payload returned by the command you've invoked. Note that ``value``
+can also be ``null``, particularly if the ``error_code`` doesn't start with the ``OK`` prefix.
+
+Good practices
+==============
+
+If you're intending interaction with The Bastion API, it's a good idea to have accounts dedicated to this, to have
+a clear distinction between human SSH usage and automated API calls. Additionally, if your automation will only
+use such accounts to call plugins (``--osh`` commands), you might want to create such accounts with the ``--osh-only``
+parameter to ``accountCreate``, this guarantees that such accounts will never be able to use The Bastion to connect
+to other infrastructures (e.g. using SSH) even if granted to.
diff --git a/_sources/using/basics/access_management.rst.txt b/_sources/using/basics/access_management.rst.txt
new file mode 100644
index 000000000..9953f8332
--- /dev/null
+++ b/_sources/using/basics/access_management.rst.txt
@@ -0,0 +1,146 @@
+=================
+Access management
+=================
+
+There are two ways of managing authorizations on The Bastion, it is extremely important
+to understand those two ways because they're complementary.
+
+.. note::
+   This section is largely inspired from the `blog post about the subject
+   <https://blog.ovhcloud.com/the-ovhcloud-ssh-bastion-part-2-delegation-dizziness/>`_
+
+The main idea is that delegation is at the core of the system: everybody has their own set of responsibilities,
+and potential actions, without having to ask the bastion admin.
+
+.. _accessManagementPersonalAccesses:
+
+Personal Accesses
+=================
+
+On the bastion, each account has (at least) one set of **personal egress keys**.
+These beasts are generated when the account is first created.
+The personal egress **private key** sits in the bastion account home.
+The account user has no way to see it, or export it out of the bastion,
+but they can use it through the bastion's code logic.
+The user can retrieve the corresponding **public key** at any time, using the :doc:`/plugins/open/selfListEgressKeys`
+command, and install it – or get it installed – on the remote servers they needs to access.
+Depending on your use case – and the level of autonomy you want to give to the teams – there are
+two ways of managing these personal accesses.
+
+Decentralized (help yourself)
+*****************************
+
+The first way mimics how you would manage accesses if you weren't using an SSH bastion at all.
+This is a perfectly valid way to handle accesses on a simple level, without too many users and a limited
+number of machines. This allows anyone to grant themselves personal accesses on the bastion,
+without having to ask anyone else to do it. It sounds like a security hole, but it's not.
+If someone adds themself a personal access to the remote server, it will only work if their
+personal egress public key has already been installed on the remote server.
+In other words, they either already had access to the remote server to do this – using means other than the bastion –
+or somebody who had access to the remote server accepted the addition of their key.
+Either way, they cannot magically grant themselves personal access without
+the admins of the remote server first permitting their key.
+
+Centralized (ask the IT crowd)
+******************************
+
+Another way to handle this can be to grant a limited number of people, such as security teams,
+the right to add personal accesses to others. This way people are less autonomous, but it might be useful
+if adding accesses has to be enacted via normalized processes. It also has some nice effects: as a sysadmin,
+one of the pros is that you can create 3 separate accounts on the remote machine, and map them to each bastion account
+you're adding. This is a good method for achieving **end-to-end traceability**; including on the remote server;
+where you might want to install **auditd** or similar tools.
+It's also doable in the help yourself mode, but it may be harder to enforce.
+
+To be clear, this access model doesn't scale so efficiently when we're dealing with whole teams,
+or big infrastructures – this is where group-based access comes handy.
+
+.. _accessManagementGroupAccesses:
+
+Group Accesses
+==============
+
+.. image:: /img/groups.png
+   :width: 400px
+
+A group has three components:
+
+- A list of members (accounts, representing individual people)
+- At least one set of group egress keys
+- A list of servers (or more precisely IPs)
+
+Servers list
+************
+
+The servers list is actually a list of IPs, or IP blocks. They map to your servers, network devices,
+or anything else with SSH capability that has an IP (on which the egress group key has been installed).
+Technically, this list is actually composed of 3-tuple items: remote user, remote IP (or IP block), remote port.
+That which applies to the personal accesses, also applies here: adding a server to the list doesn't magically
+give access to it, it is first necessary to install the **egress group public key**.
+Of course, managing the installation of these keys manually quickly becomes impractical,
+but you can consider these part of the configuration of the servers, hence they should be managed with whichever
+centralized configuration system you already use (Puppet, Chef, Ansible, /bin/cp… wait, no, strike this last one).
+
+Members list
+************
+
+The members are people who can connect to any server listed in the group server list.
+They'll be using the **private egress group key** they have access to, as members of said group.
+Of course, they have no way to extract this private key for their own use outside of the bastion,
+they can only use it through the bastion's code logic.
+
+Got a new team member? Just add them as a member of your group, and they instantly get access to all the group servers.
+Somebody leaves the company? Just delete their account on the bastion, and all the accesses are instantly gone.
+This is the case because all your servers should have incoming SSH sessions limited to your bastions.
+This way, any rogue SSH key that would have been added, is no longer of any use.
+
+.. _accessManagementGroupRoles:
+
+And some more
+*************
+
+We've covered the basics of the group-based approach, but as we need a lot of flexibility and delegation,
+there is a little more to cover. Remember when I said a group had 3 components? Well, I lied.
+A group has more than just members. Additional group roles include:
+
+- Guests
+- Gatekeepers
+- Aclkeepers
+- Owners
+
+All of these are lists of accounts that have a specific role in the group.
+
+.. image:: /img/group_roles.png
+
+First, **guests**. These are a bit like members, but with less privileges: they can connect to remote machines
+using the group key, but not to all the machines of the group, only to a subset.
+This is useful when somebody outside of the team needs a specific access to a specific server,
+potentially for a limited amount of time (as such accesses can be set to expire).
+
+Then, **gatekeepers**. Those guys manage the list of members and guests of the group.
+In other terms, they have the right to give the right to get access. Nothing too complicated here.
+Then, there are the **aclkeepers**. As you may have guessed, they manage the list of servers that are
+part of the group. If you happen to have some automation managing the provisioning of servers of your infrastructure,
+this role could be granted to a robot account whose sole purpose would be to update the servers list on the bastion,
+in a completely integrated way with your provisioning.
+You can even tag such accounts so that they'll never be able to use SSH through the bastion,
+even if somebody grants them by mistake!
+
+Last but not least, the **owners** have the highest privilege level on the group, which means they can manage
+the gatekeepers, aclkeepers and owners lists. They are permitted to give the right to give the right to get access.
+Moreover, users can accumulate these roles, which means some accounts may be a member
+and a gatekeeper at the same time, for example.
+
+Global roles
+============
+
+Beyond the roles we have just described – which are all scoped to a group – there are two additional roles,
+which are scoped to the whole bastion: the **superowner** and the **bastion admin**.
+
+In a nutshell, a **superowner** is the implicit owner of all groups present on the bastion.
+This comes in handy if the group becomes ownerless, as superowners are able to nominate a brand new owner.
+
+The most powerful role is the **bastion admin**. This role should only be given to a few individuals,
+as they can impersonate anyone, and in practice should not be given to somebody who is not already root
+on the bastion's operating system itself. Among other things, they manage the configuration of the bastion,
+where the superowners are declared.
diff --git a/_sources/using/basics/first_steps.rst.txt b/_sources/using/basics/first_steps.rst.txt
new file mode 100644
index 000000000..936630e7b
--- /dev/null
+++ b/_sources/using/basics/first_steps.rst.txt
@@ -0,0 +1,270 @@
+===========
+First steps
+===========
+
+Bastion alias
+*************
+
+You should setup a *bastion alias* to make it easy to connect to the bastion.
+An example of the proper alias to use for your account is given to the bastion administrator
+when they creates your account, and is usually something along the lines of:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   alias bssh='ssh -t myname@the-bastion.example.org --'
+
+Of course, you can modify it as you see fit, for example adding the ``-i`` argument to specify the private SSH key
+to use to connect to the bastion. You can use any name as the alias,
+but it's advised to keep it short, as you'll use it quite often.
+
+For the remaining of this documentation, we'll assume your bastion alias is ``bssh``.
+
+You can do two categories of things on the bastion:
+
+- Connect to infrastructures through it
+- Interact with the bastion itself, for example to manage your account, and/or groups,
+  through so-called **PLUGINS** aka *osh commands*
+
+Plugins
+*******
+
+We'll start by using the ``info`` plugin, to verify that your bastion access works correctly:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh --osh info
+   *------------------------------------------------------------------------------*
+   |THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+   |ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+   *------------------------------------------------------------------------------*
+   Enter PIN for 'PIV Card Holder pin (PIV_II)':
+   ---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+   => information
+   --------------------------------------------------------------------------------
+   ~ You are johndoe
+   ~ You are a bastion auditor!
+   ~ Look at you, you are a bastion superowner!
+   ~ Woosh, you are even a bastion admin!
+   ~
+   ~ Your alias to connect to this bastion is:
+   ~ alias bssh='ssh johndoe@the-bastion.example.org -p 22 -t -- '
+   ~ Your alias to connect to this bastion with MOSH is:
+   ~ alias bsshm='mosh --ssh="ssh -p 22 -t" johndoe@the-bastion.example.org -- '
+   ~
+   ~ [...]
+   ~
+   ~ Here is your excuse for anything not working today:
+   ~ BOFH excuse #46:
+   ~ waste water tank overflowed onto computer
+   ----------------------------------------------------------------------</info>---
+   Connection to the-bastion.example.org closed.
+
+Congratulations, you've just used your first command on the bastion!
+
+You can get a list of all the plugins you can use by saying:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh --osh help
+
+The list will depend on your access level on the bastion, as some commands are restricted.
+You can have more information about any command by using ``--help`` with it:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh --osh selfAddIngressKey --help
+
+See the **PLUGINS** section on the left menu, for more information about the plugins.
+
+Instead of using ``--osh`` to call plugins, you can enter the special *interactive mode*, by saying:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh -i
+
+In this mode, you can directly enter commands, and also use auto-completion features with the ``<TAB>`` key.
+You can start by just typing ``help``, which is the equivalent of saying ``bssh --osh help``.
+For security reasons, the interactive mode will disconnect you after a given amount of idle-time.
+
+Setting up access to a server
+*****************************
+
+.. note::
+
+   This section assumes that you've just set up your bastion and your account is the one that has been created
+   on installation, with all the super-powers included, especially access to the restricted
+   :doc:`/plugins/restricted/selfAddPersonalAccess` command that we'll use below.
+   If this is not the case, you'll need first to have a bastion admin grant you this command
+   through :doc:`/plugins/restricted/accountGrantCommand`
+
+Let's say that you have a server you want to secure access to, using the bastion.
+We'll call it *server42.example.org*, with IP 198.51.100.42.
+To do this, we'll use the :doc:`/plugins/restricted/selfAddPersonalAccess` command.
+
+We can use the interactive mode to get the auto-completion features:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh -i
+   Enter PIN for 'PIV Card Holder pin (PIV_II)': 
+
+   Welcome to bssh interactive mode, type `help' for available commands.
+   You can use <tab> and <tab><tab> for autocompletion.
+   You'll be disconnected after 60 seconds of inactivity.
+   Loading... 88 commands and 341 autocompletion rules loaded.
+
+   bssh(master)> 
+
+You can enter the first few characters of the command, then use ``<TAB>`` to help you complete it,
+then use ``<TAB>`` again to show you the required arguments. The complete command would be as follows:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh(master)> selfAddPersonalAccess --host 198.51.100.42 --port 22 --user root
+   ---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+   => adding private access to a server on your account
+   --------------------------------------------------------------------------------
+   ~ Testing connection to root@198.51.100.42, please wait...
+   Warning: Permanently added '198.51.100.42' (ECDSA) to the list of known hosts.
+   root@198.51.100.42: Permission denied (publickey).
+   ~ Note: if you still want to add this access even if it doesn't work, use --force
+   ~ Couldn't connect to root@198.51.100.42 (ssh returned error 255). Hint: did you add the proper public key to the remote's authorized_keys?
+   -----------------------------------------------------</selfAddPersonalAccess>---
+   bssh(master)> 
+
+You'll notice that it didn't work. This is because first, you need to add your *personal egress key* to the
+remote machine's *authorized_keys* file. If this seems strange, here is
+:doc:`how it works </presentation/principles>`.
+To get your *personal egress key*, you can use this command:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh(master)> selfListEgressKeys
+   ---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+   => the public part of your personal bastion key
+   --------------------------------------------------------------------------------
+   ~ You can copy one of those keys to a remote machine to get access to it through your account
+   ~ on this bastion, if it is listed in your private access list (check selfListAccesses)
+   ~  
+   ~ Always include the from="198.51.100.1/32" part when copying the key to a server!
+   ~  
+   ~ fingerprint: SHA256:rMpoCaYPSfRqmOBFOJvEr5uLqxYjqYtRDgUoqUwH2nA (ED25519-256) [2019/07/11]
+   ~ keyline follows, please copy the *whole* line:
+   from="198.51.100.1/32" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILnY2NQTKsTDxgcaTE6vHVm9FIbud1rJcYQ/4xUyr+DK johndoe@bssh:1562861572
+   --------------------------------------------------------</selfListEgressKeys>---
+
+Now that you have it, you can push this public key (the line starting with the *from=*) to the remote server's
+root authorized_keys, i.e. ``/root/.ssh/authorized_keys``. Now, you can add your access properly:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh(master)> selfAddPersonalAccess --host 198.51.100.42 --port 22 --user root
+   ---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+   => adding private access to a server on your account
+   --------------------------------------------------------------------------------
+   ~ Testing connection to root@198.51.100.42, please wait...
+   Warning: Permanently added '198.51.100.42' (ECDSA) to the list of known hosts.
+   ~ Access to root@198.51.100.42:22 successfully added
+   -----------------------------------------------------</selfAddPersonalAccess>---
+   bssh(master)> 
+
+All seems in order! Can we see this access we just created?
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh(master)> selfListAccesses
+   ---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+   => your access list
+   --------------------------------------------------------------------------------
+   ~ Dear johndoe, you have access to the following servers:
+   ~ IP               PORT     USER    ACCESS-BY   ADDED-BY      ADDED-AT
+   ~ 198.51.100.42      22     root    personal     johndoe    2020-05-01
+   -----------------------------------------------------</selfListAccesses>---
+   bssh(master)> 
+
+Connecting to a server and reviewing the session
+************************************************
+
+Good! Let's try to connect now!
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh(master)> ssh root@198.51.100.42
+   ~ Welcome to the-bastion, johndoe, your last login was 00:13:37 ago (Fri 2020-08-28 13:07:43 UTC) from 192.0.2.11(proxy-11.example.org)
+
+   proxy-11.example.org:40610 => johndoe@the-bastion.example.org:22 => root@server42.example.org:22 ...
+    allowed ... log on(/home/johndoe/ttyrec/198.51.100.42/2020-08-28.13-07-45.497020.fb00e1957b22.johndoe.root.198.51.100.42.22.ttyrec)
+   
+    will try the following accesses you have: 
+     - personal access with ED25519-256 key SHA256:rMpoCaYPSfRqmOBFOJvEr5uLqxYjqYtRDgUoqUwH2nA [2019/07/11]
+
+   Connecting...
+
+   root@server42:~# id
+   uid=0(root) gid=0(root) groups=0(root),2(bin)
+   root@server42:~#
+
+We're now connected to server42, and can do our work as usual. Note that to connect to server42, one can directly use:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh root@198.51.100.42
+
+Where ``bssh`` is the bastion alias we've just set up above, no need to enter interactive mode first of course.
+
+When we're done with server42, let's see if everything was correctly recorded:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   bssh(master)> selfListSessions --type ssh --detailed
+   ---the-bastion.example.org---------------------the-bastion-2.99.99-rc9.2-ovh1---
+   => your past sessions list
+   --------------------------------------------------------------------------------
+   ~ The list of your 100 past sessions follows:
+   ~
+   f4cca44a848e [2020/08/26@09:28:57 - 2020/08/26@09:29:57 (         60.0)] type ssh from 192.0.2.11:33450(proxy-11.example.org) via johndoe@198.51.100.1:22 to root@198.51.100.42:22(server42.example.org) returned 0
+   ----------------------------------------------------------</selfListSessions>---
+
+The first column is the unique identifier of the connection (or osh command).
+Let's see what we did exactly during this session:
+
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh(master)> selfPlaySession --id f4cca44a848e
+   ---the-bastion.example.org---------------------the-bastion-2.99.99-rc9.2-ovh1---
+   => replay a past session
+   --------------------------------------------------------------------------------
+   ~       ID: f4cca44a848e
+   ~  Started: 2020/08/26 09:28:57
+   ~    Ended: 2020/08/26 09:29:57
+   ~ Duration: 0d+00:01:00.382820
+   ~     Type: ssh
+   ~     From: 192.0.2.11:33450 (proxy-11.example.org)
+   ~      Via: johndoe@198.51.100.1:22
+   ~       To: root@198.51.100.42:22 (server42.example.org)
+   ~  RetCode: 0
+   ~ 
+   ~ Press '+' to play faster
+   ~ Press '-' to play slower
+   ~ Press '1' to restore normal playing speed
+   ~ 
+   ~ When you're ready to replay session 9f352fd4b85c, press ENTER.
+   ~ Starting from the next line, the Total Recall begins. Press CTRL+C to jolt awake.
+
+Now that you've connected to your first server, using a personal access,
+you may want to learn more about the :doc:`access_management`, or directly dive into the **PLUGINS** on the left menu.
diff --git a/_sources/using/basics/index.rst.txt b/_sources/using/basics/index.rst.txt
new file mode 100644
index 000000000..63c39ad6a
--- /dev/null
+++ b/_sources/using/basics/index.rst.txt
@@ -0,0 +1,16 @@
+==========
+The basics
+==========
+
+This section explains the basics you need to know to work with the bastion.
+It's advised to go through all the subsections.
+
+We make the assumption here that you already have a bastion account:
+
+- either you're one of the admins who just :doc:`installed<../../installation/basic>` it, or
+- one of the admins created an account for you, using :doc:`/plugins/restricted/accountCreate`
+
+.. toctree::
+
+   first_steps
+   access_management
diff --git a/_sources/using/http_proxy.rst.txt b/_sources/using/http_proxy.rst.txt
new file mode 100644
index 000000000..1080b1324
--- /dev/null
+++ b/_sources/using/http_proxy.rst.txt
@@ -0,0 +1,240 @@
+===========
+HTTPS Proxy
+===========
+
+.. contents::
+
+Introduction
+============
+
+In addition to securing your SSH accesses, by splitting the authentication part (ingress connection)
+and the authorization part (egress connection), The Bastion can do a similar job for HTTPS connections.
+
+Note that there is an overhead (depending on your hardware setup) of several hundreds of milliseconds
+for each query-response trip, due to the fact that multiple processes are spawned for each query,
+to ensure proper security containment to the calling account's system user.
+It's probably a bad idea to use on a multi-million queries/day workload,
+or if each added millisecond to the query-response trip impacts the QoS of your service.
+
+The primary use is for network devices, that happen to have more and more HTTPS APIs in addition
+to the usual ``conf terminal`` available through SSH. As the same commands are usually available from
+HTTPS and SSH on these devices, it would be too bad to secure the access to SSH through the bastion,
+but leave direct access to their HTTPS API!
+
+Query workflow
+==============
+
+The workflow is similar to the one used by SSH, e.g. two distinct connections (ingress and egress),
+with the egress connection using credentials stored on the bastion:
+
+- A client makes an HTTP request to the proxy, with the following information embedded in:
+
+  - The type of request (GET or POST)
+  - The complete URI, including the host of the remote HTTPS server it would like to send the request to
+  - Potential body data for POST requests
+  - Credentials to authenticate to the proxy on the ingress connection, namely the
+    bastion account name and its proxy password (set by ``selfGenerateProxyPassword``)
+  - User name to use to authenticate on the remote HTTPS server (for the egress connection)
+
+- The bastion checks the provided credentials to authenticate the request against a known account (authentication part)
+- The bastion verifies whether the just-authenticated account has access rights to connect to the remote server
+  as the specified remote user (authorization part)
+- The bastion uses the (group or personal) credentials stored on the bastion,
+  to passthrough the HTTP request to the remote server, as the specified remote user
+- The bastion forwards the response to the client
+
+Setting up the HTTPS Proxy
+==========================
+
+You should enable the HTTPS Proxy daemon, and configure it.
+Please check the :doc:`/administration/configuration/osh-http-proxy_conf` for more information.
+
+Running a query through the proxy
+=================================
+
+First try
+---------
+
+Once the proxy is running, we can try to query it:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   curl https://bastion1.example.org:8443/
+   No authentication provided, and authentication is mandatory
+
+Of course, the proxy only accepts to work when one is properly authenticated to it.
+To do this, one should have an account on the bastion, and use the :doc:`/plugins/open/selfGenerateProxyPassword`
+command so that a new ingress password is set for their account. They'll then be able to authenticate to the proxy
+using the HTTP basic-auth method, and try to send a request to a remote server.
+To keep a high compatibility with HTTP clients and libraries that can be used on the ingress side,
+all the additional data required by the bastion to properly authenticate, authorize and passthrough the request
+is encoded in the *user* part of the widely supported HTTP Authorize header (basic-auth).
+The *password* part corresponds to the password we've generated just above.
+
+The format of the *user* part is as follows:
+
+.. code-block:: none
+
+   BASTION_ACCOUNT@REMOTE_USER@REMOTE_HOST%REMOTE_PORT
+
+The **%REMOTE_PORT** part is optional, and defaults to **443** if omitted.
+For example, to send a **GET /info** request to the remote network device named **router12.example.org** on
+the default port **443**, using the remote account **monitoring**, through the **bastion1.example.org** bastion,
+having the HTTPS Proxy listening on its port **8443** and a bastion account **robot-mon**, one can use **curl**:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   curl -u robot-mon@monitoring@router12.example.org https://bastion1.example.org:8443/info
+   Enter host password for user 'robot-mon@monitoring@router12.example.org':
+   This account doesn't have access to this user@host tuple (Access denied for robot-mon to monitoring@router12.example.org:443)
+
+A password will be prompted: the password generated by ``selfGenerateProxyPassword`` should be entered.
+Remember: this is to authenticate yourself to the bastion (ingress connection), then the bastion will authenticate
+itself to the remote machine (egress connection), using credentials stored on the bastion,
+that your account must have access to.
+
+In the above case, we entered the password correctly, but our account doesn't have access to
+the requested host `monitoring@router12.example.org`. This is what we need to do now.
+
+Access declaration
+------------------
+
+The access check is the same than the one done for SSH accesses, which means that oneself
+can have access to a remote host either through a :ref:`personal access <accessManagementPersonalAccesses>` or
+a :ref:`group access <accessManagementGroupAccesses>`.
+
+To get granted access to a remote device, through a personal access, either
+the :doc:`/plugins/restricted/selfAddPersonalAccess` or the :doc:`/plugins/restricted/accountAddPersonalAccess` shall
+be used (both are restricted commands) such as:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh accountAddPersonalAccess --host router12.example.org --port 443 --user monitoring --force
+
+Note the use of ``--force`` to skip the SSH connection test, which is useless in our case.
+
+To use a group access instead, one of the :ref:`aclkeepers <accessManagementGroupRoles>` of the group
+should use :doc:`/plugins/group-aclkeeper/groupAddServer`, such as:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh groupAddServer --group netdevices --host router12.example.org --port 443 --user monitoring --force
+
+
+Egress password
+---------------
+
+For personal accesses
+*********************
+
+If access to a remote device is granted to you through a personal access (using either the ``selfAddPersonalAccess``
+or ``accountAddPersonalAccess`` commands), you must first generate a new set of credentials that will be stored
+on your bastion account, for egress connections. This is the equivalent of your personal egress keys for SSH,
+but in that case it's a password that will be used to authenticate using basic-auth to the remote server.
+You can generate this password using the ``selfGeneratePassword`` command:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh selfGeneratePassword --do-it
+   *------------------------------------------------------------------------------*
+   |THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+   |ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+   *------------------------------------------------------------------------------*
+   ╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+   │ ▶ generating a new egress password for your account
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Generated a new password of length 16 for your account, robot-mon, hashes follow:
+   │ md5crypt: $1$G0fo$2DH2OJQJ9bMgo5fUUuPeK.
+   │ sha256crypt: $5$2xd1aGuD$ze7px3olXdjWthSrdnzelm6avzT2kszx/voXms8/V00
+   │ sha512crypt: $6$udw2UNLs$tQ1p7ZYraOT4Woh1ZCGJNf.UAIh09nXPBf4ejpRurOY/fJUs6Dgh1WdkpY4pdCvKMQrPeetB42bNTSzIwJyGi1
+   │ This new password will now be used by default.
+   ╰─────────────────────────────────────────────────────</selfGeneratePassword>───
+
+As you can see, the password is stored on your bastion account, and is not printed: only its hashes are.
+With this information, the corresponding remote account can be provisioned on the device (usually, a network device).
+In our above example, an account named **monitoring** would have to be created on the remote device,
+using one of these hashes. Prefer to use the most secure hashing algorithm supported by the remote device.
+
+To get your password (hash) list, you can use ``selfListPasswords``:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh selfListPasswords
+   *------------------------------------------------------------------------------*
+   |THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+   |ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+   *------------------------------------------------------------------------------*
+   ╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+   │ ▶ list your egress passwords
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Current password created at Tue Jun 22 15:42:10 2021 by robot-mon
+   │ ... md5crypt: $1$G0fo$2DH2OJQJ9bMgo5fUUuPeK.
+   │ ... sha256crypt: $5$2xd1aGuD$ze7px3olXdjWthSrdnzelm6avzT2kszx/voXms8/V00
+   │ ... sha512crypt: $6$udw2UNLs$tQ1p7ZYraOT4Woh1ZCGJNf.UAIh09nXPBf4ejpRurOY/fJUs6Dgh1WdkpY4pdCvKMQrPeetB42bNTSzIwJyGi1
+   │ 
+   │ Fallback password 1 created at Wed Jun  2 08:00:01 2021 by robot-mon
+   │ ... md5crypt: $1$qF0M$2.rbRRGs66aPiEpc/SqGv/
+   │ ... sha256crypt: $5$E9qkC7D6$SG8BB.nXvwU0dB0Bq9S/sF5pDidLwSIDKCv95qNWhX0
+   │ ... sha512crypt: $6$druGNgSk$bzVHSvux/OOE2ZhDpabFekQU3GTsiKS7Yl/lLmb9gIAmjnFfR6gj7GzOniK2jdLtEcB/hQlhcx9TDgj5zHhVd.
+   │ 
+   ╰────────────────────────────────────────────────────────</selfListPasswords>───
+
+If the ``selfGeneratePassword`` command is used several times, the newly generated password will always override
+the previous one. Still, all the previous passwords are kept (archived) for good measure, and can be restored
+manually by a bastion admin. These passwords are named *Fallback passwords* in the output of ``selfListPasswords``.
+
+For group accesses
+******************
+
+If the access to the remote device is given through a group, then the group's own credentials will be used.
+To this effect, one of the group owners should use the :doc:`/plugins/group-owner/groupGeneratePassword` command:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh groupGeneratePassword --group netdevices --do-it
+   ╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+   │ ▶ generating a new egress password for the group
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Generated a new password of length 16 for group netdevices, hashes follow:
+   │ md5crypt: $1$9sb2$X8/pPBSLfQ0ddBGR/bzsT1
+   │ sha256crypt: $5$o6Jr8w0X$yQfLuX17tUwE1jfhhAX//vsn6KpXU5jUd7SCNbkYNH.
+   │ sha512crypt: $6$gyxMyjao$YNhZJPXZa4r838XKg2tfvvoV/Dtm5HKsyKt18BnvFfT.y.hZuSXRX9GhM4mA0hUsO9f0UBisO/WiK3vF/9qsL1
+   │ This new password will now be used by default.
+   ╰────────────────────────────────────────────────────</groupGeneratePassword>───
+
+As with the personal egress passwords, the password is stored on the bastion only, and is not printed:
+only its hashes are. With this information, the corresponding remote account can be provisioned
+on the device (usually, a network device).
+In our above example, an account named **monitoring** would have to be created on the remote device,
+using one of these hashes. Prefer to use the most secure hashing algorithm supported by the remote device.
+
+To get the group's password (hash) list, one can use the :doc:`/plugins/open/groupListPasswords` command:
+
+.. code-block:: none
+   :emphasize-lines: 1
+
+   bssh --osh groupListPasswords --group netdevices
+   *------------------------------------------------------------------------------*
+   |THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+   |ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+   *------------------------------------------------------------------------------*
+   ╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+   │ ▶ list the egress passwords of the group
+   ├───────────────────────────────────────────────────────────────────────────────
+   │ Current password created at Tue Jun 29 10:21:38 2021 by slesimpl
+   │ ... md5crypt: $1$9sb2$X8/pPBSLfQ0ddBGR/bzsT1
+   │ ... sha256crypt: $5$o6Jr8w0X$yQfLuX17tUwE1jfhhAX//vsn6KpXU5jUd7SCNbkYNH.
+   │ ... sha512crypt: $6$gyxMyjao$YNhZJPXZa4r838XKg2tfvvoV/Dtm5HKsyKt18BnvFfT.y.hZuSXRX9GhM4mA0hUsO9f0UBisO/WiK3vF/9qsL1
+   ╰───────────────────────────────────────────────────────</groupListPasswords>───
+
+If the ``groupGeneratePassword`` command is used several times, the newly generated password will always
+override the previous one. Still, all the previous passwords are kept (archived) for good measure,
+and can be restored manually by a bastion admin.
+These passwords are named *Fallback passwords* in the output of ``groupListPasswords``.
diff --git a/_sources/using/piv.rst.txt b/_sources/using/piv.rst.txt
new file mode 100644
index 000000000..b47324fb8
--- /dev/null
+++ b/_sources/using/piv.rst.txt
@@ -0,0 +1,185 @@
+================
+PIV keys support
+================
+
+.. contents::
+
+Introduction
+============
+
+The Bastion supports enabling a policy forcing accounts SSH ingress keys to originate from a known hardware token,
+ensuring that the private SSH key is only stored on this hardware token, and not on the filesystem.
+
+Currently, only Yubico keys implementing PIV can be verified this way. In that case, each individual hardware token
+has a builtin Certificate Authority, signed by a well-known Yubico certificate, hence proving that the hardware token
+is known and legit.
+
+This builtin CA, in turn, emits an attestation certificate each time a new PIV key is generated on the hardware token,
+hence proving that the bikey (private and public) has been generated by this individual hardware token.
+Other metadata is included in the attestation, such as the firmware version, the serial number of the token,
+the *TouchPolicy* and *PinPolicy*. Note that you may decide to overwrite the builtin CA by a one of your own,
+possibly signed by a CA of your company. This would ensure not only that the SSH key is provided by the device,
+but also that the device has been provided by your company.
+
+Please refer to
+the `Yubico PIV attestation page <https://developers.yubico.com/PIV/Introduction/PIV_attestation.html>`_ and
+the `Yubico PIV tool page <https://developers.yubico.com/yubico-piv-tool/YubiKey_PIV_introduction.html>`_
+for more information.
+
+Without a policy
+================
+
+If you want to support PIV keys without making those mandatory, you don't have anything to do:
+those keys are just regular RSA/ECDSA keys and they *just work* with The Bastion.
+In that case, after having properly configured your hardware token with a key in slot 9a,
+you can just use :doc:`/plugins/open/selfAddIngressKey` to add the key to your bastion account, and call it a day.
+As a quick guidance, on a Yubikey you can usually generate a key in the proper slot this way,
+after you've setup a management key:
+
+.. code-block:: shell
+   :emphasize-lines: 1
+
+   yubico-piv-tool --key=YOUR_MGMT_KEY --action generate --pin-policy always --touch-policy never --slot 9a -o -
+
+Now, if you want the bastion to be aware that this key is from a hardware token, you shall use the ``--piv`` option
+to :doc:`/plugins/open/selfAddIngressKey`. This won't do anything special per-se, except storing
+the certificates information, and showing the details of the PIV key in command outputs
+such as :doc:`/plugins/open/selfListIngressKeys`.
+Note however that if in the future you enable the PIV enforcing policy either on your account or globally,
+this key will be considered valid, contrary to all the keys added without the ``--piv`` option,
+even if these keys happen to be PIV ones. To add a key with the ``--piv`` option, you'll need the SSH public key
+as usual, but also the attestation certificate and the key certificate.
+Step by step details on how to get those are out of the scope of this document,
+but again as a quick guidance, on a Yubikey you can usually get those this way:
+
+.. code-block:: shell
+   :emphasize-lines: 1,2,3
+
+   yubico-piv-tool --action=read-certificate --slot=9a --key-format=SSH
+   yubico-piv-tool --action=attest --slot=9a
+   yubico-piv-tool --action=read-certificate --slot=f9
+
+When you'll have added your key, you'll see a few more details than usual:
+
+.. code-block:: console
+   :emphasize-lines: 1
+
+   bssh --osh selfAddIngressKey --piv
+   Enter PIN for 'PIV Card Holder pin (PIV_II)':
+   ---the-bastion.example.org--------------------------------the-bastion-3.01.03---
+   => add a new public key to your account
+   --------------------------------------------------------------------------------
+   ~ Please paste the SSH key you want to add. This bastion supports the following algorithms:
+   ~ ED25519: strongness[#####] speed[#####], use `ssh-keygen -t ed25519' to generate one
+   ~ ECDSA  : strongness[####.] speed[#####], use `ssh-keygen -t ecdsa -b 521' to generate one
+   ~ RSA    : strongness[###..] speed[#....], use `ssh-keygen -t rsa -b 4096' to generate one
+   ~ 
+   ~ In any case, don't save it without a passphrase.
+   ~ You can prepend your key with a from="IP1,IP2,..." as this bastion policy allows ingress keys "from" override by users
+   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyAMtxGT/RvzBZXiYlrCswZMruRtoBtONrVJTZ3Cj5ZpjaZyCRjQ/ETzZXXbvu9KiBsZyhVb/5H9F7CSGi+D5BlcRAKrT9P8MsT7BHWU14GhJddhHDy4rMnXapE93oxbnQIjQT34ozvTKlb0qOoR/SlT14LllvQS6ajaXB7Fm4bAJG/gYGXHEs2nmZn37Rll6vvpZ4ExM29UrqU3hAjYO0Ha+kL5G8Tr+fOhV/5ZmzNsYigdW7Ft7Co4Tpld9D0PqVhDPK7F1zHIFUXunFsewGtB3IQxLdLGDaCMzrRi11V6q/pBzN/75YsW6npRdOzJKjnwxG19lTtVCmCY3EPRFz
+   ~ 
+   ~ You have requested to add a PIV-enabled SSH key.
+   ~ Please paste the PIV attestation certificate of your hardware key in PEM format.
+   ~ This snippet should start with '-----BEGIN CERTIFICATE-----' and end with '-----END CERTIFICATE-----':
+   ~ 
+   -----BEGIN CERTIFICATE-----
+   MIIDIDCCAgigAwIBAgIQAajpKeFbM+X1Yfk8GaH9dzANBgkqhkiG9w0BAQsFADAh
+   MR8wHQYDVQQDDBZZdWJpY28gUElWIEF0dGVzdGF0aW9uMCAXDTE2MDMxNDAwMDAw
+   MFoYDzIwNTIwNDE3MDAwMDAwWjAlMSMwIQYDVQQDDBpZdWJpS2V5IFBJViBBdHRl
+   c3RhdGlvbiA5YTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALIAy3EZ
+   P9G/MFleJiWsKzBkyu5G2gG042tUlNncKPlmmNpnIJGND8RPNlddu+70qIGxnKFV
+   v/kf0XsJIaL4PkGVxEAqtP0/wyxPsEdZTXgaEl12EcPLisyddqkT3ejFudAiNBPf
+   ijO9MqVvSo6hH9KVPXguWW9BLpqNpcHsWbhsAkb+BgZccSzaeZmfftGWXq++lngT
+   Ezb1SupTeECNg7Qdr6QvkbxOv586FX/lmbM2xiKB1bsW3sKjhOmV30PQ+pWEM8rs
+   XXMcgVRe6cWx7Aa0HchDEt0sYNoIzOtGLXVXqr+kHM3/vlixbqelF07MkqOfDEbX
+   2VO1UKYJjcQ9EXMCAwEAAaNOMEwwEQYKKwYBBAGCxAoDAwQDBQIEMBQGCisGAQQB
+   gsQKAwcEBgIEALeG1jAQBgorBgEEAYLECgMIBAIDATAPBgorBgEEAYLECgMJBAEB
+   MA0GCSqGSIb3DQEBCwUAA4IBAQAq9O6H02KRvSmBYsz23r6cNTNS/fr5lSPYMHz/
+   fX+D5B1thKKGstsfZVzoopwIjj86cIWpCYuNfEje+a5HrELL8ClV88JutJR2Nihs
+   NxU3BbsSUqnwi2rQHcmtHJcC8rjfDzpYDlW1yR+SxVenbVxuRy0v8sbleHSPYaXG
+   EhjupEAuhq7n0TjZMF1X7KElx9FZZM9HeuxUJvzV7XWiUgA4Zm05+4/zKW01n2kt
+   +aMaQk7T1oiE0oOK51wJX6J80GzF51pM00oPlh4iDvnnNXYN2KvkNuNwPoceDDE/
+   8K23ZfJyTN5nibk13UbxEWSHMUue1zcnFp0KdhqxbJYSS/9q
+   -----END CERTIFICATE-----
+   ~ 
+   ~ Thanks, now please paste the PIV key certificate of your generated key in PEM format.
+   ~ This snippet should also start with '-----BEGIN CERTIFICATE-----' and end with '-----END CERTIFICATE-----':
+   ~ 
+   -----BEGIN CERTIFICATE-----
+   MIIC5jCCAc6gAwIBAgIJAKT/dqaxohbiMA0GCSqGSIb3DQEBCwUAMCsxKTAnBgNV
+   BAMMIFl1YmljbyBQSVYgUm9vdCBDQSBTZXJpYWwgMjYzNzUxMCAXDTE2MDMxNDAw
+   MDAwMFoYDzIwNTIwNDE3MDAwMDAwWjAhMR8wHQYDVQQDDBZZdWJpY28gUElWIEF0
+   dGVzdGF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwDhP3YUI
+   yLWSjseIKNzMscqCdicslrdkxPgMoK8Ocxu0err4yvFXiSZZL32BTZYLD8N7Y+d1
+   cww6VVsFYdwn01Kc6YLrwM5FIN/msXkGTPdPVhVeqNMHh4QyYrYixwWaTbDCGoQD
+   axVlifVmPS02Mvm8NDjC17X3LhsV1OiS/wOScsI8HHGgQXQIQEDMnt6cwZ83QK73
+   7Wuu5uhSzT3jVOz28Rnij1p/8PcVWcGKWCPVYNbCmCdcm/sQeJB8y5aERDaePIIZ
+   v9axnDT0DnUO7aDpzXA7i7XPbrkiSBEp7RCqXGs5cBqGCbq//xGh+/AGtCCV/sQM
+   nTjl0d2k2Q8XTwIDAQABoxUwEzARBgorBgEEAYLECgMDBAMFAgQwDQYJKoZIhvcN
+   AQELBQADggEBAHCnp3k5kQaBwYmR9nUHKGY1dgCvhJUlX2SAyY2fUeaMuURcRRlW
+   BFw6CvLAjvSs5Dy3O6JWDmk+1WFZo0UMr15WZFiS5Fpy0M+GWvBCRP3YmbSw+J2t
+   kyWypCIIu7cMtLpRYkL5SAlWmUCAz8dZPk5FLPpeqmxgQnRoSSe67IXiv3bNyPA1
+   3NoXI2xw0hWQU1+85tfTxoTxOiAzY8UpAT2GggtSmCwO3sHsHJUYXRyCf8e6jtJL
+   OFBx/uz+VJoRH7hUVOY+sbP5JJ83dRrWZkS57Hf3q0LOtbn27vM+fmL0y7z4vgDo
+   DedmrmsbPtsRc3t7RWoqCa80Iq1jPvdm5gw=
+   -----END CERTIFICATE-----
+   ~  
+   ~ Public key successfully added:
+   ~ info: ADDED_BY=jdoe USING=selfAddIngressKey UNIQID=2993de2bb014 TIMESTAMP=1609427402 DATETIME=2020-12-31T15:10:02 VERSION=3.01.03
+   ~ PIV: TouchPolicy=Never, PinPolicy=Always, SerialNo=12345678, Firmware=5.2.4
+   ~ fingerprint: SHA256:8B0T6174KUPL1iTSyC0UpnDOvuaCgyKpu8zo9rb2lco (RSA-2048) [2020/12/17]
+   ---------------------------------------------------------</selfAddIngressKey>---
+
+As you can see, we added the public key as usual but were also asked for the two certificates.
+On the bastion answer, right before the fingerprint of the key, we have a line starting with *PIV:*,
+with some metadata extracted from the certificate.
+
+Per-account policy
+==================
+
+If you want to force several accounts to only use certified PIV keys, you can set the option per-account
+using the :doc:`/plugins/restricted/accountPIV` command, see its documentation page for all the possible options.
+The main takeaways are:
+
+- If you want an account to only have PIV keys, set the ``enforce`` policy for this account
+- If you want an account to never require PIV keys, even if the global policy would require it,
+  set the ``never`` policy (useful for accounts used by automated workflows)
+
+Global policy
+=============
+
+If you want to apply a policy bastion-wide, please refer to the :ref:`ingressRequirePIV` option.
+This policy can still be overridden per-account if needed, see above.
+
+Temporary grace period
+======================
+
+If you enable the PIV policy globally or on several accounts, you'll soon find out that sometimes people forget
+or lose their PIV-enabled hardware tokens, effectively locking them out of the bastion.
+There is a *temporary grace period* feature you can use to handle such cases nicely:
+
+.. code-block:: console
+   :emphasize-lines: 1
+
+   bssh --osh accountPIV --account lechuck --policy grace --ttl 48h
+   ---the-bastion.example.org--------------------------------the-bastion-3.01.03---
+   => modify the PIV policy of an account
+   --------------------------------------------------------------------------------
+   ~ Changing account configuration...
+   
+   ~ PIV grace up to 2d+00:00:00 (Wed 2021-01-13 09:22:29 UTC) has been set for this account
+   ~ Applying change to keys...
+   
+   ~ Non-PIV account's ingress keys, if any, have been restored
+   ----------------------------------------------------------------</accountPIV>---
+
+What happens here is that, for a duration of 48 hours, this account will behave as if no PIV policy was enforced:
+non-PIV keys are allowed again. If this account had non-PIV keys before its policy was set to enforce,
+those keys are even restored (can be viewed using :doc:`/plugins/open/selfListIngressKeys` as usual),
+so that they can easily connect again. However, after the grace period expires, their policy will go back to
+what it was previously, and all the non-PIV keys will be disabled again.
+This event is logged, so you can easily link this event from your SIEM to a potential ticket to your Helpdesk
+for a hardware key replacement, or such.
+
+This mechanism allows some flexibility (avoiding sending people back home just because they forgot their hardware key),
+while still enforcing a high-level security policy with the proper processes in place.
diff --git a/_sources/using/sftp_scp.rst.txt b/_sources/using/sftp_scp.rst.txt
new file mode 100644
index 000000000..e9079647f
--- /dev/null
+++ b/_sources/using/sftp_scp.rst.txt
@@ -0,0 +1,98 @@
+==================
+SFTP & SCP support
+==================
+
+.. contents::
+
+Introduction
+============
+
+The Bastion's main goal is to secure ``ssh`` connections. However, one might also want to use ``sftp`` or ``scp`` through it.
+
+Its use is supported through the :doc:`/plugins/open/scp` and :doc:`/plugins/open/sftp` bastion plugins,
+respectively, and documented as part of all the plugins.
+This additional documentation section gives some examples and outlines some common configuration errors.
+
+Prerequisites
+=============
+
+The use of SFTP or SCP through the bastion requires an SFTP or SCP program that supports the **-S** option,
+and a shell to run the wrapper. This is the case on all operating systems using OpenSSH such as Linux or \*BSD.
+
+If you're running under Microsoft Windows, you might want to setup either a Linux VM, or a WSL (Windows Subsystem
+for Linux) environment, to have the OpenSSH version of ``scp`` or ``sftp`` and a working POSIX-style shell.
+
+Note that it won't work with Windows GUI apps, because there's no way to specify a wrapper (through **-S**),
+and no shell. For example, it won't work under WinSCP.
+
+Basic usage
+===========
+
+Please check the :doc:`/plugins/open/scp` and :doc:`/plugins/open/sftp` documentation to see how to use these.
+
+Access model
+============
+
+.. note::
+
+   Currently, to be able to use SFTP or SCP with a remote server,
+   you first need to have a declared SSH access to it.
+   This might change in a future version.
+
+Error message 1
+---------------
+
+This is briefly explained in the :doc:`/plugins/open/scp`/:doc:`/plugins/open/sftp` documentation,
+but having access rights to SSH to a machine is not enough to have the right to SCP to or from it, or use SFTP on it.
+If you have the following error, then this is your problem:
+
+::
+
+    Sorry, you seem to have access through ssh and through scp but by different and distinct means (distinct keys).
+    The intersection between your rights for ssh and for scp needs to be at least one.
+
+When this happens, it means that you have at least one declared SSH access to this machine (through one or
+several groups, or through personal accesses). You also have at least one declared SCP/SFTP access to it.
+However **both accesses are declared through different means**, and more precisely different SSH keys. For example:
+
+- You are a member of a group having this machine on one hand, and you have a declared SCP/SFTP access to this machine
+  using a personal access on the other hand. For SSH, the group key would be used, but for SCP/SFTP, your personal key
+  would be used. However, for technical reasons (that might be lifted in a future version), your SSH and SCP/SFTP access
+  must be declared with the same key, so in other words, using the same access mean (same group, or personal access).
+
+- You are a member of group **A** having this machine, but SCP/SFTP access is declared in group **B**.
+  In that case, as previously, as two different keys are used, this won't work.
+
+To declare an SCP or SFTP access, in addition to a preexisting SSH access, you should use either:
+
+- :doc:`/plugins/group-aclkeeper/groupAddServer`, if the SSH access is part of a group
+
+- :doc:`/plugins/restricted/selfAddPersonalAccess` or :doc:`/plugins/restricted/accountAddPersonalAccess`,
+  if the SSH access is personal (tied to an account)
+
+In both cases, where you would use the ``--user`` option to the command, to specify the remote user to use for
+the SSH access being declared, you should replace it by either ``--scpdown``, ``--scpup`` or ``--sftp``,
+to specify that you're about to add an SCP or SFTP access (not an SSH one), and which direction you want to allow.
+For SCP ,you can allow both directions by using the command first with ``--scpdown``, then with ``--scpup``.
+Note that for SFTP, you can't specify a direction, due to how the protocol works: you either have SFTP access (hence
+being able to upload and download files), or you don't.
+
+For example, this is a valid command to add SFTP access to a machine which is part of a group:
+
+::
+
+   bssh --osh groupAddServer --group mygroup --host scpserver.example.org --port 22 --sftp
+
+Error message 2
+---------------
+
+If you have the following message:
+
+::
+
+    Sorry, but you don't seem to have access to HOST:IP
+
+Then it means that you don't even have SSH access to this machine. In that case, somebody should grant you access,
+either by adding you to a group having this machine (:doc:`/plugins/group-gatekeeper/groupAddMember`) or by adding
+this machine to your personal accesses (:doc:`/plugins/restricted/accountAddPersonalAccess` or
+:doc:`/plugins/restricted/selfAddPersonalAccess`).
diff --git a/_sources/using/specific_ssh_clients_tutorials/index.rst.txt b/_sources/using/specific_ssh_clients_tutorials/index.rst.txt
new file mode 100644
index 000000000..c493cb4c0
--- /dev/null
+++ b/_sources/using/specific_ssh_clients_tutorials/index.rst.txt
@@ -0,0 +1,11 @@
+==============================
+Specific SSH clients tutorials
+==============================
+
+This section has a few howtos about using The Bastion with some specific SSH clients,
+mostly ones having a GUI, as the rest of the documentation assumes usage of the
+more widespread SSH CLI.
+
+.. toctree::
+
+   putty
diff --git a/_sources/using/specific_ssh_clients_tutorials/putty.rst.txt b/_sources/using/specific_ssh_clients_tutorials/putty.rst.txt
new file mode 100644
index 000000000..e7b2d8276
--- /dev/null
+++ b/_sources/using/specific_ssh_clients_tutorials/putty.rst.txt
@@ -0,0 +1,77 @@
+Using PuTTY with The Bastion
+============================
+
+First, you'll need to generate a pair of SSH keys. To this end, use the ``PuTTY`` companion tool: ``PuTTYgen``.
+
+Before hitting *Generate* to generate a new key pair, ensure that EdDSA is selected, with the Ed25519 curve.
+You'll have to move your mouse a bit to feed the pseudo-random number generator.
+
+.. image:: putty1.png
+   :alt: Main window of PuTTYgen
+
+Once the key has been generated, you'll have to input a passphrase that will protect your key.
+Ensure this passphrase is sufficiently hard to guess, but ensure you'll not forget it!
+Once you've entered your passphrase twice, it should look like this:
+
+.. image:: putty2.png
+   :alt: Main window of PuTTYgen once a key has been generated
+
+You can now hit *Save private key* and choose a file name.
+Also save the corresponding public key next to it by hitting *Save public key*,
+but don't close ``PuTTYgen`` yet.
+
+The public key you've just saved, which is also displayed at the top of the ``PuTTYgen`` window,
+starting by ``ssd-ed25519 AAAA...`` is the public key you'll need to give to The Bastion when
+creating your account there, so you can copy/paste it when The Bastion asks you for a key:
+
+.. image:: putty3.png
+   :alt: Creating an account on The Bastion
+
+Now, you can close ``PuTTYgen`` (as you've saved the private and public keys in their respective
+files, you'll be able to use them later), and open ``PuTTY`` itself:
+
+.. image:: putty4.png
+   :alt: Main window of PuTTY
+
+To create the proper connection settings, set your bastion host name (or IP) and port in the
+window above, and leave the connection type to SSH.
+
+Then, navigate to *Connection > SSH > Auth > Credentials*, and use *Browse...* to set the
+location of the private key you've generated with ``PuTTYgen``. Ensure you use the private
+key, not the public key: the private key usually ends in :file:`.ppk`, as shown below:
+
+.. image:: putty5.png
+   :alt: Credentials options section of PuTTY window
+
+Then, navigate back to *Session*, and save the session settings under any name you wish,
+so that the next time you open ``PuTTY``, you'll be able to load these settings back:
+
+.. image:: putty6.png
+   :alt: Saving the settings in PuTTY
+
+Then, you can click *Open* to establish the connection. On the first connection attempt, you'll
+be prompted with this dialog box:
+
+.. image:: putty7.png
+   :alt: Unknown hostkey dialog box
+
+This is because ``PuTTY`` never connected to the bastion before, and asks you to verify the
+bastion's host public key. This is expected on the first connection, so you can click *Accept*.
+
+You'll then be prompted for your login, which is the account name you've created on the bastion,
+associated with your public key:
+
+.. image:: putty8.png
+   :alt: Waiting for the user login
+
+You'll then need to type the passphrase protecting your private key, so ``PuTTY`` can use it:
+
+.. image:: putty9.png
+   :alt: Waiting for the private key passphrase
+
+Once done, the bastion should authenticate you, and drop you in interactive mode:
+
+.. image:: putty10.png
+   :alt:
+
+You can now use The Bastion!
diff --git a/_static/basic.css b/_static/basic.css
new file mode 100644
index 000000000..603f6a879
--- /dev/null
+++ b/_static/basic.css
@@ -0,0 +1,905 @@
+/*
+ * basic.css
+ * ~~~~~~~~~
+ *
+ * Sphinx stylesheet -- basic theme.
+ *
+ * :copyright: Copyright 2007-2021 by the Sphinx team, see AUTHORS.
+ * :license: BSD, see LICENSE for details.
+ *
+ */
+
+/* -- main layout ----------------------------------------------------------- */
+
+div.clearer {
+    clear: both;
+}
+
+div.section::after {
+    display: block;
+    content: '';
+    clear: left;
+}
+
+/* -- relbar ---------------------------------------------------------------- */
+
+div.related {
+    width: 100%;
+    font-size: 90%;
+}
+
+div.related h3 {
+    display: none;
+}
+
+div.related ul {
+    margin: 0;
+    padding: 0 0 0 10px;
+    list-style: none;
+}
+
+div.related li {
+    display: inline;
+}
+
+div.related li.right {
+    float: right;
+    margin-right: 5px;
+}
+
+/* -- sidebar --------------------------------------------------------------- */
+
+div.sphinxsidebarwrapper {
+    padding: 10px 5px 0 10px;
+}
+
+div.sphinxsidebar {
+    float: left;
+    width: 230px;
+    margin-left: -100%;
+    font-size: 90%;
+    word-wrap: break-word;
+    overflow-wrap : break-word;
+}
+
+div.sphinxsidebar ul {
+    list-style: none;
+}
+
+div.sphinxsidebar ul ul,
+div.sphinxsidebar ul.want-points {
+    margin-left: 20px;
+    list-style: square;
+}
+
+div.sphinxsidebar ul ul {
+    margin-top: 0;
+    margin-bottom: 0;
+}
+
+div.sphinxsidebar form {
+    margin-top: 10px;
+}
+
+div.sphinxsidebar input {
+    border: 1px solid #98dbcc;
+    font-family: sans-serif;
+    font-size: 1em;
+}
+
+div.sphinxsidebar #searchbox form.search {
+    overflow: hidden;
+}
+
+div.sphinxsidebar #searchbox input[type="text"] {
+    float: left;
+    width: 80%;
+    padding: 0.25em;
+    box-sizing: border-box;
+}
+
+div.sphinxsidebar #searchbox input[type="submit"] {
+    float: left;
+    width: 20%;
+    border-left: none;
+    padding: 0.25em;
+    box-sizing: border-box;
+}
+
+
+img {
+    border: 0;
+    max-width: 100%;
+}
+
+/* -- search page ----------------------------------------------------------- */
+
+ul.search {
+    margin: 10px 0 0 20px;
+    padding: 0;
+}
+
+ul.search li {
+    padding: 5px 0 5px 20px;
+    background-image: url(file.png);
+    background-repeat: no-repeat;
+    background-position: 0 7px;
+}
+
+ul.search li a {
+    font-weight: bold;
+}
+
+ul.search li p.context {
+    color: #888;
+    margin: 2px 0 0 30px;
+    text-align: left;
+}
+
+ul.keywordmatches li.goodmatch a {
+    font-weight: bold;
+}
+
+/* -- index page ------------------------------------------------------------ */
+
+table.contentstable {
+    width: 90%;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+table.contentstable p.biglink {
+    line-height: 150%;
+}
+
+a.biglink {
+    font-size: 1.3em;
+}
+
+span.linkdescr {
+    font-style: italic;
+    padding-top: 5px;
+    font-size: 90%;
+}
+
+/* -- general index --------------------------------------------------------- */
+
+table.indextable {
+    width: 100%;
+}
+
+table.indextable td {
+    text-align: left;
+    vertical-align: top;
+}
+
+table.indextable ul {
+    margin-top: 0;
+    margin-bottom: 0;
+    list-style-type: none;
+}
+
+table.indextable > tbody > tr > td > ul {
+    padding-left: 0em;
+}
+
+table.indextable tr.pcap {
+    height: 10px;
+}
+
+table.indextable tr.cap {
+    margin-top: 10px;
+    background-color: #f2f2f2;
+}
+
+img.toggler {
+    margin-right: 3px;
+    margin-top: 3px;
+    cursor: pointer;
+}
+
+div.modindex-jumpbox {
+    border-top: 1px solid #ddd;
+    border-bottom: 1px solid #ddd;
+    margin: 1em 0 1em 0;
+    padding: 0.4em;
+}
+
+div.genindex-jumpbox {
+    border-top: 1px solid #ddd;
+    border-bottom: 1px solid #ddd;
+    margin: 1em 0 1em 0;
+    padding: 0.4em;
+}
+
+/* -- domain module index --------------------------------------------------- */
+
+table.modindextable td {
+    padding: 2px;
+    border-collapse: collapse;
+}
+
+/* -- general body styles --------------------------------------------------- */
+
+div.body {
+    min-width: 450px;
+    max-width: 800px;
+}
+
+div.body p, div.body dd, div.body li, div.body blockquote {
+    -moz-hyphens: auto;
+    -ms-hyphens: auto;
+    -webkit-hyphens: auto;
+    hyphens: auto;
+}
+
+a.headerlink {
+    visibility: hidden;
+}
+
+a.brackets:before,
+span.brackets > a:before{
+    content: "[";
+}
+
+a.brackets:after,
+span.brackets > a:after {
+    content: "]";
+}
+
+h1:hover > a.headerlink,
+h2:hover > a.headerlink,
+h3:hover > a.headerlink,
+h4:hover > a.headerlink,
+h5:hover > a.headerlink,
+h6:hover > a.headerlink,
+dt:hover > a.headerlink,
+caption:hover > a.headerlink,
+p.caption:hover > a.headerlink,
+div.code-block-caption:hover > a.headerlink {
+    visibility: visible;
+}
+
+div.body p.caption {
+    text-align: inherit;
+}
+
+div.body td {
+    text-align: left;
+}
+
+.first {
+    margin-top: 0 !important;
+}
+
+p.rubric {
+    margin-top: 30px;
+    font-weight: bold;
+}
+
+img.align-left, figure.align-left, .figure.align-left, object.align-left {
+    clear: left;
+    float: left;
+    margin-right: 1em;
+}
+
+img.align-right, figure.align-right, .figure.align-right, object.align-right {
+    clear: right;
+    float: right;
+    margin-left: 1em;
+}
+
+img.align-center, figure.align-center, .figure.align-center, object.align-center {
+  display: block;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+img.align-default, figure.align-default, .figure.align-default {
+  display: block;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.align-left {
+    text-align: left;
+}
+
+.align-center {
+    text-align: center;
+}
+
+.align-default {
+    text-align: center;
+}
+
+.align-right {
+    text-align: right;
+}
+
+/* -- sidebars -------------------------------------------------------------- */
+
+div.sidebar,
+aside.sidebar {
+    margin: 0 0 0.5em 1em;
+    border: 1px solid #ddb;
+    padding: 7px;
+    background-color: #ffe;
+    width: 40%;
+    float: right;
+    clear: right;
+    overflow-x: auto;
+}
+
+p.sidebar-title {
+    font-weight: bold;
+}
+
+div.admonition, div.topic, blockquote {
+    clear: left;
+}
+
+/* -- topics ---------------------------------------------------------------- */
+
+div.topic {
+    border: 1px solid #ccc;
+    padding: 7px;
+    margin: 10px 0 10px 0;
+}
+
+p.topic-title {
+    font-size: 1.1em;
+    font-weight: bold;
+    margin-top: 10px;
+}
+
+/* -- admonitions ----------------------------------------------------------- */
+
+div.admonition {
+    margin-top: 10px;
+    margin-bottom: 10px;
+    padding: 7px;
+}
+
+div.admonition dt {
+    font-weight: bold;
+}
+
+p.admonition-title {
+    margin: 0px 10px 5px 0px;
+    font-weight: bold;
+}
+
+div.body p.centered {
+    text-align: center;
+    margin-top: 25px;
+}
+
+/* -- content of sidebars/topics/admonitions -------------------------------- */
+
+div.sidebar > :last-child,
+aside.sidebar > :last-child,
+div.topic > :last-child,
+div.admonition > :last-child {
+    margin-bottom: 0;
+}
+
+div.sidebar::after,
+aside.sidebar::after,
+div.topic::after,
+div.admonition::after,
+blockquote::after {
+    display: block;
+    content: '';
+    clear: both;
+}
+
+/* -- tables ---------------------------------------------------------------- */
+
+table.docutils {
+    margin-top: 10px;
+    margin-bottom: 10px;
+    border: 0;
+    border-collapse: collapse;
+}
+
+table.align-center {
+    margin-left: auto;
+    margin-right: auto;
+}
+
+table.align-default {
+    margin-left: auto;
+    margin-right: auto;
+}
+
+table caption span.caption-number {
+    font-style: italic;
+}
+
+table caption span.caption-text {
+}
+
+table.docutils td, table.docutils th {
+    padding: 1px 8px 1px 5px;
+    border-top: 0;
+    border-left: 0;
+    border-right: 0;
+    border-bottom: 1px solid #aaa;
+}
+
+table.footnote td, table.footnote th {
+    border: 0 !important;
+}
+
+th {
+    text-align: left;
+    padding-right: 5px;
+}
+
+table.citation {
+    border-left: solid 1px gray;
+    margin-left: 1px;
+}
+
+table.citation td {
+    border-bottom: none;
+}
+
+th > :first-child,
+td > :first-child {
+    margin-top: 0px;
+}
+
+th > :last-child,
+td > :last-child {
+    margin-bottom: 0px;
+}
+
+/* -- figures --------------------------------------------------------------- */
+
+div.figure, figure {
+    margin: 0.5em;
+    padding: 0.5em;
+}
+
+div.figure p.caption, figcaption {
+    padding: 0.3em;
+}
+
+div.figure p.caption span.caption-number,
+figcaption span.caption-number {
+    font-style: italic;
+}
+
+div.figure p.caption span.caption-text,
+figcaption span.caption-text {
+}
+
+/* -- field list styles ----------------------------------------------------- */
+
+table.field-list td, table.field-list th {
+    border: 0 !important;
+}
+
+.field-list ul {
+    margin: 0;
+    padding-left: 1em;
+}
+
+.field-list p {
+    margin: 0;
+}
+
+.field-name {
+    -moz-hyphens: manual;
+    -ms-hyphens: manual;
+    -webkit-hyphens: manual;
+    hyphens: manual;
+}
+
+/* -- hlist styles ---------------------------------------------------------- */
+
+table.hlist {
+    margin: 1em 0;
+}
+
+table.hlist td {
+    vertical-align: top;
+}
+
+/* -- object description styles --------------------------------------------- */
+
+.sig {
+	font-family: 'Consolas', 'Menlo', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace;
+}
+
+.sig-name, code.descname {
+    background-color: transparent;
+    font-weight: bold;
+}
+
+.sig-name {
+	font-size: 1.1em;
+}
+
+code.descname {
+    font-size: 1.2em;
+}
+
+.sig-prename, code.descclassname {
+    background-color: transparent;
+}
+
+.optional {
+    font-size: 1.3em;
+}
+
+.sig-paren {
+    font-size: larger;
+}
+
+.sig-param.n {
+	font-style: italic;
+}
+
+/* C++ specific styling */
+
+.sig-inline.c-texpr,
+.sig-inline.cpp-texpr {
+	font-family: unset;
+}
+
+.sig.c   .k, .sig.c   .kt,
+.sig.cpp .k, .sig.cpp .kt {
+	color: #0033B3;
+}
+
+.sig.c   .m,
+.sig.cpp .m {
+	color: #1750EB;
+}
+
+.sig.c   .s, .sig.c   .sc,
+.sig.cpp .s, .sig.cpp .sc {
+	color: #067D17;
+}
+
+
+/* -- other body styles ----------------------------------------------------- */
+
+ol.arabic {
+    list-style: decimal;
+}
+
+ol.loweralpha {
+    list-style: lower-alpha;
+}
+
+ol.upperalpha {
+    list-style: upper-alpha;
+}
+
+ol.lowerroman {
+    list-style: lower-roman;
+}
+
+ol.upperroman {
+    list-style: upper-roman;
+}
+
+:not(li) > ol > li:first-child > :first-child,
+:not(li) > ul > li:first-child > :first-child {
+    margin-top: 0px;
+}
+
+:not(li) > ol > li:last-child > :last-child,
+:not(li) > ul > li:last-child > :last-child {
+    margin-bottom: 0px;
+}
+
+ol.simple ol p,
+ol.simple ul p,
+ul.simple ol p,
+ul.simple ul p {
+    margin-top: 0;
+}
+
+ol.simple > li:not(:first-child) > p,
+ul.simple > li:not(:first-child) > p {
+    margin-top: 0;
+}
+
+ol.simple p,
+ul.simple p {
+    margin-bottom: 0;
+}
+
+dl.footnote > dt,
+dl.citation > dt {
+    float: left;
+    margin-right: 0.5em;
+}
+
+dl.footnote > dd,
+dl.citation > dd {
+    margin-bottom: 0em;
+}
+
+dl.footnote > dd:after,
+dl.citation > dd:after {
+    content: "";
+    clear: both;
+}
+
+dl.field-list {
+    display: grid;
+    grid-template-columns: fit-content(30%) auto;
+}
+
+dl.field-list > dt {
+    font-weight: bold;
+    word-break: break-word;
+    padding-left: 0.5em;
+    padding-right: 5px;
+}
+
+dl.field-list > dt:after {
+    content: ":";
+}
+
+dl.field-list > dd {
+    padding-left: 0.5em;
+    margin-top: 0em;
+    margin-left: 0em;
+    margin-bottom: 0em;
+}
+
+dl {
+    margin-bottom: 15px;
+}
+
+dd > :first-child {
+    margin-top: 0px;
+}
+
+dd ul, dd table {
+    margin-bottom: 10px;
+}
+
+dd {
+    margin-top: 3px;
+    margin-bottom: 10px;
+    margin-left: 30px;
+}
+
+dl > dd:last-child,
+dl > dd:last-child > :last-child {
+    margin-bottom: 0;
+}
+
+dt:target, span.highlighted {
+    background-color: #fbe54e;
+}
+
+rect.highlighted {
+    fill: #fbe54e;
+}
+
+dl.glossary dt {
+    font-weight: bold;
+    font-size: 1.1em;
+}
+
+.versionmodified {
+    font-style: italic;
+}
+
+.system-message {
+    background-color: #fda;
+    padding: 5px;
+    border: 3px solid red;
+}
+
+.footnote:target  {
+    background-color: #ffa;
+}
+
+.line-block {
+    display: block;
+    margin-top: 1em;
+    margin-bottom: 1em;
+}
+
+.line-block .line-block {
+    margin-top: 0;
+    margin-bottom: 0;
+    margin-left: 1.5em;
+}
+
+.guilabel, .menuselection {
+    font-family: sans-serif;
+}
+
+.accelerator {
+    text-decoration: underline;
+}
+
+.classifier {
+    font-style: oblique;
+}
+
+.classifier:before {
+    font-style: normal;
+    margin: 0 0.5em;
+    content: ":";
+    display: inline-block;
+}
+
+abbr, acronym {
+    border-bottom: dotted 1px;
+    cursor: help;
+}
+
+/* -- code displays --------------------------------------------------------- */
+
+pre {
+    overflow: auto;
+    overflow-y: hidden;  /* fixes display issues on Chrome browsers */
+}
+
+pre, div[class*="highlight-"] {
+    clear: both;
+}
+
+span.pre {
+    -moz-hyphens: none;
+    -ms-hyphens: none;
+    -webkit-hyphens: none;
+    hyphens: none;
+}
+
+div[class*="highlight-"] {
+    margin: 1em 0;
+}
+
+td.linenos pre {
+    border: 0;
+    background-color: transparent;
+    color: #aaa;
+}
+
+table.highlighttable {
+    display: block;
+}
+
+table.highlighttable tbody {
+    display: block;
+}
+
+table.highlighttable tr {
+    display: flex;
+}
+
+table.highlighttable td {
+    margin: 0;
+    padding: 0;
+}
+
+table.highlighttable td.linenos {
+    padding-right: 0.5em;
+}
+
+table.highlighttable td.code {
+    flex: 1;
+    overflow: hidden;
+}
+
+.highlight .hll {
+    display: block;
+}
+
+div.highlight pre,
+table.highlighttable pre {
+    margin: 0;
+}
+
+div.code-block-caption + div {
+    margin-top: 0;
+}
+
+div.code-block-caption {
+    margin-top: 1em;
+    padding: 2px 5px;
+    font-size: small;
+}
+
+div.code-block-caption code {
+    background-color: transparent;
+}
+
+table.highlighttable td.linenos,
+span.linenos,
+div.highlight span.gp {  /* gp: Generic.Prompt */
+  user-select: none;
+  -webkit-user-select: text; /* Safari fallback only */
+  -webkit-user-select: none; /* Chrome/Safari */
+  -moz-user-select: none; /* Firefox */
+  -ms-user-select: none; /* IE10+ */
+}
+
+div.code-block-caption span.caption-number {
+    padding: 0.1em 0.3em;
+    font-style: italic;
+}
+
+div.code-block-caption span.caption-text {
+}
+
+div.literal-block-wrapper {
+    margin: 1em 0;
+}
+
+code.xref, a code {
+    background-color: transparent;
+    font-weight: bold;
+}
+
+h1 code, h2 code, h3 code, h4 code, h5 code, h6 code {
+    background-color: transparent;
+}
+
+.viewcode-link {
+    float: right;
+}
+
+.viewcode-back {
+    float: right;
+    font-family: sans-serif;
+}
+
+div.viewcode-block:target {
+    margin: -1px -10px;
+    padding: 0 10px;
+}
+
+/* -- math display ---------------------------------------------------------- */
+
+img.math {
+    vertical-align: middle;
+}
+
+div.body div.math p {
+    text-align: center;
+}
+
+span.eqno {
+    float: right;
+}
+
+span.eqno a.headerlink {
+    position: absolute;
+    z-index: 1;
+}
+
+div.math:hover a.headerlink {
+    visibility: visible;
+}
+
+/* -- printout stylesheet --------------------------------------------------- */
+
+@media print {
+    div.document,
+    div.documentwrapper,
+    div.bodywrapper {
+        margin: 0 !important;
+        width: 100%;
+    }
+
+    div.sphinxsidebar,
+    div.related,
+    div.footer,
+    #top-link {
+        display: none;
+    }
+}
\ No newline at end of file
diff --git a/_static/css/badge_only.css b/_static/css/badge_only.css
new file mode 100644
index 000000000..4d1534482
--- /dev/null
+++ b/_static/css/badge_only.css
@@ -0,0 +1 @@
+.fa:before{-webkit-font-smoothing:antialiased}.clearfix{*zoom:1}.clearfix:before,.clearfix:after{display:table;content:""}.clearfix:after{clear:both}@font-face{font-family:FontAwesome;font-style:normal;font-weight:normal;src:url("../fonts/fontawesome-webfont.eot?#iefix") format("embedded-opentype"),url("../fonts/fontawesome-webfont.woff2") format("woff2"),url("../fonts/fontawesome-webfont.woff") format("woff"),url("../fonts/fontawesome-webfont.ttf") format("truetype"),url("../fonts/fontawesome-webfont.svg#FontAwesome") format("svg")}.fa:before{display:inline-block;font-family:FontAwesome;font-style:normal;font-weight:normal;line-height:1;text-decoration:inherit}a .fa{display:inline-block;text-decoration:inherit}li .fa{display:inline-block}li .fa-large:before,li .fa-large:before{width:1.875em}ul.fas{list-style-type:none;margin-left:2em;text-indent:-0.8em}ul.fas li .fa{width:.8em}ul.fas li .fa-large:before,ul.fas li .fa-large:before{vertical-align:baseline}.fa-book:before{content:""}.icon-book:before{content:""}.fa-caret-down:before{content:""}.icon-caret-down:before{content:""}.fa-caret-up:before{content:""}.icon-caret-up:before{content:""}.fa-caret-left:before{content:""}.icon-caret-left:before{content:""}.fa-caret-right:before{content:""}.icon-caret-right:before{content:""}.rst-versions{position:fixed;bottom:0;left:0;width:300px;color:#fcfcfc;background:#1f1d1d;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;z-index:400}.rst-versions a{color:#2980B9;text-decoration:none}.rst-versions .rst-badge-small{display:none}.rst-versions .rst-current-version{padding:12px;background-color:#272525;display:block;text-align:right;font-size:90%;cursor:pointer;color:#27AE60}.rst-versions .rst-current-version::after{clear:both;content:"";display:block}.rst-versions .rst-current-version .fa{color:#fcfcfc}.rst-versions .rst-current-version .fa-book{float:left}.rst-versions .rst-current-version .icon-book{float:left}.rst-versions .rst-current-version.rst-out-of-date{background-color:#E74C3C;color:#fff}.rst-versions .rst-current-version.rst-active-old-version{background-color:#F1C40F;color:#000}.rst-versions.shift-up{height:auto;max-height:100%;overflow-y:scroll}.rst-versions.shift-up .rst-other-versions{display:block}.rst-versions .rst-other-versions{font-size:90%;padding:12px;color:gray;display:none}.rst-versions .rst-other-versions hr{display:block;height:1px;border:0;margin:20px 0;padding:0;border-top:solid 1px #413d3d}.rst-versions .rst-other-versions dd{display:inline-block;margin:0}.rst-versions .rst-other-versions dd a{display:inline-block;padding:6px;color:#fcfcfc}.rst-versions.rst-badge{width:auto;bottom:20px;right:20px;left:auto;border:none;max-width:300px;max-height:90%}.rst-versions.rst-badge .icon-book{float:none;line-height:30px}.rst-versions.rst-badge .fa-book{float:none;line-height:30px}.rst-versions.rst-badge.shift-up .rst-current-version{text-align:right}.rst-versions.rst-badge.shift-up .rst-current-version .fa-book{float:left}.rst-versions.rst-badge.shift-up .rst-current-version .icon-book{float:left}.rst-versions.rst-badge>.rst-current-version{width:auto;height:30px;line-height:30px;padding:0 6px;display:block;text-align:center}@media screen and (max-width: 768px){.rst-versions{width:85%;display:none}.rst-versions.shift{display:block}}
diff --git a/_static/css/thebastion.css b/_static/css/thebastion.css
new file mode 100644
index 000000000..10cf121fc
--- /dev/null
+++ b/_static/css/thebastion.css
@@ -0,0 +1,11 @@
+@import 'theme.css';
+
+.cmdusage .last {
+    font-family: SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;
+    white-space: nowrap;
+    font-size: 75%;
+}
+
+.wy-nav-content {
+    max-width: 1000px;
+}
diff --git a/_static/css/theme.css b/_static/css/theme.css
new file mode 100644
index 000000000..40606a86c
--- /dev/null
+++ b/_static/css/theme.css
@@ -0,0 +1,4 @@
+html{box-sizing:border-box}*,*::after,*::before{box-sizing:inherit}article,aside,details,figcaption,figure,footer,header,hgroup,nav,section{display:block}audio,canvas,video{display:inline-block;*display:inline;*zoom:1}audio:not([controls]){display:none}[hidden]{display:none}*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}a:hover,a:active{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}blockquote{margin:0}dfn{font-style:italic}ins{background:#ff9;color:#000;text-decoration:none}mark{background:#ff0;color:#000;font-style:italic;font-weight:bold}pre,code,.rst-content tt,.rst-content code,kbd,samp{font-family:monospace,serif;_font-family:"courier new",monospace;font-size:1em}pre{white-space:pre}q{quotes:none}q:before,q:after{content:"";content:none}small{font-size:85%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}ul,ol,dl{margin:0;padding:0;list-style:none;list-style-image:none}li{list-style:none}dd{margin:0}img{border:0;-ms-interpolation-mode:bicubic;vertical-align:middle;max-width:100%}svg:not(:root){overflow:hidden}figure{margin:0}form{margin:0}fieldset{border:0;margin:0;padding:0}label{cursor:pointer}legend{border:0;*margin-left:-7px;padding:0;white-space:normal}button,input,select,textarea{font-size:100%;margin:0;vertical-align:baseline;*vertical-align:middle}button,input{line-height:normal}button,input[type="button"],input[type="reset"],input[type="submit"]{cursor:pointer;-webkit-appearance:button;*overflow:visible}button[disabled],input[disabled]{cursor:default}input[type="checkbox"],input[type="radio"]{box-sizing:border-box;padding:0;*width:13px;*height:13px}input[type="search"]{-webkit-appearance:textfield;-moz-box-sizing:content-box;-webkit-box-sizing:content-box;box-sizing:content-box}input[type="search"]::-webkit-search-decoration,input[type="search"]::-webkit-search-cancel-button{-webkit-appearance:none}button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}textarea{overflow:auto;vertical-align:top;resize:vertical}table{border-collapse:collapse;border-spacing:0}td{vertical-align:top}.chromeframe{margin:.2em 0;background:#ccc;color:#000;padding:.2em 0}.ir{display:block;border:0;text-indent:-999em;overflow:hidden;background-color:transparent;background-repeat:no-repeat;text-align:left;direction:ltr;*line-height:0}.ir br{display:none}.hidden{display:none !important;visibility:hidden}.visuallyhidden{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.visuallyhidden.focusable:active,.visuallyhidden.focusable:focus{clip:auto;height:auto;margin:0;overflow:visible;position:static;width:auto}.invisible{visibility:hidden}.relative{position:relative}big,small{font-size:100%}@media print{html,body,section{background:none !important}*{box-shadow:none !important;text-shadow:none !important;filter:none !important;-ms-filter:none !important}a,a:visited{text-decoration:underline}.ir a:after,a[href^="javascript:"]:after,a[href^="#"]:after{content:""}pre,blockquote{page-break-inside:avoid}thead{display:table-header-group}tr,img{page-break-inside:avoid}img{max-width:100% !important}@page{margin:.5cm}p,h2,.rst-content .toctree-wrapper>p.caption,h3{orphans:3;widows:3}h2,.rst-content .toctree-wrapper>p.caption,h3{page-break-after:avoid}}.fa:before,.wy-menu-vertical li button.toctree-expand:before,.wy-menu-vertical li.on a button.toctree-expand:before,.wy-menu-vertical li.current>a button.toctree-expand:before,.rst-content .admonition-title:before,.rst-content h1 .headerlink:before,.rst-content h2 .headerlink:before,.rst-content h3 .headerlink:before,.rst-content h4 .headerlink:before,.rst-content h5 .headerlink:before,.rst-content h6 .headerlink:before,.rst-content dl dt .headerlink:before,.rst-content p .headerlink:before,.rst-content p.caption .headerlink:before,.rst-content table>caption .headerlink:before,.rst-content .code-block-caption .headerlink:before,.rst-content .eqno .headerlink:before,.rst-content tt.download span:first-child:before,.rst-content code.download span:first-child:before,.icon:before,.wy-dropdown .caret:before,.wy-inline-validate.wy-inline-validate-success .wy-input-context:before,.wy-inline-validate.wy-inline-validate-danger .wy-input-context:before,.wy-inline-validate.wy-inline-validate-warning .wy-input-context:before,.wy-inline-validate.wy-inline-validate-info .wy-input-context:before,.wy-alert,.rst-content .note,.rst-content .attention,.rst-content .caution,.rst-content .danger,.rst-content .error,.rst-content .hint,.rst-content .important,.rst-content .tip,.rst-content .warning,.rst-content .seealso,.rst-content .admonition-todo,.rst-content .admonition,.btn,input[type="text"],input[type="password"],input[type="email"],input[type="url"],input[type="date"],input[type="month"],input[type="time"],input[type="datetime"],input[type="datetime-local"],input[type="week"],input[type="number"],input[type="search"],input[type="tel"],input[type="color"],select,textarea,.wy-menu-vertical li.on a,.wy-menu-vertical li.current>a,.wy-side-nav-search>a,.wy-side-nav-search .wy-dropdown>a,.wy-nav-top a{-webkit-font-smoothing:antialiased}.clearfix{*zoom:1}.clearfix:before,.clearfix:after{display:table;content:""}.clearfix:after{clear:both}/*!
+ *  Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
+ *  License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
+ */@font-face{font-family:'FontAwesome';src:url("../fonts/fontawesome-webfont.eot?v=4.7.0");src:url("../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0") format("embedded-opentype"),url("../fonts/fontawesome-webfont.woff2?v=4.7.0") format("woff2"),url("../fonts/fontawesome-webfont.woff?v=4.7.0") format("woff"),url("../fonts/fontawesome-webfont.ttf?v=4.7.0") format("truetype"),url("../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular") format("svg");font-weight:normal;font-style:normal}.fa,.wy-menu-vertical li button.toctree-expand,.wy-menu-vertical li.on a button.toctree-expand,.wy-menu-vertical li.current>a button.toctree-expand,.rst-content .admonition-title,.rst-content h1 .headerlink,.rst-content h2 .headerlink,.rst-content h3 .headerlink,.rst-content h4 .headerlink,.rst-content h5 .headerlink,.rst-content h6 .headerlink,.rst-content dl dt .headerlink,.rst-content p .headerlink,.rst-content p.caption .headerlink,.rst-content table>caption .headerlink,.rst-content .code-block-caption .headerlink,.rst-content .eqno .headerlink,.rst-content tt.download span:first-child,.rst-content code.download span:first-child,.icon{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.3333333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.2857142857em;text-align:center}.fa-ul{padding-left:0;margin-left:2.1428571429em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.1428571429em;width:2.1428571429em;top:.1428571429em;text-align:center}.fa-li.fa-lg{left:-1.8571428571em}.fa-border{padding:.2em .25em .15em;border:solid 0.08em #eee;border-radius:.1em}.fa-pull-left{float:left}.fa-pull-right{float:right}.fa.fa-pull-left,.wy-menu-vertical li button.fa-pull-left.toctree-expand,.wy-menu-vertical li.on a button.fa-pull-left.toctree-expand,.wy-menu-vertical li.current>a button.fa-pull-left.toctree-expand,.rst-content .fa-pull-left.admonition-title,.rst-content h1 .fa-pull-left.headerlink,.rst-content h2 .fa-pull-left.headerlink,.rst-content h3 .fa-pull-left.headerlink,.rst-content h4 .fa-pull-left.headerlink,.rst-content h5 .fa-pull-left.headerlink,.rst-content h6 .fa-pull-left.headerlink,.rst-content dl dt .fa-pull-left.headerlink,.rst-content p .fa-pull-left.headerlink,.rst-content table>caption .fa-pull-left.headerlink,.rst-content .code-block-caption .fa-pull-left.headerlink,.rst-content .eqno .fa-pull-left.headerlink,.rst-content tt.download span.fa-pull-left:first-child,.rst-content code.download span.fa-pull-left:first-child,.fa-pull-left.icon{margin-right:.3em}.fa.fa-pull-right,.wy-menu-vertical li button.fa-pull-right.toctree-expand,.wy-menu-vertical li.on a button.fa-pull-right.toctree-expand,.wy-menu-vertical li.current>a button.fa-pull-right.toctree-expand,.rst-content .fa-pull-right.admonition-title,.rst-content h1 .fa-pull-right.headerlink,.rst-content h2 .fa-pull-right.headerlink,.rst-content h3 .fa-pull-right.headerlink,.rst-content h4 .fa-pull-right.headerlink,.rst-content h5 .fa-pull-right.headerlink,.rst-content h6 .fa-pull-right.headerlink,.rst-content dl dt .fa-pull-right.headerlink,.rst-content p .fa-pull-right.headerlink,.rst-content table>caption .fa-pull-right.headerlink,.rst-content .code-block-caption .fa-pull-right.headerlink,.rst-content .eqno .fa-pull-right.headerlink,.rst-content tt.download span.fa-pull-right:first-child,.rst-content code.download span.fa-pull-right:first-child,.fa-pull-right.icon{margin-left:.3em}.pull-right{float:right}.pull-left{float:left}.fa.pull-left,.wy-menu-vertical li button.pull-left.toctree-expand,.wy-menu-vertical li.on a button.pull-left.toctree-expand,.wy-menu-vertical li.current>a button.pull-left.toctree-expand,.rst-content .pull-left.admonition-title,.rst-content h1 .pull-left.headerlink,.rst-content h2 .pull-left.headerlink,.rst-content h3 .pull-left.headerlink,.rst-content h4 .pull-left.headerlink,.rst-content h5 .pull-left.headerlink,.rst-content h6 .pull-left.headerlink,.rst-content dl dt .pull-left.headerlink,.rst-content p .pull-left.headerlink,.rst-content table>caption .pull-left.headerlink,.rst-content .code-block-caption .pull-left.headerlink,.rst-content .eqno .pull-left.headerlink,.rst-content tt.download span.pull-left:first-child,.rst-content code.download span.pull-left:first-child,.pull-left.icon{margin-right:.3em}.fa.pull-right,.wy-menu-vertical li button.pull-right.toctree-expand,.wy-menu-vertical li.on a button.pull-right.toctree-expand,.wy-menu-vertical li.current>a button.pull-right.toctree-expand,.rst-content .pull-right.admonition-title,.rst-content h1 .pull-right.headerlink,.rst-content h2 .pull-right.headerlink,.rst-content h3 .pull-right.headerlink,.rst-content h4 .pull-right.headerlink,.rst-content h5 .pull-right.headerlink,.rst-content h6 .pull-right.headerlink,.rst-content dl dt .pull-right.headerlink,.rst-content p .pull-right.headerlink,.rst-content table>caption .pull-right.headerlink,.rst-content .code-block-caption .pull-right.headerlink,.rst-content .eqno .pull-right.headerlink,.rst-content tt.download span.pull-right:first-child,.rst-content code.download span.pull-right:first-child,.pull-right.icon{margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:fa-spin 2s infinite linear}.fa-pulse{-webkit-animation:fa-spin 1s infinite steps(8);animation:fa-spin 1s infinite steps(8)}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);-ms-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";-webkit-transform:rotate(270deg);-ms-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";-webkit-transform:scale(-1, 1);-ms-transform:scale(-1, 1);transform:scale(-1, 1)}.fa-flip-vertical{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";-webkit-transform:scale(1, -1);-ms-transform:scale(1, -1);transform:scale(1, -1)}:root .fa-rotate-90,:root .fa-rotate-180,:root .fa-rotate-270,:root .fa-flip-horizontal,:root .fa-flip-vertical{filter:none}.fa-stack{position:relative;display:inline-block;width:2em;height:2em;line-height:2em;vertical-align:middle}.fa-stack-1x,.fa-stack-2x{position:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:""}.fa-music:before{content:""}.fa-search:before,.icon-search:before{content:""}.fa-envelope-o:before{content:""}.fa-heart:before{content:""}.fa-star:before{content:""}.fa-star-o:before{content:""}.fa-user:before{content:""}.fa-film:before{content:""}.fa-th-large:before{content:""}.fa-th:before{content:""}.fa-th-list:before{content:""}.fa-check:before{content:""}.fa-remove:before,.fa-close:before,.fa-times:before{content:""}.fa-search-plus:before{content:""}.fa-search-minus:before{content:""}.fa-power-off:before{content:""}.fa-signal:before{content:""}.fa-gear:before,.fa-cog:before{content:""}.fa-trash-o:before{content:""}.fa-home:before,.icon-home:before{content:""}.fa-file-o:before{content:""}.fa-clock-o:before{content:""}.fa-road:before{content:""}.fa-download:before,.rst-content tt.download span:first-child:before,.rst-content code.download span:first-child:before{content:""}.fa-arrow-circle-o-down:before{content:""}.fa-arrow-circle-o-up:before{content:""}.fa-inbox:before{content:""}.fa-play-circle-o:before{content:""}.fa-rotate-right:before,.fa-repeat:before{content:""}.fa-refresh:before{content:""}.fa-list-alt:before{content:""}.fa-lock:before{content:""}.fa-flag:before{content:""}.fa-headphones:before{content:""}.fa-volume-off:before{content:""}.fa-volume-down:before{content:""}.fa-volume-up:before{content:""}.fa-qrcode:before{content:""}.fa-barcode:before{content:""}.fa-tag:before{content:""}.fa-tags:before{content:""}.fa-book:before,.icon-book:before{content:""}.fa-bookmark:before{content:""}.fa-print:before{content:""}.fa-camera:before{content:""}.fa-font:before{content:""}.fa-bold:before{content:""}.fa-italic:before{content:""}.fa-text-height:before{content:""}.fa-text-width:before{content:""}.fa-align-left:before{content:""}.fa-align-center:before{content:""}.fa-align-right:before{content:""}.fa-align-justify:before{content:""}.fa-list:before{content:""}.fa-dedent:before,.fa-outdent:before{content:""}.fa-indent:before{content:""}.fa-video-camera:before{content:""}.fa-photo:before,.fa-image:before,.fa-picture-o:before{content:""}.fa-pencil:before{content:""}.fa-map-marker:before{content:""}.fa-adjust:before{content:""}.fa-tint:before{content:""}.fa-edit:before,.fa-pencil-square-o:before{content:""}.fa-share-square-o:before{content:""}.fa-check-square-o:before{content:""}.fa-arrows:before{content:""}.fa-step-backward:before{content:""}.fa-fast-backward:before{content:""}.fa-backward:before{content:""}.fa-play:before{content:""}.fa-pause:before{content:""}.fa-stop:before{content:""}.fa-forward:before{content:""}.fa-fast-forward:before{content:""}.fa-step-forward:before{content:""}.fa-eject:before{content:""}.fa-chevron-left:before{content:""}.fa-chevron-right:before{content:""}.fa-plus-circle:before{content:""}.fa-minus-circle:before{content:""}.fa-times-circle:before,.wy-inline-validate.wy-inline-validate-danger .wy-input-context:before{content:""}.fa-check-circle:before,.wy-inline-validate.wy-inline-validate-success .wy-input-context:before{content:""}.fa-question-circle:before{content:""}.fa-info-circle:before{content:""}.fa-crosshairs:before{content:""}.fa-times-circle-o:before{content:""}.fa-check-circle-o:before{content:""}.fa-ban:before{content:""}.fa-arrow-left:before{content:""}.fa-arrow-right:before{content:""}.fa-arrow-up:before{content:""}.fa-arrow-down:before{content:""}.fa-mail-forward:before,.fa-share:before{content:""}.fa-expand:before{content:""}.fa-compress:before{content:""}.fa-plus:before{content:""}.fa-minus:before{content:""}.fa-asterisk:before{content:""}.fa-exclamation-circle:before,.wy-inline-validate.wy-inline-validate-warning .wy-input-context:before,.wy-inline-validate.wy-inline-validate-info .wy-input-context:before,.rst-content .admonition-title:before{content:""}.fa-gift:before{content:""}.fa-leaf:before{content:""}.fa-fire:before,.icon-fire:before{content:""}.fa-eye:before{content:""}.fa-eye-slash:before{content:""}.fa-warning:before,.fa-exclamation-triangle:before{content:""}.fa-plane:before{content:""}.fa-calendar:before{content:""}.fa-random:before{content:""}.fa-comment:before{content:""}.fa-magnet:before{content:""}.fa-chevron-up:before{content:""}.fa-chevron-down:before{content:""}.fa-retweet:before{content:""}.fa-shopping-cart:before{content:""}.fa-folder:before{content:""}.fa-folder-open:before{content:""}.fa-arrows-v:before{content:""}.fa-arrows-h:before{content:""}.fa-bar-chart-o:before,.fa-bar-chart:before{content:""}.fa-twitter-square:before{content:""}.fa-facebook-square:before{content:""}.fa-camera-retro:before{content:""}.fa-key:before{content:""}.fa-gears:before,.fa-cogs:before{content:""}.fa-comments:before{content:""}.fa-thumbs-o-up:before{content:""}.fa-thumbs-o-down:before{content:""}.fa-star-half:before{content:""}.fa-heart-o:before{content:""}.fa-sign-out:before{content:""}.fa-linkedin-square:before{content:""}.fa-thumb-tack:before{content:""}.fa-external-link:before{content:""}.fa-sign-in:before{content:""}.fa-trophy:before{content:""}.fa-github-square:before{content:""}.fa-upload:before{content:""}.fa-lemon-o:before{content:""}.fa-phone:before{content:""}.fa-square-o:before{content:""}.fa-bookmark-o:before{content:""}.fa-phone-square:before{content:""}.fa-twitter:before{content:""}.fa-facebook-f:before,.fa-facebook:before{content:""}.fa-github:before,.icon-github:before{content:""}.fa-unlock:before{content:""}.fa-credit-card:before{content:""}.fa-feed:before,.fa-rss:before{content:""}.fa-hdd-o:before{content:""}.fa-bullhorn:before{content:""}.fa-bell:before{content:""}.fa-certificate:before{content:""}.fa-hand-o-right:before{content:""}.fa-hand-o-left:before{content:""}.fa-hand-o-up:before{content:""}.fa-hand-o-down:before{content:""}.fa-arrow-circle-left:before,.icon-circle-arrow-left:before{content:""}.fa-arrow-circle-right:before,.icon-circle-arrow-right:before{content:""}.fa-arrow-circle-up:before{content:""}.fa-arrow-circle-down:before{content:""}.fa-globe:before{content:""}.fa-wrench:before{content:""}.fa-tasks:before{content:""}.fa-filter:before{content:""}.fa-briefcase:before{content:""}.fa-arrows-alt:before{content:""}.fa-group:before,.fa-users:before{content:""}.fa-chain:before,.fa-link:before,.icon-link:before{content:""}.fa-cloud:before{content:""}.fa-flask:before{content:""}.fa-cut:before,.fa-scissors:before{content:""}.fa-copy:before,.fa-files-o:before{content:""}.fa-paperclip:before{content:""}.fa-save:before,.fa-floppy-o:before{content:""}.fa-square:before{content:""}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:""}.fa-list-ul:before{content:""}.fa-list-ol:before{content:""}.fa-strikethrough:before{content:""}.fa-underline:before{content:""}.fa-table:before{content:""}.fa-magic:before{content:""}.fa-truck:before{content:""}.fa-pinterest:before{content:""}.fa-pinterest-square:before{content:""}.fa-google-plus-square:before{content:""}.fa-google-plus:before{content:""}.fa-money:before{content:""}.fa-caret-down:before,.wy-dropdown .caret:before,.icon-caret-down:before{content:""}.fa-caret-up:before{content:""}.fa-caret-left:before{content:""}.fa-caret-right:before{content:""}.fa-columns:before{content:""}.fa-unsorted:before,.fa-sort:before{content:""}.fa-sort-down:before,.fa-sort-desc:before{content:""}.fa-sort-up:before,.fa-sort-asc:before{content:""}.fa-envelope:before{content:""}.fa-linkedin:before{content:""}.fa-rotate-left:before,.fa-undo:before{content:""}.fa-legal:before,.fa-gavel:before{content:""}.fa-dashboard:before,.fa-tachometer:before{content:""}.fa-comment-o:before{content:""}.fa-comments-o:before{content:""}.fa-flash:before,.fa-bolt:before{content:""}.fa-sitemap:before{content:""}.fa-umbrella:before{content:""}.fa-paste:before,.fa-clipboard:before{content:""}.fa-lightbulb-o:before{content:""}.fa-exchange:before{content:""}.fa-cloud-download:before{content:""}.fa-cloud-upload:before{content:""}.fa-user-md:before{content:""}.fa-stethoscope:before{content:""}.fa-suitcase:before{content:""}.fa-bell-o:before{content:""}.fa-coffee:before{content:""}.fa-cutlery:before{content:""}.fa-file-text-o:before{content:""}.fa-building-o:before{content:""}.fa-hospital-o:before{content:""}.fa-ambulance:before{content:""}.fa-medkit:before{content:""}.fa-fighter-jet:before{content:""}.fa-beer:before{content:""}.fa-h-square:before{content:""}.fa-plus-square:before{content:""}.fa-angle-double-left:before{content:""}.fa-angle-double-right:before{content:""}.fa-angle-double-up:before{content:""}.fa-angle-double-down:before{content:""}.fa-angle-left:before{content:""}.fa-angle-right:before{content:""}.fa-angle-up:before{content:""}.fa-angle-down:before{content:""}.fa-desktop:before{content:""}.fa-laptop:before{content:""}.fa-tablet:before{content:""}.fa-mobile-phone:before,.fa-mobile:before{content:""}.fa-circle-o:before{content:""}.fa-quote-left:before{content:""}.fa-quote-right:before{content:""}.fa-spinner:before{content:""}.fa-circle:before{content:""}.fa-mail-reply:before,.fa-reply:before{content:""}.fa-github-alt:before{content:""}.fa-folder-o:before{content:""}.fa-folder-open-o:before{content:""}.fa-smile-o:before{content:""}.fa-frown-o:before{content:""}.fa-meh-o:before{content:""}.fa-gamepad:before{content:""}.fa-keyboard-o:before{content:""}.fa-flag-o:before{content:""}.fa-flag-checkered:before{content:""}.fa-terminal:before{content:""}.fa-code:before{content:""}.fa-mail-reply-all:before,.fa-reply-all:before{content:""}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:before{content:""}.fa-location-arrow:before{content:""}.fa-crop:before{content:""}.fa-code-fork:before{content:""}.fa-unlink:before,.fa-chain-broken:before{content:""}.fa-question:before{content:""}.fa-info:before{content:""}.fa-exclamation:before{content:""}.fa-superscript:before{content:""}.fa-subscript:before{content:""}.fa-eraser:before{content:""}.fa-puzzle-piece:before{content:""}.fa-microphone:before{content:""}.fa-microphone-slash:before{content:""}.fa-shield:before{content:""}.fa-calendar-o:before{content:""}.fa-fire-extinguisher:before{content:""}.fa-rocket:before{content:""}.fa-maxcdn:before{content:""}.fa-chevron-circle-left:before{content:""}.fa-chevron-circle-right:before{content:""}.fa-chevron-circle-up:before{content:""}.fa-chevron-circle-down:before{content:""}.fa-html5:before{content:""}.fa-css3:before{content:""}.fa-anchor:before{content:""}.fa-unlock-alt:before{content:""}.fa-bullseye:before{content:""}.fa-ellipsis-h:before{content:""}.fa-ellipsis-v:before{content:""}.fa-rss-square:before{content:""}.fa-play-circle:before{content:""}.fa-ticket:before{content:""}.fa-minus-square:before{content:""}.fa-minus-square-o:before,.wy-menu-vertical li.on a button.toctree-expand:before,.wy-menu-vertical li.current>a button.toctree-expand:before{content:""}.fa-level-up:before{content:""}.fa-level-down:before{content:""}.fa-check-square:before{content:""}.fa-pencil-square:before{content:""}.fa-external-link-square:before{content:""}.fa-share-square:before{content:""}.fa-compass:before{content:""}.fa-toggle-down:before,.fa-caret-square-o-down:before{content:""}.fa-toggle-up:before,.fa-caret-square-o-up:before{content:""}.fa-toggle-right:before,.fa-caret-square-o-right:before{content:""}.fa-euro:before,.fa-eur:before{content:""}.fa-gbp:before{content:""}.fa-dollar:before,.fa-usd:before{content:""}.fa-rupee:before,.fa-inr:before{content:""}.fa-cny:before,.fa-rmb:before,.fa-yen:before,.fa-jpy:before{content:""}.fa-ruble:before,.fa-rouble:before,.fa-rub:before{content:""}.fa-won:before,.fa-krw:before{content:""}.fa-bitcoin:before,.fa-btc:before{content:""}.fa-file:before{content:""}.fa-file-text:before{content:""}.fa-sort-alpha-asc:before{content:""}.fa-sort-alpha-desc:before{content:""}.fa-sort-amount-asc:before{content:""}.fa-sort-amount-desc:before{content:""}.fa-sort-numeric-asc:before{content:""}.fa-sort-numeric-desc:before{content:""}.fa-thumbs-up:before{content:""}.fa-thumbs-down:before{content:""}.fa-youtube-square:before{content:""}.fa-youtube:before{content:""}.fa-xing:before{content:""}.fa-xing-square:before{content:""}.fa-youtube-play:before{content:""}.fa-dropbox:before{content:""}.fa-stack-overflow:before{content:""}.fa-instagram:before{content:""}.fa-flickr:before{content:""}.fa-adn:before{content:""}.fa-bitbucket:before,.icon-bitbucket:before{content:""}.fa-bitbucket-square:before{content:""}.fa-tumblr:before{content:""}.fa-tumblr-square:before{content:""}.fa-long-arrow-down:before{content:""}.fa-long-arrow-up:before{content:""}.fa-long-arrow-left:before{content:""}.fa-long-arrow-right:before{content:""}.fa-apple:before{content:""}.fa-windows:before{content:""}.fa-android:before{content:""}.fa-linux:before{content:""}.fa-dribbble:before{content:""}.fa-skype:before{content:""}.fa-foursquare:before{content:""}.fa-trello:before{content:""}.fa-female:before{content:""}.fa-male:before{content:""}.fa-gittip:before,.fa-gratipay:before{content:""}.fa-sun-o:before{content:""}.fa-moon-o:before{content:""}.fa-archive:before{content:""}.fa-bug:before{content:""}.fa-vk:before{content:""}.fa-weibo:before{content:""}.fa-renren:before{content:""}.fa-pagelines:before{content:""}.fa-stack-exchange:before{content:""}.fa-arrow-circle-o-right:before{content:""}.fa-arrow-circle-o-left:before{content:""}.fa-toggle-left:before,.fa-caret-square-o-left:before{content:""}.fa-dot-circle-o:before{content:""}.fa-wheelchair:before{content:""}.fa-vimeo-square:before{content:""}.fa-turkish-lira:before,.fa-try:before{content:""}.fa-plus-square-o:before,.wy-menu-vertical li button.toctree-expand:before{content:""}.fa-space-shuttle:before{content:""}.fa-slack:before{content:""}.fa-envelope-square:before{content:""}.fa-wordpress:before{content:""}.fa-openid:before{content:""}.fa-institution:before,.fa-bank:before,.fa-university:before{content:""}.fa-mortar-board:before,.fa-graduation-cap:before{content:""}.fa-yahoo:before{content:""}.fa-google:before{content:""}.fa-reddit:before{content:""}.fa-reddit-square:before{content:""}.fa-stumbleupon-circle:before{content:""}.fa-stumbleupon:before{content:""}.fa-delicious:before{content:""}.fa-digg:before{content:""}.fa-pied-piper-pp:before{content:""}.fa-pied-piper-alt:before{content:""}.fa-drupal:before{content:""}.fa-joomla:before{content:""}.fa-language:before{content:""}.fa-fax:before{content:""}.fa-building:before{content:""}.fa-child:before{content:""}.fa-paw:before{content:""}.fa-spoon:before{content:""}.fa-cube:before{content:""}.fa-cubes:before{content:""}.fa-behance:before{content:""}.fa-behance-square:before{content:""}.fa-steam:before{content:""}.fa-steam-square:before{content:""}.fa-recycle:before{content:""}.fa-automobile:before,.fa-car:before{content:""}.fa-cab:before,.fa-taxi:before{content:""}.fa-tree:before{content:""}.fa-spotify:before{content:""}.fa-deviantart:before{content:""}.fa-soundcloud:before{content:""}.fa-database:before{content:""}.fa-file-pdf-o:before{content:""}.fa-file-word-o:before{content:""}.fa-file-excel-o:before{content:""}.fa-file-powerpoint-o:before{content:""}.fa-file-photo-o:before,.fa-file-picture-o:before,.fa-file-image-o:before{content:""}.fa-file-zip-o:before,.fa-file-archive-o:before{content:""}.fa-file-sound-o:before,.fa-file-audio-o:before{content:""}.fa-file-movie-o:before,.fa-file-video-o:before{content:""}.fa-file-code-o:before{content:""}.fa-vine:before{content:""}.fa-codepen:before{content:""}.fa-jsfiddle:before{content:""}.fa-life-bouy:before,.fa-life-buoy:before,.fa-life-saver:before,.fa-support:before,.fa-life-ring:before{content:""}.fa-circle-o-notch:before{content:""}.fa-ra:before,.fa-resistance:before,.fa-rebel:before{content:""}.fa-ge:before,.fa-empire:before{content:""}.fa-git-square:before{content:""}.fa-git:before{content:""}.fa-y-combinator-square:before,.fa-yc-square:before,.fa-hacker-news:before{content:""}.fa-tencent-weibo:before{content:""}.fa-qq:before{content:""}.fa-wechat:before,.fa-weixin:before{content:""}.fa-send:before,.fa-paper-plane:before{content:""}.fa-send-o:before,.fa-paper-plane-o:before{content:""}.fa-history:before{content:""}.fa-circle-thin:before{content:""}.fa-header:before{content:""}.fa-paragraph:before{content:""}.fa-sliders:before{content:""}.fa-share-alt:before{content:""}.fa-share-alt-square:before{content:""}.fa-bomb:before{content:""}.fa-soccer-ball-o:before,.fa-futbol-o:before{content:""}.fa-tty:before{content:""}.fa-binoculars:before{content:""}.fa-plug:before{content:""}.fa-slideshare:before{content:""}.fa-twitch:before{content:""}.fa-yelp:before{content:""}.fa-newspaper-o:before{content:""}.fa-wifi:before{content:""}.fa-calculator:before{content:""}.fa-paypal:before{content:""}.fa-google-wallet:before{content:""}.fa-cc-visa:before{content:""}.fa-cc-mastercard:before{content:""}.fa-cc-discover:before{content:""}.fa-cc-amex:before{content:""}.fa-cc-paypal:before{content:""}.fa-cc-stripe:before{content:""}.fa-bell-slash:before{content:""}.fa-bell-slash-o:before{content:""}.fa-trash:before{content:""}.fa-copyright:before{content:""}.fa-at:before{content:""}.fa-eyedropper:before{content:""}.fa-paint-brush:before{content:""}.fa-birthday-cake:before{content:""}.fa-area-chart:before{content:""}.fa-pie-chart:before{content:""}.fa-line-chart:before{content:""}.fa-lastfm:before{content:""}.fa-lastfm-square:before{content:""}.fa-toggle-off:before{content:""}.fa-toggle-on:before{content:""}.fa-bicycle:before{content:""}.fa-bus:before{content:""}.fa-ioxhost:before{content:""}.fa-angellist:before{content:""}.fa-cc:before{content:""}.fa-shekel:before,.fa-sheqel:before,.fa-ils:before{content:""}.fa-meanpath:before{content:""}.fa-buysellads:before{content:""}.fa-connectdevelop:before{content:""}.fa-dashcube:before{content:""}.fa-forumbee:before{content:""}.fa-leanpub:before{content:""}.fa-sellsy:before{content:""}.fa-shirtsinbulk:before{content:""}.fa-simplybuilt:before{content:""}.fa-skyatlas:before{content:""}.fa-cart-plus:before{content:""}.fa-cart-arrow-down:before{content:""}.fa-diamond:before{content:""}.fa-ship:before{content:""}.fa-user-secret:before{content:""}.fa-motorcycle:before{content:""}.fa-street-view:before{content:""}.fa-heartbeat:before{content:""}.fa-venus:before{content:""}.fa-mars:before{content:""}.fa-mercury:before{content:""}.fa-intersex:before,.fa-transgender:before{content:""}.fa-transgender-alt:before{content:""}.fa-venus-double:before{content:""}.fa-mars-double:before{content:""}.fa-venus-mars:before{content:""}.fa-mars-stroke:before{content:""}.fa-mars-stroke-v:before{content:""}.fa-mars-stroke-h:before{content:""}.fa-neuter:before{content:""}.fa-genderless:before{content:""}.fa-facebook-official:before{content:""}.fa-pinterest-p:before{content:""}.fa-whatsapp:before{content:""}.fa-server:before{content:""}.fa-user-plus:before{content:""}.fa-user-times:before{content:""}.fa-hotel:before,.fa-bed:before{content:""}.fa-viacoin:before{content:""}.fa-train:before{content:""}.fa-subway:before{content:""}.fa-medium:before{content:""}.fa-yc:before,.fa-y-combinator:before{content:""}.fa-optin-monster:before{content:""}.fa-opencart:before{content:""}.fa-expeditedssl:before{content:""}.fa-battery-4:before,.fa-battery:before,.fa-battery-full:before{content:""}.fa-battery-3:before,.fa-battery-three-quarters:before{content:""}.fa-battery-2:before,.fa-battery-half:before{content:""}.fa-battery-1:before,.fa-battery-quarter:before{content:""}.fa-battery-0:before,.fa-battery-empty:before{content:""}.fa-mouse-pointer:before{content:""}.fa-i-cursor:before{content:""}.fa-object-group:before{content:""}.fa-object-ungroup:before{content:""}.fa-sticky-note:before{content:""}.fa-sticky-note-o:before{content:""}.fa-cc-jcb:before{content:""}.fa-cc-diners-club:before{content:""}.fa-clone:before{content:""}.fa-balance-scale:before{content:""}.fa-hourglass-o:before{content:""}.fa-hourglass-1:before,.fa-hourglass-start:before{content:""}.fa-hourglass-2:before,.fa-hourglass-half:before{content:""}.fa-hourglass-3:before,.fa-hourglass-end:before{content:""}.fa-hourglass:before{content:""}.fa-hand-grab-o:before,.fa-hand-rock-o:before{content:""}.fa-hand-stop-o:before,.fa-hand-paper-o:before{content:""}.fa-hand-scissors-o:before{content:""}.fa-hand-lizard-o:before{content:""}.fa-hand-spock-o:before{content:""}.fa-hand-pointer-o:before{content:""}.fa-hand-peace-o:before{content:""}.fa-trademark:before{content:""}.fa-registered:before{content:""}.fa-creative-commons:before{content:""}.fa-gg:before{content:""}.fa-gg-circle:before{content:""}.fa-tripadvisor:before{content:""}.fa-odnoklassniki:before{content:""}.fa-odnoklassniki-square:before{content:""}.fa-get-pocket:before{content:""}.fa-wikipedia-w:before{content:""}.fa-safari:before{content:""}.fa-chrome:before{content:""}.fa-firefox:before{content:""}.fa-opera:before{content:""}.fa-internet-explorer:before{content:""}.fa-tv:before,.fa-television:before{content:""}.fa-contao:before{content:""}.fa-500px:before{content:""}.fa-amazon:before{content:""}.fa-calendar-plus-o:before{content:""}.fa-calendar-minus-o:before{content:""}.fa-calendar-times-o:before{content:""}.fa-calendar-check-o:before{content:""}.fa-industry:before{content:""}.fa-map-pin:before{content:""}.fa-map-signs:before{content:""}.fa-map-o:before{content:""}.fa-map:before{content:""}.fa-commenting:before{content:""}.fa-commenting-o:before{content:""}.fa-houzz:before{content:""}.fa-vimeo:before{content:""}.fa-black-tie:before{content:""}.fa-fonticons:before{content:""}.fa-reddit-alien:before{content:""}.fa-edge:before{content:""}.fa-credit-card-alt:before{content:""}.fa-codiepie:before{content:""}.fa-modx:before{content:""}.fa-fort-awesome:before{content:""}.fa-usb:before{content:""}.fa-product-hunt:before{content:""}.fa-mixcloud:before{content:""}.fa-scribd:before{content:""}.fa-pause-circle:before{content:""}.fa-pause-circle-o:before{content:""}.fa-stop-circle:before{content:""}.fa-stop-circle-o:before{content:""}.fa-shopping-bag:before{content:""}.fa-shopping-basket:before{content:""}.fa-hashtag:before{content:""}.fa-bluetooth:before{content:""}.fa-bluetooth-b:before{content:""}.fa-percent:before{content:""}.fa-gitlab:before,.icon-gitlab:before{content:""}.fa-wpbeginner:before{content:""}.fa-wpforms:before{content:""}.fa-envira:before{content:""}.fa-universal-access:before{content:""}.fa-wheelchair-alt:before{content:""}.fa-question-circle-o:before{content:""}.fa-blind:before{content:""}.fa-audio-description:before{content:""}.fa-volume-control-phone:before{content:""}.fa-braille:before{content:""}.fa-assistive-listening-systems:before{content:""}.fa-asl-interpreting:before,.fa-american-sign-language-interpreting:before{content:""}.fa-deafness:before,.fa-hard-of-hearing:before,.fa-deaf:before{content:""}.fa-glide:before{content:""}.fa-glide-g:before{content:""}.fa-signing:before,.fa-sign-language:before{content:""}.fa-low-vision:before{content:""}.fa-viadeo:before{content:""}.fa-viadeo-square:before{content:""}.fa-snapchat:before{content:""}.fa-snapchat-ghost:before{content:""}.fa-snapchat-square:before{content:""}.fa-pied-piper:before{content:""}.fa-first-order:before{content:""}.fa-yoast:before{content:""}.fa-themeisle:before{content:""}.fa-google-plus-circle:before,.fa-google-plus-official:before{content:""}.fa-fa:before,.fa-font-awesome:before{content:""}.fa-handshake-o:before{content:""}.fa-envelope-open:before{content:""}.fa-envelope-open-o:before{content:""}.fa-linode:before{content:""}.fa-address-book:before{content:""}.fa-address-book-o:before{content:""}.fa-vcard:before,.fa-address-card:before{content:""}.fa-vcard-o:before,.fa-address-card-o:before{content:""}.fa-user-circle:before{content:""}.fa-user-circle-o:before{content:""}.fa-user-o:before{content:""}.fa-id-badge:before{content:""}.fa-drivers-license:before,.fa-id-card:before{content:""}.fa-drivers-license-o:before,.fa-id-card-o:before{content:""}.fa-quora:before{content:""}.fa-free-code-camp:before{content:""}.fa-telegram:before{content:""}.fa-thermometer-4:before,.fa-thermometer:before,.fa-thermometer-full:before{content:""}.fa-thermometer-3:before,.fa-thermometer-three-quarters:before{content:""}.fa-thermometer-2:before,.fa-thermometer-half:before{content:""}.fa-thermometer-1:before,.fa-thermometer-quarter:before{content:""}.fa-thermometer-0:before,.fa-thermometer-empty:before{content:""}.fa-shower:before{content:""}.fa-bathtub:before,.fa-s15:before,.fa-bath:before{content:""}.fa-podcast:before{content:""}.fa-window-maximize:before{content:""}.fa-window-minimize:before{content:""}.fa-window-restore:before{content:""}.fa-times-rectangle:before,.fa-window-close:before{content:""}.fa-times-rectangle-o:before,.fa-window-close-o:before{content:""}.fa-bandcamp:before{content:""}.fa-grav:before{content:""}.fa-etsy:before{content:""}.fa-imdb:before{content:""}.fa-ravelry:before{content:""}.fa-eercast:before{content:""}.fa-microchip:before{content:""}.fa-snowflake-o:before{content:""}.fa-superpowers:before{content:""}.fa-wpexplorer:before{content:""}.fa-meetup:before{content:""}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0, 0, 0, 0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto}.fa,.wy-menu-vertical li button.toctree-expand,.wy-menu-vertical li.on a button.toctree-expand,.wy-menu-vertical li.current>a button.toctree-expand,.rst-content .admonition-title,.rst-content h1 .headerlink,.rst-content h2 .headerlink,.rst-content h3 .headerlink,.rst-content h4 .headerlink,.rst-content h5 .headerlink,.rst-content h6 .headerlink,.rst-content dl dt .headerlink,.rst-content p .headerlink,.rst-content p.caption .headerlink,.rst-content table>caption .headerlink,.rst-content .code-block-caption .headerlink,.rst-content .eqno .headerlink,.rst-content tt.download span:first-child,.rst-content code.download span:first-child,.icon,.wy-dropdown .caret,.wy-inline-validate.wy-inline-validate-success .wy-input-context,.wy-inline-validate.wy-inline-validate-danger .wy-input-context,.wy-inline-validate.wy-inline-validate-warning .wy-input-context,.wy-inline-validate.wy-inline-validate-info .wy-input-context{font-family:inherit}.fa:before,.wy-menu-vertical li button.toctree-expand:before,.wy-menu-vertical li.on a button.toctree-expand:before,.wy-menu-vertical li.current>a button.toctree-expand:before,.rst-content .admonition-title:before,.rst-content h1 .headerlink:before,.rst-content h2 .headerlink:before,.rst-content h3 .headerlink:before,.rst-content h4 .headerlink:before,.rst-content h5 .headerlink:before,.rst-content h6 .headerlink:before,.rst-content dl dt .headerlink:before,.rst-content p .headerlink:before,.rst-content p.caption .headerlink:before,.rst-content table>caption .headerlink:before,.rst-content .code-block-caption .headerlink:before,.rst-content .eqno .headerlink:before,.rst-content tt.download span:first-child:before,.rst-content code.download span:first-child:before,.icon:before,.wy-dropdown .caret:before,.wy-inline-validate.wy-inline-validate-success .wy-input-context:before,.wy-inline-validate.wy-inline-validate-danger .wy-input-context:before,.wy-inline-validate.wy-inline-validate-warning .wy-input-context:before,.wy-inline-validate.wy-inline-validate-info .wy-input-context:before{font-family:"FontAwesome";display:inline-block;font-style:normal;font-weight:normal;line-height:1;text-decoration:inherit}a .fa,a .wy-menu-vertical li button.toctree-expand,.wy-menu-vertical li a button.toctree-expand,.wy-menu-vertical li.on a button.toctree-expand,.wy-menu-vertical li.current>a button.toctree-expand,a .rst-content .admonition-title,.rst-content a .admonition-title,a .rst-content h1 .headerlink,.rst-content h1 a .headerlink,a .rst-content h2 .headerlink,.rst-content h2 a .headerlink,a .rst-content h3 .headerlink,.rst-content h3 a .headerlink,a .rst-content h4 .headerlink,.rst-content h4 a .headerlink,a .rst-content h5 .headerlink,.rst-content h5 a .headerlink,a .rst-content h6 .headerlink,.rst-content h6 a .headerlink,a .rst-content dl dt .headerlink,.rst-content dl dt a .headerlink,a .rst-content p .headerlink,.rst-content p a .headerlink,a .rst-content p.caption .headerlink,.rst-content p.caption a .headerlink,a .rst-content table>caption .headerlink,.rst-content table>caption a .headerlink,a .rst-content .code-block-caption .headerlink,.rst-content .code-block-caption a .headerlink,a .rst-content .eqno .headerlink,.rst-content .eqno a .headerlink,a .rst-content tt.download span:first-child,.rst-content tt.download a span:first-child,a .rst-content code.download span:first-child,.rst-content code.download a span:first-child,a .icon{display:inline-block;text-decoration:inherit}.btn .fa,.btn .wy-menu-vertical li button.toctree-expand,.wy-menu-vertical li .btn button.toctree-expand,.btn .wy-menu-vertical li.on a button.toctree-expand,.wy-menu-vertical li.on a .btn button.toctree-expand,.btn .wy-menu-vertical li.current>a button.toctree-expand,.wy-menu-vertical li.current>a .btn button.toctree-expand,.btn .rst-content .admonition-title,.rst-content .btn .admonition-title,.btn .rst-content h1 .headerlink,.rst-content h1 .btn .headerlink,.btn .rst-content h2 .headerlink,.rst-content h2 .btn .headerlink,.btn .rst-content h3 .headerlink,.rst-content h3 .btn .headerlink,.btn .rst-content h4 .headerlink,.rst-content h4 .btn .headerlink,.btn .rst-content h5 .headerlink,.rst-content h5 .btn .headerlink,.btn .rst-content h6 .headerlink,.rst-content h6 .btn .headerlink,.btn .rst-content dl dt .headerlink,.rst-content dl dt .btn .headerlink,.btn .rst-content p .headerlink,.rst-content p .btn .headerlink,.btn .rst-content table>caption .headerlink,.rst-content table>caption .btn .headerlink,.btn .rst-content .code-block-caption .headerlink,.rst-content .code-block-caption .btn .headerlink,.btn .rst-content .eqno .headerlink,.rst-content .eqno .btn .headerlink,.btn .rst-content tt.download span:first-child,.rst-content tt.download .btn span:first-child,.btn .rst-content code.download span:first-child,.rst-content code.download .btn span:first-child,.btn .icon,.nav .fa,.nav .wy-menu-vertical li button.toctree-expand,.wy-menu-vertical li .nav button.toctree-expand,.nav .wy-menu-vertical li.on a button.toctree-expand,.wy-menu-vertical li.on a .nav button.toctree-expand,.nav .wy-menu-vertical li.current>a button.toctree-expand,.wy-menu-vertical li.current>a .nav button.toctree-expand,.nav .rst-content .admonition-title,.rst-content .nav .admonition-title,.nav .rst-content h1 .headerlink,.rst-content h1 .nav .headerlink,.nav .rst-content h2 .headerlink,.rst-content h2 .nav .headerlink,.nav .rst-content h3 .headerlink,.rst-content h3 .nav .headerlink,.nav .rst-content h4 .headerlink,.rst-content h4 .nav .headerlink,.nav .rst-content h5 .headerlink,.rst-content h5 .nav .headerlink,.nav .rst-content h6 .headerlink,.rst-content h6 .nav .headerlink,.nav .rst-content dl dt .headerlink,.rst-content dl dt .nav .headerlink,.nav .rst-content p .headerlink,.rst-content p .nav .headerlink,.nav .rst-content table>caption .headerlink,.rst-content table>caption .nav .headerlink,.nav .rst-content .code-block-caption .headerlink,.rst-content .code-block-caption .nav .headerlink,.nav .rst-content .eqno .headerlink,.rst-content .eqno .nav .headerlink,.nav .rst-content tt.download span:first-child,.rst-content tt.download .nav span:first-child,.nav .rst-content code.download span:first-child,.rst-content code.download .nav span:first-child,.nav .icon{display:inline}.btn .fa.fa-large,.btn .wy-menu-vertical li button.fa-large.toctree-expand,.wy-menu-vertical li .btn button.fa-large.toctree-expand,.btn .rst-content .fa-large.admonition-title,.rst-content .btn .fa-large.admonition-title,.btn .rst-content h1 .fa-large.headerlink,.rst-content h1 .btn .fa-large.headerlink,.btn .rst-content h2 .fa-large.headerlink,.rst-content h2 .btn .fa-large.headerlink,.btn .rst-content h3 .fa-large.headerlink,.rst-content h3 .btn .fa-large.headerlink,.btn .rst-content h4 .fa-large.headerlink,.rst-content h4 .btn .fa-large.headerlink,.btn .rst-content h5 .fa-large.headerlink,.rst-content h5 .btn .fa-large.headerlink,.btn .rst-content h6 .fa-large.headerlink,.rst-content h6 .btn .fa-large.headerlink,.btn .rst-content dl dt .fa-large.headerlink,.rst-content dl dt .btn .fa-large.headerlink,.btn .rst-content p .fa-large.headerlink,.rst-content p .btn .fa-large.headerlink,.btn .rst-content table>caption .fa-large.headerlink,.rst-content table>caption .btn .fa-large.headerlink,.btn .rst-content .code-block-caption .fa-large.headerlink,.rst-content .code-block-caption .btn .fa-large.headerlink,.btn .rst-content .eqno .fa-large.headerlink,.rst-content .eqno .btn .fa-large.headerlink,.btn .rst-content tt.download span.fa-large:first-child,.rst-content tt.download .btn span.fa-large:first-child,.btn .rst-content code.download span.fa-large:first-child,.rst-content code.download .btn span.fa-large:first-child,.btn .fa-large.icon,.nav .fa.fa-large,.nav .wy-menu-vertical li button.fa-large.toctree-expand,.wy-menu-vertical li .nav button.fa-large.toctree-expand,.nav .rst-content .fa-large.admonition-title,.rst-content .nav .fa-large.admonition-title,.nav .rst-content h1 .fa-large.headerlink,.rst-content h1 .nav .fa-large.headerlink,.nav .rst-content h2 .fa-large.headerlink,.rst-content h2 .nav .fa-large.headerlink,.nav .rst-content h3 .fa-large.headerlink,.rst-content h3 .nav .fa-large.headerlink,.nav .rst-content h4 .fa-large.headerlink,.rst-content h4 .nav .fa-large.headerlink,.nav .rst-content h5 .fa-large.headerlink,.rst-content h5 .nav .fa-large.headerlink,.nav .rst-content h6 .fa-large.headerlink,.rst-content h6 .nav .fa-large.headerlink,.nav .rst-content dl dt .fa-large.headerlink,.rst-content dl dt .nav .fa-large.headerlink,.nav .rst-content p .fa-large.headerlink,.rst-content p .nav .fa-large.headerlink,.nav .rst-content table>caption .fa-large.headerlink,.rst-content table>caption .nav .fa-large.headerlink,.nav .rst-content .code-block-caption .fa-large.headerlink,.rst-content .code-block-caption .nav .fa-large.headerlink,.nav .rst-content .eqno .fa-large.headerlink,.rst-content .eqno .nav .fa-large.headerlink,.nav .rst-content tt.download span.fa-large:first-child,.rst-content tt.download .nav span.fa-large:first-child,.nav .rst-content code.download span.fa-large:first-child,.rst-content code.download .nav span.fa-large:first-child,.nav .fa-large.icon{line-height:.9em}.btn .fa.fa-spin,.btn .wy-menu-vertical li button.fa-spin.toctree-expand,.wy-menu-vertical li .btn button.fa-spin.toctree-expand,.btn .rst-content .fa-spin.admonition-title,.rst-content .btn .fa-spin.admonition-title,.btn .rst-content h1 .fa-spin.headerlink,.rst-content h1 .btn .fa-spin.headerlink,.btn .rst-content h2 .fa-spin.headerlink,.rst-content h2 .btn .fa-spin.headerlink,.btn .rst-content h3 .fa-spin.headerlink,.rst-content h3 .btn .fa-spin.headerlink,.btn .rst-content h4 .fa-spin.headerlink,.rst-content h4 .btn .fa-spin.headerlink,.btn .rst-content h5 .fa-spin.headerlink,.rst-content h5 .btn .fa-spin.headerlink,.btn .rst-content h6 .fa-spin.headerlink,.rst-content h6 .btn .fa-spin.headerlink,.btn .rst-content dl dt .fa-spin.headerlink,.rst-content dl dt .btn .fa-spin.headerlink,.btn .rst-content p .fa-spin.headerlink,.rst-content p .btn .fa-spin.headerlink,.btn .rst-content table>caption .fa-spin.headerlink,.rst-content table>caption .btn .fa-spin.headerlink,.btn .rst-content .code-block-caption .fa-spin.headerlink,.rst-content .code-block-caption .btn .fa-spin.headerlink,.btn .rst-content .eqno .fa-spin.headerlink,.rst-content .eqno .btn .fa-spin.headerlink,.btn .rst-content tt.download span.fa-spin:first-child,.rst-content tt.download .btn span.fa-spin:first-child,.btn .rst-content code.download span.fa-spin:first-child,.rst-content code.download .btn span.fa-spin:first-child,.btn .fa-spin.icon,.nav .fa.fa-spin,.nav .wy-menu-vertical li button.fa-spin.toctree-expand,.wy-menu-vertical li .nav button.fa-spin.toctree-expand,.nav .rst-content .fa-spin.admonition-title,.rst-content .nav .fa-spin.admonition-title,.nav .rst-content h1 .fa-spin.headerlink,.rst-content h1 .nav .fa-spin.headerlink,.nav .rst-content h2 .fa-spin.headerlink,.rst-content h2 .nav .fa-spin.headerlink,.nav .rst-content h3 .fa-spin.headerlink,.rst-content h3 .nav .fa-spin.headerlink,.nav .rst-content h4 .fa-spin.headerlink,.rst-content h4 .nav .fa-spin.headerlink,.nav .rst-content h5 .fa-spin.headerlink,.rst-content h5 .nav .fa-spin.headerlink,.nav .rst-content h6 .fa-spin.headerlink,.rst-content h6 .nav .fa-spin.headerlink,.nav .rst-content dl dt .fa-spin.headerlink,.rst-content dl dt .nav .fa-spin.headerlink,.nav .rst-content p .fa-spin.headerlink,.rst-content p .nav .fa-spin.headerlink,.nav .rst-content table>caption .fa-spin.headerlink,.rst-content table>caption .nav .fa-spin.headerlink,.nav .rst-content .code-block-caption .fa-spin.headerlink,.rst-content .code-block-caption .nav .fa-spin.headerlink,.nav .rst-content .eqno .fa-spin.headerlink,.rst-content .eqno .nav .fa-spin.headerlink,.nav .rst-content tt.download span.fa-spin:first-child,.rst-content tt.download .nav span.fa-spin:first-child,.nav .rst-content code.download span.fa-spin:first-child,.rst-content code.download .nav span.fa-spin:first-child,.nav .fa-spin.icon{display:inline-block}.btn.fa:before,.wy-menu-vertical li button.btn.toctree-expand:before,.rst-content .btn.admonition-title:before,.rst-content h1 .btn.headerlink:before,.rst-content h2 .btn.headerlink:before,.rst-content h3 .btn.headerlink:before,.rst-content h4 .btn.headerlink:before,.rst-content h5 .btn.headerlink:before,.rst-content h6 .btn.headerlink:before,.rst-content dl dt .btn.headerlink:before,.rst-content p .btn.headerlink:before,.rst-content table>caption .btn.headerlink:before,.rst-content .code-block-caption .btn.headerlink:before,.rst-content .eqno .btn.headerlink:before,.rst-content tt.download span.btn:first-child:before,.rst-content code.download span.btn:first-child:before,.btn.icon:before{opacity:.5;-webkit-transition:opacity .05s ease-in;-moz-transition:opacity .05s ease-in;transition:opacity .05s ease-in}.btn.fa:hover:before,.wy-menu-vertical li button.btn.toctree-expand:hover:before,.rst-content .btn.admonition-title:hover:before,.rst-content h1 .btn.headerlink:hover:before,.rst-content h2 .btn.headerlink:hover:before,.rst-content h3 .btn.headerlink:hover:before,.rst-content h4 .btn.headerlink:hover:before,.rst-content h5 .btn.headerlink:hover:before,.rst-content h6 .btn.headerlink:hover:before,.rst-content dl dt .btn.headerlink:hover:before,.rst-content p .btn.headerlink:hover:before,.rst-content table>caption .btn.headerlink:hover:before,.rst-content .code-block-caption .btn.headerlink:hover:before,.rst-content .eqno .btn.headerlink:hover:before,.rst-content tt.download span.btn:first-child:hover:before,.rst-content code.download span.btn:first-child:hover:before,.btn.icon:hover:before{opacity:1}.btn-mini .fa:before,.btn-mini .wy-menu-vertical li button.toctree-expand:before,.wy-menu-vertical li .btn-mini button.toctree-expand:before,.btn-mini .rst-content .admonition-title:before,.rst-content .btn-mini .admonition-title:before,.btn-mini .rst-content h1 .headerlink:before,.rst-content h1 .btn-mini .headerlink:before,.btn-mini .rst-content h2 .headerlink:before,.rst-content h2 .btn-mini .headerlink:before,.btn-mini .rst-content h3 .headerlink:before,.rst-content h3 .btn-mini .headerlink:before,.btn-mini .rst-content h4 .headerlink:before,.rst-content h4 .btn-mini .headerlink:before,.btn-mini .rst-content h5 .headerlink:before,.rst-content h5 .btn-mini .headerlink:before,.btn-mini .rst-content h6 .headerlink:before,.rst-content h6 .btn-mini .headerlink:before,.btn-mini .rst-content dl dt .headerlink:before,.rst-content dl dt .btn-mini .headerlink:before,.btn-mini .rst-content p .headerlink:before,.rst-content p .btn-mini .headerlink:before,.btn-mini .rst-content table>caption .headerlink:before,.rst-content table>caption .btn-mini .headerlink:before,.btn-mini .rst-content .code-block-caption .headerlink:before,.rst-content .code-block-caption .btn-mini .headerlink:before,.btn-mini .rst-content .eqno .headerlink:before,.rst-content .eqno .btn-mini .headerlink:before,.btn-mini .rst-content tt.download span:first-child:before,.rst-content tt.download .btn-mini span:first-child:before,.btn-mini .rst-content code.download span:first-child:before,.rst-content code.download .btn-mini span:first-child:before,.btn-mini .icon:before{font-size:14px;vertical-align:-15%}.wy-alert,.rst-content .note,.rst-content .attention,.rst-content .caution,.rst-content .danger,.rst-content .error,.rst-content .hint,.rst-content .important,.rst-content .tip,.rst-content .warning,.rst-content .seealso,.rst-content .admonition-todo,.rst-content .admonition{padding:12px;line-height:24px;margin-bottom:24px;background:#e7f2fa}.wy-alert-title,.rst-content .admonition-title{color:#fff;font-weight:bold;display:block;color:#fff;background:#6ab0de;margin:-12px;padding:6px 12px;margin-bottom:12px}.wy-alert.wy-alert-danger,.rst-content .wy-alert-danger.note,.rst-content .wy-alert-danger.attention,.rst-content .wy-alert-danger.caution,.rst-content .danger,.rst-content .error,.rst-content .wy-alert-danger.hint,.rst-content .wy-alert-danger.important,.rst-content .wy-alert-danger.tip,.rst-content .wy-alert-danger.warning,.rst-content .wy-alert-danger.seealso,.rst-content .wy-alert-danger.admonition-todo,.rst-content .wy-alert-danger.admonition{background:#fdf3f2}.wy-alert.wy-alert-danger .wy-alert-title,.rst-content .wy-alert-danger.note .wy-alert-title,.rst-content .wy-alert-danger.attention .wy-alert-title,.rst-content .wy-alert-danger.caution .wy-alert-title,.rst-content .danger .wy-alert-title,.rst-content .error .wy-alert-title,.rst-content .wy-alert-danger.hint .wy-alert-title,.rst-content .wy-alert-danger.important .wy-alert-title,.rst-content .wy-alert-danger.tip .wy-alert-title,.rst-content .wy-alert-danger.warning .wy-alert-title,.rst-content .wy-alert-danger.seealso .wy-alert-title,.rst-content .wy-alert-danger.admonition-todo .wy-alert-title,.rst-content .wy-alert-danger.admonition .wy-alert-title,.wy-alert.wy-alert-danger .rst-content .admonition-title,.rst-content .wy-alert.wy-alert-danger .admonition-title,.rst-content .wy-alert-danger.note .admonition-title,.rst-content .wy-alert-danger.attention .admonition-title,.rst-content .wy-alert-danger.caution .admonition-title,.rst-content .danger .admonition-title,.rst-content .error .admonition-title,.rst-content .wy-alert-danger.hint .admonition-title,.rst-content .wy-alert-danger.important .admonition-title,.rst-content .wy-alert-danger.tip .admonition-title,.rst-content .wy-alert-danger.warning .admonition-title,.rst-content .wy-alert-danger.seealso .admonition-title,.rst-content .wy-alert-danger.admonition-todo .admonition-title,.rst-content .wy-alert-danger.admonition .admonition-title{background:#f29f97}.wy-alert.wy-alert-warning,.rst-content .wy-alert-warning.note,.rst-content .attention,.rst-content .caution,.rst-content .wy-alert-warning.danger,.rst-content .wy-alert-warning.error,.rst-content .wy-alert-warning.hint,.rst-content .wy-alert-warning.important,.rst-content .wy-alert-warning.tip,.rst-content .warning,.rst-content .wy-alert-warning.seealso,.rst-content .admonition-todo,.rst-content .wy-alert-warning.admonition{background:#ffedcc}.wy-alert.wy-alert-warning .wy-alert-title,.rst-content .wy-alert-warning.note .wy-alert-title,.rst-content .attention .wy-alert-title,.rst-content .caution .wy-alert-title,.rst-content .wy-alert-warning.danger .wy-alert-title,.rst-content .wy-alert-warning.error .wy-alert-title,.rst-content .wy-alert-warning.hint .wy-alert-title,.rst-content .wy-alert-warning.important .wy-alert-title,.rst-content .wy-alert-warning.tip .wy-alert-title,.rst-content .warning .wy-alert-title,.rst-content .wy-alert-warning.seealso .wy-alert-title,.rst-content .admonition-todo .wy-alert-title,.rst-content .wy-alert-warning.admonition .wy-alert-title,.wy-alert.wy-alert-warning .rst-content .admonition-title,.rst-content .wy-alert.wy-alert-warning .admonition-title,.rst-content .wy-alert-warning.note .admonition-title,.rst-content .attention .admonition-title,.rst-content .caution .admonition-title,.rst-content .wy-alert-warning.danger .admonition-title,.rst-content .wy-alert-warning.error .admonition-title,.rst-content .wy-alert-warning.hint .admonition-title,.rst-content .wy-alert-warning.important .admonition-title,.rst-content .wy-alert-warning.tip .admonition-title,.rst-content .warning .admonition-title,.rst-content .wy-alert-warning.seealso .admonition-title,.rst-content .admonition-todo .admonition-title,.rst-content .wy-alert-warning.admonition .admonition-title{background:#f0b37e}.wy-alert.wy-alert-info,.rst-content .note,.rst-content .wy-alert-info.attention,.rst-content .wy-alert-info.caution,.rst-content .wy-alert-info.danger,.rst-content .wy-alert-info.error,.rst-content .wy-alert-info.hint,.rst-content .wy-alert-info.important,.rst-content .wy-alert-info.tip,.rst-content .wy-alert-info.warning,.rst-content .seealso,.rst-content .wy-alert-info.admonition-todo,.rst-content .wy-alert-info.admonition{background:#e7f2fa}.wy-alert.wy-alert-info .wy-alert-title,.rst-content .note .wy-alert-title,.rst-content .wy-alert-info.attention .wy-alert-title,.rst-content .wy-alert-info.caution .wy-alert-title,.rst-content .wy-alert-info.danger .wy-alert-title,.rst-content .wy-alert-info.error .wy-alert-title,.rst-content .wy-alert-info.hint .wy-alert-title,.rst-content .wy-alert-info.important .wy-alert-title,.rst-content .wy-alert-info.tip .wy-alert-title,.rst-content .wy-alert-info.warning .wy-alert-title,.rst-content .seealso .wy-alert-title,.rst-content .wy-alert-info.admonition-todo .wy-alert-title,.rst-content .wy-alert-info.admonition .wy-alert-title,.wy-alert.wy-alert-info .rst-content .admonition-title,.rst-content .wy-alert.wy-alert-info .admonition-title,.rst-content .note .admonition-title,.rst-content .wy-alert-info.attention .admonition-title,.rst-content .wy-alert-info.caution .admonition-title,.rst-content .wy-alert-info.danger .admonition-title,.rst-content .wy-alert-info.error .admonition-title,.rst-content .wy-alert-info.hint .admonition-title,.rst-content .wy-alert-info.important .admonition-title,.rst-content .wy-alert-info.tip .admonition-title,.rst-content .wy-alert-info.warning .admonition-title,.rst-content .seealso .admonition-title,.rst-content .wy-alert-info.admonition-todo .admonition-title,.rst-content .wy-alert-info.admonition .admonition-title{background:#6ab0de}.wy-alert.wy-alert-success,.rst-content .wy-alert-success.note,.rst-content .wy-alert-success.attention,.rst-content .wy-alert-success.caution,.rst-content .wy-alert-success.danger,.rst-content .wy-alert-success.error,.rst-content .hint,.rst-content .important,.rst-content .tip,.rst-content .wy-alert-success.warning,.rst-content .wy-alert-success.seealso,.rst-content .wy-alert-success.admonition-todo,.rst-content .wy-alert-success.admonition{background:#dbfaf4}.wy-alert.wy-alert-success .wy-alert-title,.rst-content .wy-alert-success.note .wy-alert-title,.rst-content .wy-alert-success.attention .wy-alert-title,.rst-content .wy-alert-success.caution .wy-alert-title,.rst-content .wy-alert-success.danger .wy-alert-title,.rst-content .wy-alert-success.error .wy-alert-title,.rst-content .hint .wy-alert-title,.rst-content .important .wy-alert-title,.rst-content .tip .wy-alert-title,.rst-content .wy-alert-success.warning .wy-alert-title,.rst-content .wy-alert-success.seealso .wy-alert-title,.rst-content .wy-alert-success.admonition-todo .wy-alert-title,.rst-content .wy-alert-success.admonition .wy-alert-title,.wy-alert.wy-alert-success .rst-content .admonition-title,.rst-content .wy-alert.wy-alert-success .admonition-title,.rst-content .wy-alert-success.note .admonition-title,.rst-content .wy-alert-success.attention .admonition-title,.rst-content .wy-alert-success.caution .admonition-title,.rst-content .wy-alert-success.danger .admonition-title,.rst-content .wy-alert-success.error .admonition-title,.rst-content .hint .admonition-title,.rst-content .important .admonition-title,.rst-content .tip .admonition-title,.rst-content .wy-alert-success.warning .admonition-title,.rst-content .wy-alert-success.seealso .admonition-title,.rst-content .wy-alert-success.admonition-todo .admonition-title,.rst-content .wy-alert-success.admonition .admonition-title{background:#1abc9c}.wy-alert.wy-alert-neutral,.rst-content .wy-alert-neutral.note,.rst-content .wy-alert-neutral.attention,.rst-content .wy-alert-neutral.caution,.rst-content .wy-alert-neutral.danger,.rst-content .wy-alert-neutral.error,.rst-content .wy-alert-neutral.hint,.rst-content .wy-alert-neutral.important,.rst-content .wy-alert-neutral.tip,.rst-content .wy-alert-neutral.warning,.rst-content .wy-alert-neutral.seealso,.rst-content .wy-alert-neutral.admonition-todo,.rst-content .wy-alert-neutral.admonition{background:#f3f6f6}.wy-alert.wy-alert-neutral .wy-alert-title,.rst-content .wy-alert-neutral.note .wy-alert-title,.rst-content .wy-alert-neutral.attention .wy-alert-title,.rst-content .wy-alert-neutral.caution .wy-alert-title,.rst-content .wy-alert-neutral.danger .wy-alert-title,.rst-content .wy-alert-neutral.error .wy-alert-title,.rst-content .wy-alert-neutral.hint .wy-alert-title,.rst-content .wy-alert-neutral.important .wy-alert-title,.rst-content .wy-alert-neutral.tip .wy-alert-title,.rst-content .wy-alert-neutral.warning .wy-alert-title,.rst-content .wy-alert-neutral.seealso .wy-alert-title,.rst-content .wy-alert-neutral.admonition-todo .wy-alert-title,.rst-content .wy-alert-neutral.admonition .wy-alert-title,.wy-alert.wy-alert-neutral .rst-content .admonition-title,.rst-content .wy-alert.wy-alert-neutral .admonition-title,.rst-content .wy-alert-neutral.note .admonition-title,.rst-content .wy-alert-neutral.attention .admonition-title,.rst-content .wy-alert-neutral.caution .admonition-title,.rst-content .wy-alert-neutral.danger .admonition-title,.rst-content .wy-alert-neutral.error .admonition-title,.rst-content .wy-alert-neutral.hint .admonition-title,.rst-content .wy-alert-neutral.important .admonition-title,.rst-content .wy-alert-neutral.tip .admonition-title,.rst-content .wy-alert-neutral.warning .admonition-title,.rst-content .wy-alert-neutral.seealso .admonition-title,.rst-content .wy-alert-neutral.admonition-todo .admonition-title,.rst-content .wy-alert-neutral.admonition .admonition-title{color:#404040;background:#e1e4e5}.wy-alert.wy-alert-neutral a,.rst-content .wy-alert-neutral.note a,.rst-content .wy-alert-neutral.attention a,.rst-content .wy-alert-neutral.caution a,.rst-content .wy-alert-neutral.danger a,.rst-content .wy-alert-neutral.error a,.rst-content .wy-alert-neutral.hint a,.rst-content .wy-alert-neutral.important a,.rst-content .wy-alert-neutral.tip a,.rst-content .wy-alert-neutral.warning a,.rst-content .wy-alert-neutral.seealso a,.rst-content .wy-alert-neutral.admonition-todo a,.rst-content .wy-alert-neutral.admonition a{color:#2980B9}.wy-alert p:last-child,.rst-content .note p:last-child,.rst-content .attention p:last-child,.rst-content .caution p:last-child,.rst-content .danger p:last-child,.rst-content .error p:last-child,.rst-content .hint p:last-child,.rst-content .important p:last-child,.rst-content .tip p:last-child,.rst-content .warning p:last-child,.rst-content .seealso p:last-child,.rst-content .admonition-todo p:last-child,.rst-content .admonition p:last-child{margin-bottom:0}.wy-tray-container{position:fixed;bottom:0px;left:0;z-index:600}.wy-tray-container li{display:block;width:300px;background:transparent;color:#fff;text-align:center;box-shadow:0 5px 5px 0 rgba(0,0,0,0.1);padding:0 24px;min-width:20%;opacity:0;height:0;line-height:56px;overflow:hidden;-webkit-transition:all .3s ease-in;-moz-transition:all .3s ease-in;transition:all .3s ease-in}.wy-tray-container li.wy-tray-item-success{background:#27AE60}.wy-tray-container li.wy-tray-item-info{background:#2980B9}.wy-tray-container li.wy-tray-item-warning{background:#E67E22}.wy-tray-container li.wy-tray-item-danger{background:#E74C3C}.wy-tray-container li.on{opacity:1;height:56px}@media screen and (max-width: 768px){.wy-tray-container{bottom:auto;top:0;width:100%}.wy-tray-container li{width:100%}}button{font-size:100%;margin:0;vertical-align:baseline;*vertical-align:middle;cursor:pointer;line-height:normal;-webkit-appearance:button;*overflow:visible}button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}button[disabled]{cursor:default}.btn{display:inline-block;border-radius:2px;line-height:normal;white-space:nowrap;text-align:center;cursor:pointer;font-size:100%;padding:6px 12px 8px 12px;color:#fff;border:1px solid rgba(0,0,0,0.1);background-color:#27AE60;text-decoration:none;font-weight:normal;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;box-shadow:0px 1px 2px -1px rgba(255,255,255,0.5) inset,0px -2px 0px 0px rgba(0,0,0,0.1) inset;outline-none:false;vertical-align:middle;*display:inline;zoom:1;-webkit-user-drag:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;-webkit-transition:all .1s linear;-moz-transition:all .1s linear;transition:all .1s linear}.btn-hover{background:#2e8ece;color:#fff}.btn:hover{background:#2cc36b;color:#fff}.btn:focus{background:#2cc36b;outline:0}.btn:active{box-shadow:0px -1px 0px 0px rgba(0,0,0,0.05) inset,0px 2px 0px 0px rgba(0,0,0,0.1) inset;padding:8px 12px 6px 12px}.btn:visited{color:#fff}.btn:disabled{background-image:none;filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:alpha(opacity=40);opacity:.4;cursor:not-allowed;box-shadow:none}.btn-disabled{background-image:none;filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:alpha(opacity=40);opacity:.4;cursor:not-allowed;box-shadow:none}.btn-disabled:hover,.btn-disabled:focus,.btn-disabled:active{background-image:none;filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:alpha(opacity=40);opacity:.4;cursor:not-allowed;box-shadow:none}.btn::-moz-focus-inner{padding:0;border:0}.btn-small{font-size:80%}.btn-info{background-color:#2980B9 !important}.btn-info:hover{background-color:#2e8ece !important}.btn-neutral{background-color:#f3f6f6 !important;color:#404040 !important}.btn-neutral:hover{background-color:#e5ebeb !important;color:#404040}.btn-neutral:visited{color:#404040 !important}.btn-success{background-color:#27AE60 !important}.btn-success:hover{background-color:#295 !important}.btn-danger{background-color:#E74C3C !important}.btn-danger:hover{background-color:#ea6153 !important}.btn-warning{background-color:#E67E22 !important}.btn-warning:hover{background-color:#e98b39 !important}.btn-invert{background-color:#222}.btn-invert:hover{background-color:#2f2f2f !important}.btn-link{background-color:transparent !important;color:#2980B9;box-shadow:none;border-color:transparent !important}.btn-link:hover{background-color:transparent !important;color:#409ad5 !important;box-shadow:none}.btn-link:active{background-color:transparent !important;color:#409ad5 !important;box-shadow:none}.btn-link:visited{color:#9B59B6}.wy-btn-group .btn,.wy-control .btn{vertical-align:middle}.wy-btn-group{margin-bottom:24px;*zoom:1}.wy-btn-group:before,.wy-btn-group:after{display:table;content:""}.wy-btn-group:after{clear:both}.wy-dropdown{position:relative;display:inline-block}.wy-dropdown-active .wy-dropdown-menu{display:block}.wy-dropdown-menu{position:absolute;left:0;display:none;float:left;top:100%;min-width:100%;background:#fcfcfc;z-index:100;border:solid 1px #cfd7dd;box-shadow:0 2px 2px 0 rgba(0,0,0,0.1);padding:12px}.wy-dropdown-menu>dd>a{display:block;clear:both;color:#404040;white-space:nowrap;font-size:90%;padding:0 12px;cursor:pointer}.wy-dropdown-menu>dd>a:hover{background:#2980B9;color:#fff}.wy-dropdown-menu>dd.divider{border-top:solid 1px #cfd7dd;margin:6px 0}.wy-dropdown-menu>dd.search{padding-bottom:12px}.wy-dropdown-menu>dd.search input[type="search"]{width:100%}.wy-dropdown-menu>dd.call-to-action{background:#e3e3e3;text-transform:uppercase;font-weight:500;font-size:80%}.wy-dropdown-menu>dd.call-to-action:hover{background:#e3e3e3}.wy-dropdown-menu>dd.call-to-action .btn{color:#fff}.wy-dropdown.wy-dropdown-up .wy-dropdown-menu{bottom:100%;top:auto;left:auto;right:0}.wy-dropdown.wy-dropdown-bubble .wy-dropdown-menu{background:#fcfcfc;margin-top:2px}.wy-dropdown.wy-dropdown-bubble .wy-dropdown-menu a{padding:6px 12px}.wy-dropdown.wy-dropdown-bubble .wy-dropdown-menu a:hover{background:#2980B9;color:#fff}.wy-dropdown.wy-dropdown-left .wy-dropdown-menu{right:0;left:auto;text-align:right}.wy-dropdown-arrow:before{content:" ";border-bottom:5px solid #f5f5f5;border-left:5px solid transparent;border-right:5px solid transparent;position:absolute;display:block;top:-4px;left:50%;margin-left:-3px}.wy-dropdown-arrow.wy-dropdown-arrow-left:before{left:11px}.wy-form-stacked select{display:block}.wy-form-aligned input,.wy-form-aligned textarea,.wy-form-aligned select,.wy-form-aligned .wy-help-inline,.wy-form-aligned label{display:inline-block;*display:inline;*zoom:1;vertical-align:middle}.wy-form-aligned .wy-control-group>label{display:inline-block;vertical-align:middle;width:10em;margin:6px 12px 0 0;float:left}.wy-form-aligned .wy-control{float:left}.wy-form-aligned .wy-control label{display:block}.wy-form-aligned .wy-control select{margin-top:6px}fieldset{border:0;margin:0;padding:0}legend{display:block;width:100%;border:0;padding:0;white-space:normal;margin-bottom:24px;font-size:150%;*margin-left:-7px}label{display:block;margin:0 0 .3125em 0;color:#333;font-size:90%}input,select,textarea{font-size:100%;margin:0;vertical-align:baseline;*vertical-align:middle}.wy-control-group{margin-bottom:24px;*zoom:1;max-width:1200px;margin-left:auto;margin-right:auto;*zoom:1}.wy-control-group:before,.wy-control-group:after{display:table;content:""}.wy-control-group:after{clear:both}.wy-control-group:before,.wy-control-group:after{display:table;content:""}.wy-control-group:after{clear:both}.wy-control-group.wy-control-group-required>label:after{content:" *";color:#E74C3C}.wy-control-group .wy-form-full,.wy-control-group .wy-form-halves,.wy-control-group .wy-form-thirds{padding-bottom:12px}.wy-control-group .wy-form-full select,.wy-control-group .wy-form-halves select,.wy-control-group .wy-form-thirds select{width:100%}.wy-control-group .wy-form-full input[type="text"],.wy-control-group .wy-form-full input[type="password"],.wy-control-group .wy-form-full input[type="email"],.wy-control-group .wy-form-full input[type="url"],.wy-control-group .wy-form-full input[type="date"],.wy-control-group .wy-form-full input[type="month"],.wy-control-group .wy-form-full input[type="time"],.wy-control-group .wy-form-full input[type="datetime"],.wy-control-group .wy-form-full input[type="datetime-local"],.wy-control-group .wy-form-full input[type="week"],.wy-control-group .wy-form-full input[type="number"],.wy-control-group .wy-form-full input[type="search"],.wy-control-group .wy-form-full input[type="tel"],.wy-control-group .wy-form-full input[type="color"],.wy-control-group .wy-form-halves input[type="text"],.wy-control-group .wy-form-halves input[type="password"],.wy-control-group .wy-form-halves input[type="email"],.wy-control-group .wy-form-halves input[type="url"],.wy-control-group .wy-form-halves input[type="date"],.wy-control-group .wy-form-halves input[type="month"],.wy-control-group .wy-form-halves input[type="time"],.wy-control-group .wy-form-halves input[type="datetime"],.wy-control-group .wy-form-halves input[type="datetime-local"],.wy-control-group .wy-form-halves input[type="week"],.wy-control-group .wy-form-halves input[type="number"],.wy-control-group .wy-form-halves input[type="search"],.wy-control-group .wy-form-halves input[type="tel"],.wy-control-group .wy-form-halves input[type="color"],.wy-control-group .wy-form-thirds input[type="text"],.wy-control-group .wy-form-thirds input[type="password"],.wy-control-group .wy-form-thirds input[type="email"],.wy-control-group .wy-form-thirds input[type="url"],.wy-control-group .wy-form-thirds input[type="date"],.wy-control-group .wy-form-thirds input[type="month"],.wy-control-group .wy-form-thirds input[type="time"],.wy-control-group .wy-form-thirds input[type="datetime"],.wy-control-group .wy-form-thirds input[type="datetime-local"],.wy-control-group .wy-form-thirds input[type="week"],.wy-control-group .wy-form-thirds input[type="number"],.wy-control-group .wy-form-thirds input[type="search"],.wy-control-group .wy-form-thirds input[type="tel"],.wy-control-group .wy-form-thirds input[type="color"]{width:100%}.wy-control-group .wy-form-full{float:left;display:block;margin-right:2.3576520234%;width:100%;margin-right:0}.wy-control-group .wy-form-full:last-child{margin-right:0}.wy-control-group .wy-form-halves{float:left;display:block;margin-right:2.3576520234%;width:48.8211739883%}.wy-control-group .wy-form-halves:last-child{margin-right:0}.wy-control-group .wy-form-halves:nth-of-type(2n){margin-right:0}.wy-control-group .wy-form-halves:nth-of-type(2n+1){clear:left}.wy-control-group .wy-form-thirds{float:left;display:block;margin-right:2.3576520234%;width:31.7615653177%}.wy-control-group .wy-form-thirds:last-child{margin-right:0}.wy-control-group .wy-form-thirds:nth-of-type(3n){margin-right:0}.wy-control-group .wy-form-thirds:nth-of-type(3n+1){clear:left}.wy-control-group.wy-control-group-no-input .wy-control{margin:6px 0 0 0;font-size:90%}.wy-control-no-input{display:inline-block;margin:6px 0 0 0;font-size:90%}.wy-control-group.fluid-input input[type="text"],.wy-control-group.fluid-input input[type="password"],.wy-control-group.fluid-input input[type="email"],.wy-control-group.fluid-input input[type="url"],.wy-control-group.fluid-input input[type="date"],.wy-control-group.fluid-input input[type="month"],.wy-control-group.fluid-input input[type="time"],.wy-control-group.fluid-input input[type="datetime"],.wy-control-group.fluid-input input[type="datetime-local"],.wy-control-group.fluid-input input[type="week"],.wy-control-group.fluid-input input[type="number"],.wy-control-group.fluid-input input[type="search"],.wy-control-group.fluid-input input[type="tel"],.wy-control-group.fluid-input input[type="color"]{width:100%}.wy-form-message-inline{display:inline-block;padding-left:.3em;color:#666;vertical-align:middle;font-size:90%}.wy-form-message{display:block;color:#999;font-size:70%;margin-top:.3125em;font-style:italic}.wy-form-message p{font-size:inherit;font-style:italic;margin-bottom:6px}.wy-form-message p:last-child{margin-bottom:0}input{line-height:normal}input[type="button"],input[type="reset"],input[type="submit"]{-webkit-appearance:button;cursor:pointer;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;*overflow:visible}input[type="text"],input[type="password"],input[type="email"],input[type="url"],input[type="date"],input[type="month"],input[type="time"],input[type="datetime"],input[type="datetime-local"],input[type="week"],input[type="number"],input[type="search"],input[type="tel"],input[type="color"]{-webkit-appearance:none;padding:6px;display:inline-block;border:1px solid #ccc;font-size:80%;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;box-shadow:inset 0 1px 3px #ddd;border-radius:0;-webkit-transition:border .3s linear;-moz-transition:border .3s linear;transition:border .3s linear}input[type="datetime-local"]{padding:.34375em .625em}input[disabled]{cursor:default}input[type="checkbox"],input[type="radio"]{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;padding:0;margin-right:.3125em;*height:13px;*width:13px}input[type="search"]{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}input[type="search"]::-webkit-search-cancel-button,input[type="search"]::-webkit-search-decoration{-webkit-appearance:none}input[type="text"]:focus,input[type="password"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus{outline:0;outline:thin dotted \9 ;border-color:#333}input.no-focus:focus{border-color:#ccc !important}input[type="file"]:focus,input[type="radio"]:focus,input[type="checkbox"]:focus{outline:thin dotted #333;outline:1px auto #129FEA}input[type="text"][disabled],input[type="password"][disabled],input[type="email"][disabled],input[type="url"][disabled],input[type="date"][disabled],input[type="month"][disabled],input[type="time"][disabled],input[type="datetime"][disabled],input[type="datetime-local"][disabled],input[type="week"][disabled],input[type="number"][disabled],input[type="search"][disabled],input[type="tel"][disabled],input[type="color"][disabled]{cursor:not-allowed;background-color:#fafafa}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#E74C3C;border:1px solid #E74C3C}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#E74C3C}input[type="file"]:focus:invalid:focus,input[type="radio"]:focus:invalid:focus,input[type="checkbox"]:focus:invalid:focus{outline-color:#E74C3C}input.wy-input-large{padding:12px;font-size:100%}textarea{overflow:auto;vertical-align:top;width:100%;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif}select,textarea{padding:.5em .625em;display:inline-block;border:1px solid #ccc;font-size:80%;box-shadow:inset 0 1px 3px #ddd;-webkit-transition:border .3s linear;-moz-transition:border .3s linear;transition:border .3s linear}select{border:1px solid #ccc;background-color:#fff}select[multiple]{height:auto}select:focus,textarea:focus{outline:0}select[disabled],textarea[disabled],input[readonly],select[readonly],textarea[readonly]{cursor:not-allowed;background-color:#fafafa}input[type="radio"][disabled],input[type="checkbox"][disabled]{cursor:not-allowed}.wy-checkbox,.wy-radio{margin:6px 0;color:#404040;display:block}.wy-checkbox input,.wy-radio input{vertical-align:baseline}.wy-form-message-inline{display:inline-block;*display:inline;*zoom:1;vertical-align:middle}.wy-input-prefix,.wy-input-suffix{white-space:nowrap;padding:6px}.wy-input-prefix .wy-input-context,.wy-input-suffix .wy-input-context{line-height:27px;padding:0 8px;display:inline-block;font-size:80%;background-color:#f3f6f6;border:solid 1px #ccc;color:#999}.wy-input-suffix .wy-input-context{border-left:0}.wy-input-prefix .wy-input-context{border-right:0}.wy-switch{position:relative;display:block;height:24px;margin-top:12px;cursor:pointer}.wy-switch:before{position:absolute;content:"";display:block;left:0;top:0;width:36px;height:12px;border-radius:4px;background:#ccc;-webkit-transition:all .2s ease-in-out;-moz-transition:all .2s ease-in-out;transition:all .2s ease-in-out}.wy-switch:after{position:absolute;content:"";display:block;width:18px;height:18px;border-radius:4px;background:#999;left:-3px;top:-3px;-webkit-transition:all .2s ease-in-out;-moz-transition:all .2s ease-in-out;transition:all .2s ease-in-out}.wy-switch span{position:absolute;left:48px;display:block;font-size:12px;color:#ccc;line-height:1}.wy-switch.active:before{background:#1e8449}.wy-switch.active:after{left:24px;background:#27AE60}.wy-switch.disabled{cursor:not-allowed;opacity:.8}.wy-control-group.wy-control-group-error .wy-form-message,.wy-control-group.wy-control-group-error>label{color:#E74C3C}.wy-control-group.wy-control-group-error input[type="text"],.wy-control-group.wy-control-group-error input[type="password"],.wy-control-group.wy-control-group-error input[type="email"],.wy-control-group.wy-control-group-error input[type="url"],.wy-control-group.wy-control-group-error input[type="date"],.wy-control-group.wy-control-group-error input[type="month"],.wy-control-group.wy-control-group-error input[type="time"],.wy-control-group.wy-control-group-error input[type="datetime"],.wy-control-group.wy-control-group-error input[type="datetime-local"],.wy-control-group.wy-control-group-error input[type="week"],.wy-control-group.wy-control-group-error input[type="number"],.wy-control-group.wy-control-group-error input[type="search"],.wy-control-group.wy-control-group-error input[type="tel"],.wy-control-group.wy-control-group-error input[type="color"]{border:solid 1px #E74C3C}.wy-control-group.wy-control-group-error textarea{border:solid 1px #E74C3C}.wy-inline-validate{white-space:nowrap}.wy-inline-validate .wy-input-context{padding:.5em .625em;display:inline-block;font-size:80%}.wy-inline-validate.wy-inline-validate-success .wy-input-context{color:#27AE60}.wy-inline-validate.wy-inline-validate-danger .wy-input-context{color:#E74C3C}.wy-inline-validate.wy-inline-validate-warning .wy-input-context{color:#E67E22}.wy-inline-validate.wy-inline-validate-info .wy-input-context{color:#2980B9}.rotate-90{-webkit-transform:rotate(90deg);-moz-transform:rotate(90deg);-ms-transform:rotate(90deg);-o-transform:rotate(90deg);transform:rotate(90deg)}.rotate-180{-webkit-transform:rotate(180deg);-moz-transform:rotate(180deg);-ms-transform:rotate(180deg);-o-transform:rotate(180deg);transform:rotate(180deg)}.rotate-270{-webkit-transform:rotate(270deg);-moz-transform:rotate(270deg);-ms-transform:rotate(270deg);-o-transform:rotate(270deg);transform:rotate(270deg)}.mirror{-webkit-transform:scaleX(-1);-moz-transform:scaleX(-1);-ms-transform:scaleX(-1);-o-transform:scaleX(-1);transform:scaleX(-1)}.mirror.rotate-90{-webkit-transform:scaleX(-1) rotate(90deg);-moz-transform:scaleX(-1) rotate(90deg);-ms-transform:scaleX(-1) rotate(90deg);-o-transform:scaleX(-1) rotate(90deg);transform:scaleX(-1) rotate(90deg)}.mirror.rotate-180{-webkit-transform:scaleX(-1) rotate(180deg);-moz-transform:scaleX(-1) rotate(180deg);-ms-transform:scaleX(-1) rotate(180deg);-o-transform:scaleX(-1) rotate(180deg);transform:scaleX(-1) rotate(180deg)}.mirror.rotate-270{-webkit-transform:scaleX(-1) rotate(270deg);-moz-transform:scaleX(-1) rotate(270deg);-ms-transform:scaleX(-1) rotate(270deg);-o-transform:scaleX(-1) rotate(270deg);transform:scaleX(-1) rotate(270deg)}@media only screen and (max-width: 480px){.wy-form button[type="submit"]{margin:.7em 0 0}.wy-form input[type="text"],.wy-form input[type="password"],.wy-form input[type="email"],.wy-form input[type="url"],.wy-form input[type="date"],.wy-form input[type="month"],.wy-form input[type="time"],.wy-form input[type="datetime"],.wy-form input[type="datetime-local"],.wy-form input[type="week"],.wy-form input[type="number"],.wy-form input[type="search"],.wy-form input[type="tel"],.wy-form input[type="color"]{margin-bottom:.3em;display:block}.wy-form label{margin-bottom:.3em;display:block}.wy-form input[type="password"],.wy-form input[type="email"],.wy-form input[type="url"],.wy-form input[type="date"],.wy-form input[type="month"],.wy-form input[type="time"],.wy-form input[type="datetime"],.wy-form input[type="datetime-local"],.wy-form input[type="week"],.wy-form input[type="number"],.wy-form input[type="search"],.wy-form input[type="tel"],.wy-form input[type="color"]{margin-bottom:0}.wy-form-aligned .wy-control-group label{margin-bottom:.3em;text-align:left;display:block;width:100%}.wy-form-aligned .wy-control{margin:1.5em 0 0 0}.wy-form .wy-help-inline,.wy-form-message-inline,.wy-form-message{display:block;font-size:80%;padding:6px 0}}@media screen and (max-width: 768px){.tablet-hide{display:none}}@media screen and (max-width: 480px){.mobile-hide{display:none}}.float-left{float:left}.float-right{float:right}.full-width{width:100%}.wy-table,.rst-content table.docutils,.rst-content table.field-list{border-collapse:collapse;border-spacing:0;empty-cells:show;margin-bottom:24px}.wy-table caption,.rst-content table.docutils caption,.rst-content table.field-list caption{color:#000;font:italic 85%/1 arial,sans-serif;padding:1em 0;text-align:center}.wy-table td,.rst-content table.docutils td,.rst-content table.field-list td,.wy-table th,.rst-content table.docutils th,.rst-content table.field-list th{font-size:90%;margin:0;overflow:visible;padding:8px 16px}.wy-table td:first-child,.rst-content table.docutils td:first-child,.rst-content table.field-list td:first-child,.wy-table th:first-child,.rst-content table.docutils th:first-child,.rst-content table.field-list th:first-child{border-left-width:0}.wy-table thead,.rst-content table.docutils thead,.rst-content table.field-list thead{color:#000;text-align:left;vertical-align:bottom;white-space:nowrap}.wy-table thead th,.rst-content table.docutils thead th,.rst-content table.field-list thead th{font-weight:bold;border-bottom:solid 2px #e1e4e5}.wy-table td,.rst-content table.docutils td,.rst-content table.field-list td{background-color:transparent;vertical-align:middle}.wy-table td p,.rst-content table.docutils td p,.rst-content table.field-list td p{line-height:18px}.wy-table td p:last-child,.rst-content table.docutils td p:last-child,.rst-content table.field-list td p:last-child{margin-bottom:0}.wy-table .wy-table-cell-min,.rst-content table.docutils .wy-table-cell-min,.rst-content table.field-list .wy-table-cell-min{width:1%;padding-right:0}.wy-table .wy-table-cell-min input[type=checkbox],.rst-content table.docutils .wy-table-cell-min input[type=checkbox],.rst-content table.field-list .wy-table-cell-min input[type=checkbox],.wy-table .wy-table-cell-min input[type=checkbox],.rst-content table.docutils .wy-table-cell-min input[type=checkbox],.rst-content table.field-list .wy-table-cell-min input[type=checkbox]{margin:0}.wy-table-secondary{color:gray;font-size:90%}.wy-table-tertiary{color:gray;font-size:80%}.wy-table-odd td,.wy-table-striped tr:nth-child(2n-1) td,.rst-content table.docutils:not(.field-list) tr:nth-child(2n-1) td{background-color:#f3f6f6}.wy-table-backed{background-color:#f3f6f6}.wy-table-bordered-all,.rst-content table.docutils{border:1px solid #e1e4e5}.wy-table-bordered-all td,.rst-content table.docutils td{border-bottom:1px solid #e1e4e5;border-left:1px solid #e1e4e5}.wy-table-bordered-all tbody>tr:last-child td,.rst-content table.docutils tbody>tr:last-child td{border-bottom-width:0}.wy-table-bordered{border:1px solid #e1e4e5}.wy-table-bordered-rows td{border-bottom:1px solid #e1e4e5}.wy-table-bordered-rows tbody>tr:last-child td{border-bottom-width:0}.wy-table-horizontal tbody>tr:last-child td{border-bottom-width:0}.wy-table-horizontal td,.wy-table-horizontal th{border-width:0 0 1px 0;border-bottom:1px solid #e1e4e5}.wy-table-horizontal tbody>tr:last-child td{border-bottom-width:0}.wy-table-responsive{margin-bottom:24px;max-width:100%;overflow:auto}.wy-table-responsive table{margin-bottom:0 !important}.wy-table-responsive table td,.wy-table-responsive table th{white-space:nowrap}a{color:#2980B9;text-decoration:none;cursor:pointer}a:hover{color:#3091d1}a:visited{color:#9B59B6}html{height:100%;overflow-x:hidden}body{font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;font-weight:normal;color:#404040;min-height:100%;overflow-x:hidden;background:#edf0f2}.wy-text-left{text-align:left}.wy-text-center{text-align:center}.wy-text-right{text-align:right}.wy-text-large{font-size:120%}.wy-text-normal{font-size:100%}.wy-text-small,small{font-size:80%}.wy-text-strike{text-decoration:line-through}.wy-text-warning{color:#E67E22 !important}a.wy-text-warning:hover{color:#eb9950 !important}.wy-text-info{color:#2980B9 !important}a.wy-text-info:hover{color:#409ad5 !important}.wy-text-success{color:#27AE60 !important}a.wy-text-success:hover{color:#36d278 !important}.wy-text-danger{color:#E74C3C !important}a.wy-text-danger:hover{color:#ed7669 !important}.wy-text-neutral{color:#404040 !important}a.wy-text-neutral:hover{color:#595959 !important}h1,h2,.rst-content .toctree-wrapper>p.caption,h3,h4,h5,h6,legend{margin-top:0;font-weight:700;font-family:"Roboto Slab","ff-tisa-web-pro","Georgia",Arial,sans-serif}p{line-height:24px;margin:0;font-size:16px;margin-bottom:24px}h1{font-size:175%}h2,.rst-content .toctree-wrapper>p.caption{font-size:150%}h3{font-size:125%}h4{font-size:115%}h5{font-size:110%}h6{font-size:100%}hr{display:block;height:1px;border:0;border-top:1px solid #e1e4e5;margin:24px 0;padding:0}code,.rst-content tt,.rst-content code{white-space:nowrap;max-width:100%;background:#fff;border:solid 1px #e1e4e5;font-size:75%;padding:0 5px;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;color:#E74C3C;overflow-x:auto}code.code-large,.rst-content tt.code-large{font-size:90%}.wy-plain-list-disc,.rst-content .section ul,.rst-content section ul,.rst-content .toctree-wrapper ul,article ul{list-style:disc;line-height:24px;margin-bottom:24px}.wy-plain-list-disc li,.rst-content .section ul li,.rst-content section ul li,.rst-content .toctree-wrapper ul li,article ul li{list-style:disc;margin-left:24px}.wy-plain-list-disc li p:last-child,.rst-content .section ul li p:last-child,.rst-content section ul li p:last-child,.rst-content .toctree-wrapper ul li p:last-child,article ul li p:last-child{margin-bottom:0}.wy-plain-list-disc li ul,.rst-content .section ul li ul,.rst-content section ul li ul,.rst-content .toctree-wrapper ul li ul,article ul li ul{margin-bottom:0}.wy-plain-list-disc li li,.rst-content .section ul li li,.rst-content section ul li li,.rst-content .toctree-wrapper ul li li,article ul li li{list-style:circle}.wy-plain-list-disc li li li,.rst-content .section ul li li li,.rst-content section ul li li li,.rst-content .toctree-wrapper ul li li li,article ul li li li{list-style:square}.wy-plain-list-disc li ol li,.rst-content .section ul li ol li,.rst-content section ul li ol li,.rst-content .toctree-wrapper ul li ol li,article ul li ol li{list-style:decimal}.wy-plain-list-decimal,.rst-content .section ol,.rst-content .section ol.arabic,.rst-content section ol,.rst-content section ol.arabic,.rst-content .toctree-wrapper ol,.rst-content .toctree-wrapper ol.arabic,article ol{list-style:decimal;line-height:24px;margin-bottom:24px}.wy-plain-list-decimal li,.rst-content .section ol li,.rst-content .section ol.arabic li,.rst-content section ol li,.rst-content section ol.arabic li,.rst-content .toctree-wrapper ol li,.rst-content .toctree-wrapper ol.arabic li,article ol li{list-style:decimal;margin-left:24px}.wy-plain-list-decimal li p:last-child,.rst-content .section ol li p:last-child,.rst-content section ol li p:last-child,.rst-content .toctree-wrapper ol li p:last-child,article ol li p:last-child{margin-bottom:0}.wy-plain-list-decimal li ul,.rst-content .section ol li ul,.rst-content .section ol.arabic li ul,.rst-content section ol li ul,.rst-content section ol.arabic li ul,.rst-content .toctree-wrapper ol li ul,.rst-content .toctree-wrapper ol.arabic li ul,article ol li ul{margin-bottom:0}.wy-plain-list-decimal li ul li,.rst-content .section ol li ul li,.rst-content .section ol.arabic li ul li,.rst-content section ol li ul li,.rst-content section ol.arabic li ul li,.rst-content .toctree-wrapper ol li ul li,.rst-content .toctree-wrapper ol.arabic li ul li,article ol li ul li{list-style:disc}.wy-breadcrumbs{*zoom:1}.wy-breadcrumbs:before,.wy-breadcrumbs:after{display:table;content:""}.wy-breadcrumbs:after{clear:both}.wy-breadcrumbs li{display:inline-block}.wy-breadcrumbs li.wy-breadcrumbs-aside{float:right}.wy-breadcrumbs li a{display:inline-block;padding:5px}.wy-breadcrumbs li a:first-child{padding-left:0}.wy-breadcrumbs li code,.wy-breadcrumbs li .rst-content tt,.rst-content .wy-breadcrumbs li tt{padding:5px;border:none;background:none}.wy-breadcrumbs li code.literal,.wy-breadcrumbs li .rst-content tt.literal,.rst-content .wy-breadcrumbs li tt.literal{color:#404040}.wy-breadcrumbs-extra{margin-bottom:0;color:#b3b3b3;font-size:80%;display:inline-block}@media screen and (max-width: 480px){.wy-breadcrumbs-extra{display:none}.wy-breadcrumbs li.wy-breadcrumbs-aside{display:none}}@media print{.wy-breadcrumbs li.wy-breadcrumbs-aside{display:none}}html{font-size:16px}.wy-affix{position:fixed;top:1.618em}.wy-menu a:hover{text-decoration:none}.wy-menu-horiz{*zoom:1}.wy-menu-horiz:before,.wy-menu-horiz:after{display:table;content:""}.wy-menu-horiz:after{clear:both}.wy-menu-horiz ul,.wy-menu-horiz li{display:inline-block}.wy-menu-horiz li:hover{background:rgba(255,255,255,0.1)}.wy-menu-horiz li.divide-left{border-left:solid 1px #404040}.wy-menu-horiz li.divide-right{border-right:solid 1px #404040}.wy-menu-horiz a{height:32px;display:inline-block;line-height:32px;padding:0 16px}.wy-menu-vertical{width:300px}.wy-menu-vertical header,.wy-menu-vertical p.caption{color:#55a5d9;height:32px;line-height:32px;padding:0 1.618em;margin:12px 0 0 0;display:block;font-weight:bold;text-transform:uppercase;font-size:85%;white-space:nowrap}.wy-menu-vertical ul{margin-bottom:0}.wy-menu-vertical li.divide-top{border-top:solid 1px #404040}.wy-menu-vertical li.divide-bottom{border-bottom:solid 1px #404040}.wy-menu-vertical li.current{background:#e3e3e3}.wy-menu-vertical li.current a{color:gray;border-right:solid 1px #c9c9c9;padding:.4045em 2.427em}.wy-menu-vertical li.current a:hover{background:#d6d6d6}.wy-menu-vertical li code,.wy-menu-vertical li .rst-content tt,.rst-content .wy-menu-vertical li tt{border:none;background:inherit;color:inherit;padding-left:0;padding-right:0}.wy-menu-vertical li button.toctree-expand{display:block;float:left;margin-left:-1.2em;line-height:18px;color:#4d4d4d;border:none;background:none;padding:0}.wy-menu-vertical li.on a,.wy-menu-vertical li.current>a{color:#404040;padding:.4045em 1.618em;font-weight:bold;position:relative;background:#fcfcfc;border:none;padding-left:1.618em -4px}.wy-menu-vertical li.on a:hover,.wy-menu-vertical li.current>a:hover{background:#fcfcfc}.wy-menu-vertical li.on a:hover button.toctree-expand,.wy-menu-vertical li.current>a:hover button.toctree-expand{color:gray}.wy-menu-vertical li.on a button.toctree-expand,.wy-menu-vertical li.current>a button.toctree-expand{display:block;line-height:18px;color:#333}.wy-menu-vertical li.toctree-l1.current>a{border-bottom:solid 1px #c9c9c9;border-top:solid 1px #c9c9c9}.wy-menu-vertical .toctree-l1.current .toctree-l2>ul,.wy-menu-vertical .toctree-l2.current .toctree-l3>ul,.wy-menu-vertical .toctree-l3.current .toctree-l4>ul,.wy-menu-vertical .toctree-l4.current .toctree-l5>ul,.wy-menu-vertical .toctree-l5.current .toctree-l6>ul,.wy-menu-vertical .toctree-l6.current .toctree-l7>ul,.wy-menu-vertical .toctree-l7.current .toctree-l8>ul,.wy-menu-vertical .toctree-l8.current .toctree-l9>ul,.wy-menu-vertical .toctree-l9.current .toctree-l10>ul,.wy-menu-vertical .toctree-l10.current .toctree-l11>ul{display:none}.wy-menu-vertical .toctree-l1.current .current.toctree-l2>ul,.wy-menu-vertical .toctree-l2.current .current.toctree-l3>ul,.wy-menu-vertical .toctree-l3.current .current.toctree-l4>ul,.wy-menu-vertical .toctree-l4.current .current.toctree-l5>ul,.wy-menu-vertical .toctree-l5.current .current.toctree-l6>ul,.wy-menu-vertical .toctree-l6.current .current.toctree-l7>ul,.wy-menu-vertical .toctree-l7.current .current.toctree-l8>ul,.wy-menu-vertical .toctree-l8.current .current.toctree-l9>ul,.wy-menu-vertical .toctree-l9.current .current.toctree-l10>ul,.wy-menu-vertical .toctree-l10.current .current.toctree-l11>ul{display:block}.wy-menu-vertical li.toctree-l3,.wy-menu-vertical li.toctree-l4{font-size:.9em}.wy-menu-vertical li.toctree-l2 a,.wy-menu-vertical li.toctree-l3 a,.wy-menu-vertical li.toctree-l4 a,.wy-menu-vertical li.toctree-l5 a,.wy-menu-vertical li.toctree-l6 a,.wy-menu-vertical li.toctree-l7 a,.wy-menu-vertical li.toctree-l8 a,.wy-menu-vertical li.toctree-l9 a,.wy-menu-vertical li.toctree-l10 a{color:#404040}.wy-menu-vertical li.toctree-l2 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l3 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l4 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l5 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l6 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l7 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l8 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l9 a:hover button.toctree-expand,.wy-menu-vertical li.toctree-l10 a:hover button.toctree-expand{color:gray}.wy-menu-vertical li.toctree-l2.current li.toctree-l3>a,.wy-menu-vertical li.toctree-l3.current li.toctree-l4>a,.wy-menu-vertical li.toctree-l4.current li.toctree-l5>a,.wy-menu-vertical li.toctree-l5.current li.toctree-l6>a,.wy-menu-vertical li.toctree-l6.current li.toctree-l7>a,.wy-menu-vertical li.toctree-l7.current li.toctree-l8>a,.wy-menu-vertical li.toctree-l8.current li.toctree-l9>a,.wy-menu-vertical li.toctree-l9.current li.toctree-l10>a,.wy-menu-vertical li.toctree-l10.current li.toctree-l11>a{display:block}.wy-menu-vertical li.toctree-l2.current>a{padding:.4045em 2.427em}.wy-menu-vertical li.toctree-l2.current li.toctree-l3>a{padding:.4045em 4.045em;padding-right:1.618em}.wy-menu-vertical li.toctree-l3.current>a{padding:.4045em 4.045em}.wy-menu-vertical li.toctree-l3.current li.toctree-l4>a{padding:.4045em 5.663em;padding-right:1.618em}.wy-menu-vertical li.toctree-l4.current>a{padding:.4045em 5.663em}.wy-menu-vertical li.toctree-l4.current li.toctree-l5>a{padding:.4045em 7.281em;padding-right:1.618em}.wy-menu-vertical li.toctree-l5.current>a{padding:.4045em 7.281em}.wy-menu-vertical li.toctree-l5.current li.toctree-l6>a{padding:.4045em 8.899em;padding-right:1.618em}.wy-menu-vertical li.toctree-l6.current>a{padding:.4045em 8.899em}.wy-menu-vertical li.toctree-l6.current li.toctree-l7>a{padding:.4045em 10.517em;padding-right:1.618em}.wy-menu-vertical li.toctree-l7.current>a{padding:.4045em 10.517em}.wy-menu-vertical li.toctree-l7.current li.toctree-l8>a{padding:.4045em 12.135em;padding-right:1.618em}.wy-menu-vertical li.toctree-l8.current>a{padding:.4045em 12.135em}.wy-menu-vertical li.toctree-l8.current li.toctree-l9>a{padding:.4045em 13.753em;padding-right:1.618em}.wy-menu-vertical li.toctree-l9.current>a{padding:.4045em 13.753em}.wy-menu-vertical li.toctree-l9.current li.toctree-l10>a{padding:.4045em 15.371em;padding-right:1.618em}.wy-menu-vertical li.toctree-l10.current>a{padding:.4045em 15.371em}.wy-menu-vertical li.toctree-l10.current li.toctree-l11>a{padding:.4045em 16.989em;padding-right:1.618em}.wy-menu-vertical li.toctree-l2.current>a{background:#c9c9c9}.wy-menu-vertical li.toctree-l2.current li.toctree-l3>a{background:#c9c9c9}.wy-menu-vertical li.toctree-l2 button.toctree-expand{color:#a3a3a3}.wy-menu-vertical li.toctree-l3.current>a{background:#bdbdbd}.wy-menu-vertical li.toctree-l3.current li.toctree-l4>a{background:#bdbdbd}.wy-menu-vertical li.toctree-l3 button.toctree-expand{color:#969696}.wy-menu-vertical li.current ul{display:block}.wy-menu-vertical li ul{margin-bottom:0;display:none}.wy-menu-vertical li ul li a{margin-bottom:0;color:#d9d9d9;font-weight:normal}.wy-menu-vertical a{line-height:18px;padding:.4045em 1.618em;display:block;position:relative;font-size:90%;color:#d9d9d9}.wy-menu-vertical a:hover{background-color:#4e4a4a;cursor:pointer}.wy-menu-vertical a:hover button.toctree-expand{color:#d9d9d9}.wy-menu-vertical a:active{background-color:#2980B9;cursor:pointer;color:#fff}.wy-menu-vertical a:active button.toctree-expand{color:#fff}.wy-side-nav-search{display:block;width:300px;padding:.809em;margin-bottom:.809em;z-index:200;background-color:#2980B9;text-align:center;color:#fcfcfc}.wy-side-nav-search input[type=text]{width:100%;border-radius:50px;padding:6px 12px;border-color:#2472a4}.wy-side-nav-search img{display:block;margin:auto auto .809em auto;height:45px;width:45px;background-color:#2980B9;padding:5px;border-radius:100%}.wy-side-nav-search>a,.wy-side-nav-search .wy-dropdown>a{color:#fcfcfc;font-size:100%;font-weight:bold;display:inline-block;padding:4px 6px;margin-bottom:.809em;max-width:100%}.wy-side-nav-search>a:hover,.wy-side-nav-search .wy-dropdown>a:hover{background:rgba(255,255,255,0.1)}.wy-side-nav-search>a img.logo,.wy-side-nav-search .wy-dropdown>a img.logo{display:block;margin:0 auto;height:auto;width:auto;border-radius:0;max-width:100%;background:transparent}.wy-side-nav-search>a.icon img.logo,.wy-side-nav-search .wy-dropdown>a.icon img.logo{margin-top:.85em}.wy-side-nav-search>div.version{margin-top:-.4045em;margin-bottom:.809em;font-weight:normal;color:rgba(255,255,255,0.3)}.wy-nav .wy-menu-vertical header{color:#2980B9}.wy-nav .wy-menu-vertical a{color:#b3b3b3}.wy-nav .wy-menu-vertical a:hover{background-color:#2980B9;color:#fff}[data-menu-wrap]{-webkit-transition:all .2s ease-in;-moz-transition:all .2s ease-in;transition:all .2s ease-in;position:absolute;opacity:1;width:100%;opacity:0}[data-menu-wrap].move-center{left:0;right:auto;opacity:1}[data-menu-wrap].move-left{right:auto;left:-100%;opacity:0}[data-menu-wrap].move-right{right:-100%;left:auto;opacity:0}.wy-body-for-nav{background:#fcfcfc}.wy-grid-for-nav{position:absolute;width:100%;height:100%}.wy-nav-side{position:fixed;top:0;bottom:0;left:0;padding-bottom:2em;width:300px;overflow-x:hidden;overflow-y:hidden;min-height:100%;color:#9b9b9b;background:#343131;z-index:200}.wy-side-scroll{width:320px;position:relative;overflow-x:hidden;overflow-y:scroll;height:100%}.wy-nav-top{display:none;background:#2980B9;color:#fff;padding:.4045em .809em;position:relative;line-height:50px;text-align:center;font-size:100%;*zoom:1}.wy-nav-top:before,.wy-nav-top:after{display:table;content:""}.wy-nav-top:after{clear:both}.wy-nav-top a{color:#fff;font-weight:bold}.wy-nav-top img{margin-right:12px;height:45px;width:45px;background-color:#2980B9;padding:5px;border-radius:100%}.wy-nav-top i{font-size:30px;float:left;cursor:pointer;padding-top:inherit}.wy-nav-content-wrap{margin-left:300px;background:#fcfcfc;min-height:100%}.wy-nav-content{padding:1.618em 3.236em;height:100%;max-width:800px;margin:auto}.wy-body-mask{position:fixed;width:100%;height:100%;background:rgba(0,0,0,0.2);display:none;z-index:499}.wy-body-mask.on{display:block}footer{color:gray}footer p{margin-bottom:12px}footer span.commit code,footer span.commit .rst-content tt,.rst-content footer span.commit tt{padding:0px;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;font-size:1em;background:none;border:none;color:gray}.rst-footer-buttons{*zoom:1}.rst-footer-buttons:before,.rst-footer-buttons:after{width:100%}.rst-footer-buttons:before,.rst-footer-buttons:after{display:table;content:""}.rst-footer-buttons:after{clear:both}.rst-breadcrumbs-buttons{margin-top:12px;*zoom:1}.rst-breadcrumbs-buttons:before,.rst-breadcrumbs-buttons:after{display:table;content:""}.rst-breadcrumbs-buttons:after{clear:both}#search-results .search li{margin-bottom:24px;border-bottom:solid 1px #e1e4e5;padding-bottom:24px}#search-results .search li:first-child{border-top:solid 1px #e1e4e5;padding-top:24px}#search-results .search li a{font-size:120%;margin-bottom:12px;display:inline-block}#search-results .context{color:gray;font-size:90%}.genindextable li>ul{margin-left:24px}@media screen and (max-width: 768px){.wy-body-for-nav{background:#fcfcfc}.wy-nav-top{display:block}.wy-nav-side{left:-300px}.wy-nav-side.shift{width:85%;left:0}.wy-side-scroll{width:auto}.wy-side-nav-search{width:auto}.wy-menu.wy-menu-vertical{width:auto}.wy-nav-content-wrap{margin-left:0}.wy-nav-content-wrap .wy-nav-content{padding:1.618em}.wy-nav-content-wrap.shift{position:fixed;min-width:100%;left:85%;top:0;height:100%;overflow:hidden}}@media screen and (min-width: 1100px){.wy-nav-content-wrap{background:rgba(0,0,0,0.05)}.wy-nav-content{margin:0;background:#fcfcfc}}@media print{.rst-versions,footer,.wy-nav-side{display:none}.wy-nav-content-wrap{margin-left:0}}.rst-versions{position:fixed;bottom:0;left:0;width:300px;color:#fcfcfc;background:#1f1d1d;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;z-index:400}.rst-versions a{color:#2980B9;text-decoration:none}.rst-versions .rst-badge-small{display:none}.rst-versions .rst-current-version{padding:12px;background-color:#272525;display:block;text-align:right;font-size:90%;cursor:pointer;color:#27AE60;*zoom:1}.rst-versions .rst-current-version:before,.rst-versions .rst-current-version:after{display:table;content:""}.rst-versions .rst-current-version:after{clear:both}.rst-versions .rst-current-version .fa,.rst-versions .rst-current-version .wy-menu-vertical li button.toctree-expand,.wy-menu-vertical li .rst-versions .rst-current-version button.toctree-expand,.rst-versions .rst-current-version .rst-content .admonition-title,.rst-content .rst-versions .rst-current-version .admonition-title,.rst-versions .rst-current-version .rst-content h1 .headerlink,.rst-content h1 .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content h2 .headerlink,.rst-content h2 .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content h3 .headerlink,.rst-content h3 .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content h4 .headerlink,.rst-content h4 .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content h5 .headerlink,.rst-content h5 .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content h6 .headerlink,.rst-content h6 .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content dl dt .headerlink,.rst-content dl dt .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content p .headerlink,.rst-content p .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content table>caption .headerlink,.rst-content table>caption .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content .code-block-caption .headerlink,.rst-content .code-block-caption .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content .eqno .headerlink,.rst-content .eqno .rst-versions .rst-current-version .headerlink,.rst-versions .rst-current-version .rst-content tt.download span:first-child,.rst-content tt.download .rst-versions .rst-current-version span:first-child,.rst-versions .rst-current-version .rst-content code.download span:first-child,.rst-content code.download .rst-versions .rst-current-version span:first-child,.rst-versions .rst-current-version .icon{color:#fcfcfc}.rst-versions .rst-current-version .fa-book,.rst-versions .rst-current-version .icon-book{float:left}.rst-versions .rst-current-version .icon-book{float:left}.rst-versions .rst-current-version.rst-out-of-date{background-color:#E74C3C;color:#fff}.rst-versions .rst-current-version.rst-active-old-version{background-color:#F1C40F;color:#000}.rst-versions.shift-up{height:auto;max-height:100%;overflow-y:scroll}.rst-versions.shift-up .rst-other-versions{display:block}.rst-versions .rst-other-versions{font-size:90%;padding:12px;color:gray;display:none}.rst-versions .rst-other-versions hr{display:block;height:1px;border:0;margin:20px 0;padding:0;border-top:solid 1px #413d3d}.rst-versions .rst-other-versions dd{display:inline-block;margin:0}.rst-versions .rst-other-versions dd a{display:inline-block;padding:6px;color:#fcfcfc}.rst-versions.rst-badge{width:auto;bottom:20px;right:20px;left:auto;border:none;max-width:300px;max-height:90%}.rst-versions.rst-badge .icon-book{float:none;line-height:30px}.rst-versions.rst-badge .fa-book,.rst-versions.rst-badge .icon-book{float:none;line-height:30px}.rst-versions.rst-badge.shift-up .rst-current-version{text-align:right}.rst-versions.rst-badge.shift-up .rst-current-version .fa-book,.rst-versions.rst-badge.shift-up .rst-current-version .icon-book{float:left}.rst-versions.rst-badge.shift-up .rst-current-version .icon-book{float:left}.rst-versions.rst-badge>.rst-current-version{width:auto;height:30px;line-height:30px;padding:0 6px;display:block;text-align:center}@media screen and (max-width: 768px){.rst-versions{width:85%;display:none}.rst-versions.shift{display:block}}.rst-content h1,.rst-content h2,.rst-content .toctree-wrapper>p.caption,.rst-content h3,.rst-content h4,.rst-content h5,.rst-content h6{margin-bottom:24px}.rst-content img{max-width:100%;height:auto}.rst-content div.figure,.rst-content figure{margin-bottom:24px}.rst-content div.figure .caption-text,.rst-content figure .caption-text{font-style:italic}.rst-content div.figure p:last-child.caption,.rst-content figure p:last-child.caption{margin-bottom:0px}.rst-content div.figure.align-center,.rst-content figure.align-center{text-align:center}.rst-content .section>img,.rst-content .section>a>img,.rst-content section>img,.rst-content section>a>img{margin-bottom:24px}.rst-content abbr[title]{text-decoration:none}.rst-content.style-external-links a.reference.external:after{font-family:FontAwesome;content:"";color:#b3b3b3;vertical-align:super;font-size:60%;margin:0 .2em}.rst-content blockquote{margin-left:24px;line-height:24px;margin-bottom:24px}.rst-content pre.literal-block{white-space:pre;margin:0;padding:12px 12px;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;display:block;overflow:auto}.rst-content pre.literal-block,.rst-content div[class^='highlight']{border:1px solid #e1e4e5;overflow-x:auto;margin:1px 0 24px 0}.rst-content pre.literal-block div[class^='highlight'],.rst-content div[class^='highlight'] div[class^='highlight']{padding:0px;border:none;margin:0}.rst-content div[class^='highlight'] td.code{width:100%}.rst-content .linenodiv pre{border-right:solid 1px #e6e9ea;margin:0;padding:12px 12px;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;user-select:none;pointer-events:none}.rst-content div[class^='highlight'] pre{white-space:pre;margin:0;padding:12px 12px;display:block;overflow:auto}.rst-content div[class^='highlight'] pre .hll{display:block;margin:0 -12px;padding:0 12px}.rst-content pre.literal-block,.rst-content div[class^='highlight'] pre,.rst-content .linenodiv pre{font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;font-size:12px;line-height:1.4}.rst-content div.highlight span.linenos,.rst-content div.highlight .gp{user-select:none;pointer-events:none}.rst-content div.highlight span.linenos{display:inline-block;padding-left:0px;padding-right:12px;margin-right:12px;border-right:1px solid #e6e9ea}.rst-content .code-block-caption{font-style:italic;font-size:85%;line-height:1;padding:1em 0;text-align:center}@media print{.rst-content .codeblock,.rst-content div[class^='highlight'],.rst-content div[class^='highlight'] pre{white-space:pre-wrap}}.rst-content .note,.rst-content .attention,.rst-content .caution,.rst-content .danger,.rst-content .error,.rst-content .hint,.rst-content .important,.rst-content .tip,.rst-content .warning,.rst-content .seealso,.rst-content .admonition-todo,.rst-content .admonition{clear:both}.rst-content .note .last,.rst-content .note>*:last-child,.rst-content .attention .last,.rst-content .attention>*:last-child,.rst-content .caution .last,.rst-content .caution>*:last-child,.rst-content .danger .last,.rst-content .danger>*:last-child,.rst-content .error .last,.rst-content .error>*:last-child,.rst-content .hint .last,.rst-content .hint>*:last-child,.rst-content .important .last,.rst-content .important>*:last-child,.rst-content .tip .last,.rst-content .tip>*:last-child,.rst-content .warning .last,.rst-content .warning>*:last-child,.rst-content .seealso .last,.rst-content .seealso>*:last-child,.rst-content .admonition-todo .last,.rst-content .admonition-todo>*:last-child,.rst-content .admonition .last,.rst-content .admonition>*:last-child{margin-bottom:0}.rst-content .admonition-title:before{margin-right:4px}.rst-content .admonition table{border-color:rgba(0,0,0,0.1)}.rst-content .admonition table td,.rst-content .admonition table th{background:transparent !important;border-color:rgba(0,0,0,0.1) !important}.rst-content .section ol.loweralpha,.rst-content .section ol.loweralpha>li,.rst-content section ol.loweralpha,.rst-content section ol.loweralpha>li,.rst-content .toctree-wrapper ol.loweralpha,.rst-content .toctree-wrapper ol.loweralpha>li{list-style:lower-alpha}.rst-content .section ol.upperalpha,.rst-content .section ol.upperalpha>li,.rst-content section ol.upperalpha,.rst-content section ol.upperalpha>li,.rst-content .toctree-wrapper ol.upperalpha,.rst-content .toctree-wrapper ol.upperalpha>li{list-style:upper-alpha}.rst-content .section ol li>*,.rst-content .section ul li>*,.rst-content section ol li>*,.rst-content section ul li>*,.rst-content .toctree-wrapper ol li>*,.rst-content .toctree-wrapper ul li>*{margin-top:12px;margin-bottom:12px}.rst-content .section ol li>*:first-child,.rst-content .section ul li>*:first-child,.rst-content section ol li>*:first-child,.rst-content section ul li>*:first-child,.rst-content .toctree-wrapper ol li>*:first-child,.rst-content .toctree-wrapper ul li>*:first-child{margin-top:0rem}.rst-content .section ol li>p,.rst-content .section ol li>p:last-child,.rst-content .section ul li>p,.rst-content .section ul li>p:last-child,.rst-content section ol li>p,.rst-content section ol li>p:last-child,.rst-content section ul li>p,.rst-content section ul li>p:last-child,.rst-content .toctree-wrapper ol li>p,.rst-content .toctree-wrapper ol li>p:last-child,.rst-content .toctree-wrapper ul li>p,.rst-content .toctree-wrapper ul li>p:last-child{margin-bottom:12px}.rst-content .section ol li>p:only-child,.rst-content .section ol li>p:only-child:last-child,.rst-content .section ul li>p:only-child,.rst-content .section ul li>p:only-child:last-child,.rst-content section ol li>p:only-child,.rst-content section ol li>p:only-child:last-child,.rst-content section ul li>p:only-child,.rst-content section ul li>p:only-child:last-child,.rst-content .toctree-wrapper ol li>p:only-child,.rst-content .toctree-wrapper ol li>p:only-child:last-child,.rst-content .toctree-wrapper ul li>p:only-child,.rst-content .toctree-wrapper ul li>p:only-child:last-child{margin-bottom:0rem}.rst-content .section ol li>ul,.rst-content .section ol li>ol,.rst-content .section ul li>ul,.rst-content .section ul li>ol,.rst-content section ol li>ul,.rst-content section ol li>ol,.rst-content section ul li>ul,.rst-content section ul li>ol,.rst-content .toctree-wrapper ol li>ul,.rst-content .toctree-wrapper ol li>ol,.rst-content .toctree-wrapper ul li>ul,.rst-content .toctree-wrapper ul li>ol{margin-bottom:12px}.rst-content .section ol.simple li>*,.rst-content .section ul.simple li>*,.rst-content section ol.simple li>*,.rst-content section ul.simple li>*,.rst-content .toctree-wrapper ol.simple li>*,.rst-content .toctree-wrapper ul.simple li>*{margin-top:0rem;margin-bottom:0rem}.rst-content .section ol.simple li ul,.rst-content .section ol.simple li ol,.rst-content .section ul.simple li ul,.rst-content .section ul.simple li ol,.rst-content section ol.simple li ul,.rst-content section ol.simple li ol,.rst-content section ul.simple li ul,.rst-content section ul.simple li ol,.rst-content .toctree-wrapper ol.simple li ul,.rst-content .toctree-wrapper ol.simple li ol,.rst-content .toctree-wrapper ul.simple li ul,.rst-content .toctree-wrapper ul.simple li ol{margin-top:0rem;margin-bottom:0rem}.rst-content .line-block{margin-left:0px;margin-bottom:24px;line-height:24px}.rst-content .line-block .line-block{margin-left:24px;margin-bottom:0px}.rst-content .topic-title{font-weight:bold;margin-bottom:12px}.rst-content .toc-backref{color:#404040}.rst-content .align-right{float:right;margin:0px 0px 24px 24px}.rst-content .align-left{float:left;margin:0px 24px 24px 0px}.rst-content .align-center{margin:auto}.rst-content .align-center:not(table){display:block}.rst-content h1 .headerlink,.rst-content h2 .headerlink,.rst-content .toctree-wrapper>p.caption .headerlink,.rst-content h3 .headerlink,.rst-content h4 .headerlink,.rst-content h5 .headerlink,.rst-content h6 .headerlink,.rst-content dl dt .headerlink,.rst-content p .headerlink,.rst-content p.caption .headerlink,.rst-content table>caption .headerlink,.rst-content .code-block-caption .headerlink,.rst-content .eqno .headerlink{opacity:0;font-size:14px;font-family:FontAwesome;margin-left:.5em}.rst-content h1 .headerlink:focus,.rst-content h2 .headerlink:focus,.rst-content .toctree-wrapper>p.caption .headerlink:focus,.rst-content h3 .headerlink:focus,.rst-content h4 .headerlink:focus,.rst-content h5 .headerlink:focus,.rst-content h6 .headerlink:focus,.rst-content dl dt .headerlink:focus,.rst-content p .headerlink:focus,.rst-content p.caption .headerlink:focus,.rst-content table>caption .headerlink:focus,.rst-content .code-block-caption .headerlink:focus,.rst-content .eqno .headerlink:focus{opacity:1}.rst-content h1:hover .headerlink,.rst-content h2:hover .headerlink,.rst-content .toctree-wrapper>p.caption:hover .headerlink,.rst-content h3:hover .headerlink,.rst-content h4:hover .headerlink,.rst-content h5:hover .headerlink,.rst-content h6:hover .headerlink,.rst-content dl dt:hover .headerlink,.rst-content p:hover .headerlink,.rst-content p.caption:hover .headerlink,.rst-content table>caption:hover .headerlink,.rst-content .code-block-caption:hover .headerlink,.rst-content .eqno:hover .headerlink{opacity:1}.rst-content .btn:focus{outline:2px solid}.rst-content table>caption .headerlink:after{font-size:12px}.rst-content .centered{text-align:center}.rst-content .sidebar{float:right;width:40%;display:block;margin:0 0 24px 24px;padding:24px;background:#f3f6f6;border:solid 1px #e1e4e5}.rst-content .sidebar p,.rst-content .sidebar ul,.rst-content .sidebar dl{font-size:90%}.rst-content .sidebar .last,.rst-content .sidebar>*:last-child{margin-bottom:0}.rst-content .sidebar .sidebar-title{display:block;font-family:"Roboto Slab","ff-tisa-web-pro","Georgia",Arial,sans-serif;font-weight:bold;background:#e1e4e5;padding:6px 12px;margin:-24px;margin-bottom:24px;font-size:100%}.rst-content .highlighted{background:#F1C40F;box-shadow:0 0 0 2px #F1C40F;display:inline;font-weight:bold}.rst-content .footnote-reference,.rst-content .citation-reference{vertical-align:baseline;position:relative;top:-0.4em;line-height:0;font-size:90%}.rst-content .hlist{width:100%}.rst-content dl dt span.classifier:before{content:" : "}.rst-content dl dt span.classifier-delimiter{display:none !important}html.writer-html4 .rst-content table.docutils.citation,html.writer-html4 .rst-content table.docutils.footnote{background:none;border:none}html.writer-html4 .rst-content table.docutils.citation td,html.writer-html4 .rst-content table.docutils.citation tr,html.writer-html4 .rst-content table.docutils.footnote td,html.writer-html4 .rst-content table.docutils.footnote tr{border:none;background-color:transparent !important;white-space:normal}html.writer-html4 .rst-content table.docutils.citation td.label,html.writer-html4 .rst-content table.docutils.footnote td.label{padding-left:0;padding-right:0;vertical-align:top}html.writer-html5 .rst-content dl.footnote,html.writer-html5 .rst-content dl.field-list{display:grid;grid-template-columns:max-content auto}html.writer-html5 .rst-content dl.footnote>dt,html.writer-html5 .rst-content dl.field-list>dt{padding-left:1rem}html.writer-html5 .rst-content dl.footnote>dt:after,html.writer-html5 .rst-content dl.field-list>dt:after{content:":"}html.writer-html5 .rst-content dl.footnote>dt,html.writer-html5 .rst-content dl.footnote>dd,html.writer-html5 .rst-content dl.field-list>dt,html.writer-html5 .rst-content dl.field-list>dd{margin-bottom:0rem}html.writer-html5 .rst-content dl.footnote{font-size:.9rem}html.writer-html5 .rst-content dl.footnote>dt{margin:0rem .5rem .5rem 0rem;line-height:1.2rem;word-break:break-all;font-weight:normal}html.writer-html5 .rst-content dl.footnote>dt>span.brackets{margin-right:.5rem}html.writer-html5 .rst-content dl.footnote>dt>span.brackets:before{content:"["}html.writer-html5 .rst-content dl.footnote>dt>span.brackets:after{content:"]"}html.writer-html5 .rst-content dl.footnote>dt>span.fn-backref{font-style:italic}html.writer-html5 .rst-content dl.footnote>dd{margin:0rem 0rem .5rem 0rem;line-height:1.2rem}html.writer-html5 .rst-content dl.footnote>dd p{font-size:.9rem}html.writer-html5 .rst-content dl.option-list kbd{font-size:.9rem}html.writer-html4 .rst-content table.docutils.citation,.rst-content table.docutils.footnote,html.writer-html5 .rst-content dl.footnote{color:gray}html.writer-html4 .rst-content table.docutils.citation tt,html.writer-html4 .rst-content table.docutils.citation code,.rst-content table.docutils.footnote tt,.rst-content table.docutils.footnote code,html.writer-html5 .rst-content dl.footnote tt,html.writer-html5 .rst-content dl.footnote code{color:#555}.rst-content .wy-table-responsive.citation,.rst-content .wy-table-responsive.footnote{margin-bottom:0}.rst-content .wy-table-responsive.citation+:not(.citation),.rst-content .wy-table-responsive.footnote+:not(.footnote){margin-top:24px}.rst-content .wy-table-responsive.citation:last-child,.rst-content .wy-table-responsive.footnote:last-child{margin-bottom:24px}.rst-content table.docutils th{border-color:#e1e4e5}html.writer-html5 .rst-content table.docutils th{border:1px solid #e1e4e5}html.writer-html5 .rst-content table.docutils th>p,html.writer-html5 .rst-content table.docutils td>p{line-height:1rem;margin-bottom:0rem;font-size:.9rem}.rst-content table.docutils td .last,.rst-content table.docutils td .last>*:last-child{margin-bottom:0}.rst-content table.field-list{border:none}.rst-content table.field-list td{border:none}.rst-content table.field-list td p{font-size:inherit;line-height:inherit}.rst-content table.field-list td>strong{display:inline-block}.rst-content table.field-list .field-name{padding-right:10px;text-align:left;white-space:nowrap}.rst-content table.field-list .field-body{text-align:left}.rst-content tt,.rst-content tt,.rst-content code{color:#000;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;padding:2px 5px}.rst-content tt big,.rst-content tt em,.rst-content tt big,.rst-content code big,.rst-content tt em,.rst-content code em{font-size:100% !important;line-height:normal}.rst-content tt.literal,.rst-content tt.literal,.rst-content code.literal{color:#E74C3C;white-space:normal}.rst-content tt.xref,a .rst-content tt,.rst-content tt.xref,.rst-content code.xref,a .rst-content tt,a .rst-content code{font-weight:bold;color:#404040}.rst-content pre,.rst-content kbd,.rst-content samp{font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace}.rst-content a tt,.rst-content a tt,.rst-content a code{color:#2980B9}.rst-content dl{margin-bottom:24px}.rst-content dl dt{font-weight:bold;margin-bottom:12px}.rst-content dl p,.rst-content dl table,.rst-content dl ul,.rst-content dl ol{margin-bottom:12px}.rst-content dl dd{margin:0 0 12px 24px;line-height:24px}html.writer-html4 .rst-content dl:not(.docutils),html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple){margin-bottom:24px}html.writer-html4 .rst-content dl:not(.docutils)>dt,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple)>dt{display:table;margin:6px 0;font-size:90%;line-height:normal;background:#e7f2fa;color:#2980B9;border-top:solid 3px #6ab0de;padding:6px;position:relative}html.writer-html4 .rst-content dl:not(.docutils)>dt:before,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple)>dt:before{color:#6ab0de}html.writer-html4 .rst-content dl:not(.docutils)>dt .headerlink,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple)>dt .headerlink{color:#404040;font-size:100% !important}html.writer-html4 .rst-content dl:not(.docutils) dl:not(.field-list)>dt,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) dl:not(.field-list)>dt{margin-bottom:6px;border:none;border-left:solid 3px #ccc;background:#f0f0f0;color:#555}html.writer-html4 .rst-content dl:not(.docutils) dl:not(.field-list)>dt .headerlink,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) dl:not(.field-list)>dt .headerlink{color:#404040;font-size:100% !important}html.writer-html4 .rst-content dl:not(.docutils)>dt:first-child,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple)>dt:first-child{margin-top:0}html.writer-html4 .rst-content dl:not(.docutils) tt.descname,html.writer-html4 .rst-content dl:not(.docutils) tt.descclassname,html.writer-html4 .rst-content dl:not(.docutils) tt.descname,html.writer-html4 .rst-content dl:not(.docutils) code.descname,html.writer-html4 .rst-content dl:not(.docutils) tt.descclassname,html.writer-html4 .rst-content dl:not(.docutils) code.descclassname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) tt.descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) tt.descclassname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) tt.descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) code.descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) tt.descclassname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) code.descclassname{background-color:transparent;border:none;padding:0;font-size:100% !important}html.writer-html4 .rst-content dl:not(.docutils) tt.descname,html.writer-html4 .rst-content dl:not(.docutils) tt.descname,html.writer-html4 .rst-content dl:not(.docutils) code.descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) tt.descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) tt.descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) code.descname{font-weight:bold}html.writer-html4 .rst-content dl:not(.docutils) .optional,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) .optional{display:inline-block;padding:0 4px;color:#000;font-weight:bold}html.writer-html4 .rst-content dl:not(.docutils) .property,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) .property{display:inline-block;padding-right:8px;max-width:100%}html.writer-html4 .rst-content dl:not(.docutils) .k,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) .k{font-style:italic}html.writer-html4 .rst-content dl:not(.docutils) .sig-name,html.writer-html4 .rst-content dl:not(.docutils) .descname,html.writer-html4 .rst-content dl:not(.docutils) .descclassname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) .sig-name,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) .descname,html.writer-html5 .rst-content dl[class]:not(.option-list):not(.field-list):not(.footnote):not(.glossary):not(.simple) .descclassname{font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;color:#000}.rst-content .viewcode-link,.rst-content .viewcode-back{display:inline-block;color:#27AE60;font-size:80%;padding-left:24px}.rst-content .viewcode-back{display:block;float:right}.rst-content p.rubric{margin-bottom:12px;font-weight:bold}.rst-content tt.download,.rst-content code.download{background:inherit;padding:inherit;font-weight:normal;font-family:inherit;font-size:inherit;color:inherit;border:inherit;white-space:inherit}.rst-content tt.download span:first-child,.rst-content code.download span:first-child{-webkit-font-smoothing:subpixel-antialiased}.rst-content tt.download span:first-child:before,.rst-content code.download span:first-child:before{margin-right:4px}.rst-content .guilabel{border:1px solid #7fbbe3;background:#e7f2fa;font-size:80%;font-weight:700;border-radius:4px;padding:2.4px 6px;margin:auto 2px}.rst-content .versionmodified{font-style:italic}@media screen and (max-width: 480px){.rst-content .sidebar{width:100%}}span[id*='MathJax-Span']{color:#404040}.math{text-align:center}@font-face{font-family:"Lato";src:url("../fonts/Lato-Regular.woff2") format("woff2"),url("../fonts/Lato-Regular.ttf") format("truetype");font-weight:400;font-style:normal;font-display:block}@font-face{font-family:"Lato";src:url("../fonts/Lato-Bold.woff2") format("woff2"),url("../fonts/Lato-Bold.ttf") format("truetype");font-weight:700;font-style:normal;font-display:block}@font-face{font-family:"Lato";src:url("../fonts/Lato-BoldItalic.woff2") format("woff2"),url("../fonts/Lato-BoldItalic.ttf") format("truetype");font-weight:700;font-style:italic;font-display:block}@font-face{font-family:"Lato";src:url("../fonts/Lato-Italic.woff2") format("woff2"),url("../fonts/Lato-Italic.ttf") format("truetype");font-weight:400;font-style:italic;font-display:block}@font-face{font-family:"Roboto Slab";font-style:normal;font-weight:400;src:url("../fonts/RobotoSlab-Regular.woff2") format("woff2");font-display:block}@font-face{font-family:"Roboto Slab";font-style:normal;font-weight:700;src:url("../fonts/RobotoSlab-Bold.woff2") format("woff2");font-display:block}
diff --git a/_static/doctools.js b/_static/doctools.js
new file mode 100644
index 000000000..8cbf1b161
--- /dev/null
+++ b/_static/doctools.js
@@ -0,0 +1,323 @@
+/*
+ * doctools.js
+ * ~~~~~~~~~~~
+ *
+ * Sphinx JavaScript utilities for all documentation.
+ *
+ * :copyright: Copyright 2007-2021 by the Sphinx team, see AUTHORS.
+ * :license: BSD, see LICENSE for details.
+ *
+ */
+
+/**
+ * select a different prefix for underscore
+ */
+$u = _.noConflict();
+
+/**
+ * make the code below compatible with browsers without
+ * an installed firebug like debugger
+if (!window.console || !console.firebug) {
+  var names = ["log", "debug", "info", "warn", "error", "assert", "dir",
+    "dirxml", "group", "groupEnd", "time", "timeEnd", "count", "trace",
+    "profile", "profileEnd"];
+  window.console = {};
+  for (var i = 0; i < names.length; ++i)
+    window.console[names[i]] = function() {};
+}
+ */
+
+/**
+ * small helper function to urldecode strings
+ *
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURIComponent#Decoding_query_parameters_from_a_URL
+ */
+jQuery.urldecode = function(x) {
+  if (!x) {
+    return x
+  }
+  return decodeURIComponent(x.replace(/\+/g, ' '));
+};
+
+/**
+ * small helper function to urlencode strings
+ */
+jQuery.urlencode = encodeURIComponent;
+
+/**
+ * This function returns the parsed url parameters of the
+ * current request. Multiple values per key are supported,
+ * it will always return arrays of strings for the value parts.
+ */
+jQuery.getQueryParameters = function(s) {
+  if (typeof s === 'undefined')
+    s = document.location.search;
+  var parts = s.substr(s.indexOf('?') + 1).split('&');
+  var result = {};
+  for (var i = 0; i < parts.length; i++) {
+    var tmp = parts[i].split('=', 2);
+    var key = jQuery.urldecode(tmp[0]);
+    var value = jQuery.urldecode(tmp[1]);
+    if (key in result)
+      result[key].push(value);
+    else
+      result[key] = [value];
+  }
+  return result;
+};
+
+/**
+ * highlight a given string on a jquery object by wrapping it in
+ * span elements with the given class name.
+ */
+jQuery.fn.highlightText = function(text, className) {
+  function highlight(node, addItems) {
+    if (node.nodeType === 3) {
+      var val = node.nodeValue;
+      var pos = val.toLowerCase().indexOf(text);
+      if (pos >= 0 &&
+          !jQuery(node.parentNode).hasClass(className) &&
+          !jQuery(node.parentNode).hasClass("nohighlight")) {
+        var span;
+        var isInSVG = jQuery(node).closest("body, svg, foreignObject").is("svg");
+        if (isInSVG) {
+          span = document.createElementNS("http://www.w3.org/2000/svg", "tspan");
+        } else {
+          span = document.createElement("span");
+          span.className = className;
+        }
+        span.appendChild(document.createTextNode(val.substr(pos, text.length)));
+        node.parentNode.insertBefore(span, node.parentNode.insertBefore(
+          document.createTextNode(val.substr(pos + text.length)),
+          node.nextSibling));
+        node.nodeValue = val.substr(0, pos);
+        if (isInSVG) {
+          var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+          var bbox = node.parentElement.getBBox();
+          rect.x.baseVal.value = bbox.x;
+          rect.y.baseVal.value = bbox.y;
+          rect.width.baseVal.value = bbox.width;
+          rect.height.baseVal.value = bbox.height;
+          rect.setAttribute('class', className);
+          addItems.push({
+              "parent": node.parentNode,
+              "target": rect});
+        }
+      }
+    }
+    else if (!jQuery(node).is("button, select, textarea")) {
+      jQuery.each(node.childNodes, function() {
+        highlight(this, addItems);
+      });
+    }
+  }
+  var addItems = [];
+  var result = this.each(function() {
+    highlight(this, addItems);
+  });
+  for (var i = 0; i < addItems.length; ++i) {
+    jQuery(addItems[i].parent).before(addItems[i].target);
+  }
+  return result;
+};
+
+/*
+ * backward compatibility for jQuery.browser
+ * This will be supported until firefox bug is fixed.
+ */
+if (!jQuery.browser) {
+  jQuery.uaMatch = function(ua) {
+    ua = ua.toLowerCase();
+
+    var match = /(chrome)[ \/]([\w.]+)/.exec(ua) ||
+      /(webkit)[ \/]([\w.]+)/.exec(ua) ||
+      /(opera)(?:.*version|)[ \/]([\w.]+)/.exec(ua) ||
+      /(msie) ([\w.]+)/.exec(ua) ||
+      ua.indexOf("compatible") < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua) ||
+      [];
+
+    return {
+      browser: match[ 1 ] || "",
+      version: match[ 2 ] || "0"
+    };
+  };
+  jQuery.browser = {};
+  jQuery.browser[jQuery.uaMatch(navigator.userAgent).browser] = true;
+}
+
+/**
+ * Small JavaScript module for the documentation.
+ */
+var Documentation = {
+
+  init : function() {
+    this.fixFirefoxAnchorBug();
+    this.highlightSearchWords();
+    this.initIndexTable();
+    if (DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) {
+      this.initOnKeyListeners();
+    }
+  },
+
+  /**
+   * i18n support
+   */
+  TRANSLATIONS : {},
+  PLURAL_EXPR : function(n) { return n === 1 ? 0 : 1; },
+  LOCALE : 'unknown',
+
+  // gettext and ngettext don't access this so that the functions
+  // can safely bound to a different name (_ = Documentation.gettext)
+  gettext : function(string) {
+    var translated = Documentation.TRANSLATIONS[string];
+    if (typeof translated === 'undefined')
+      return string;
+    return (typeof translated === 'string') ? translated : translated[0];
+  },
+
+  ngettext : function(singular, plural, n) {
+    var translated = Documentation.TRANSLATIONS[singular];
+    if (typeof translated === 'undefined')
+      return (n == 1) ? singular : plural;
+    return translated[Documentation.PLURALEXPR(n)];
+  },
+
+  addTranslations : function(catalog) {
+    for (var key in catalog.messages)
+      this.TRANSLATIONS[key] = catalog.messages[key];
+    this.PLURAL_EXPR = new Function('n', 'return +(' + catalog.plural_expr + ')');
+    this.LOCALE = catalog.locale;
+  },
+
+  /**
+   * add context elements like header anchor links
+   */
+  addContextElements : function() {
+    $('div[id] > :header:first').each(function() {
+      $('<a class="headerlink">\u00B6</a>').
+      attr('href', '#' + this.id).
+      attr('title', _('Permalink to this headline')).
+      appendTo(this);
+    });
+    $('dt[id]').each(function() {
+      $('<a class="headerlink">\u00B6</a>').
+      attr('href', '#' + this.id).
+      attr('title', _('Permalink to this definition')).
+      appendTo(this);
+    });
+  },
+
+  /**
+   * workaround a firefox stupidity
+   * see: https://bugzilla.mozilla.org/show_bug.cgi?id=645075
+   */
+  fixFirefoxAnchorBug : function() {
+    if (document.location.hash && $.browser.mozilla)
+      window.setTimeout(function() {
+        document.location.href += '';
+      }, 10);
+  },
+
+  /**
+   * highlight the search words provided in the url in the text
+   */
+  highlightSearchWords : function() {
+    var params = $.getQueryParameters();
+    var terms = (params.highlight) ? params.highlight[0].split(/\s+/) : [];
+    if (terms.length) {
+      var body = $('div.body');
+      if (!body.length) {
+        body = $('body');
+      }
+      window.setTimeout(function() {
+        $.each(terms, function() {
+          body.highlightText(this.toLowerCase(), 'highlighted');
+        });
+      }, 10);
+      $('<p class="highlight-link"><a href="javascript:Documentation.' +
+        'hideSearchWords()">' + _('Hide Search Matches') + '</a></p>')
+          .appendTo($('#searchbox'));
+    }
+  },
+
+  /**
+   * init the domain index toggle buttons
+   */
+  initIndexTable : function() {
+    var togglers = $('img.toggler').click(function() {
+      var src = $(this).attr('src');
+      var idnum = $(this).attr('id').substr(7);
+      $('tr.cg-' + idnum).toggle();
+      if (src.substr(-9) === 'minus.png')
+        $(this).attr('src', src.substr(0, src.length-9) + 'plus.png');
+      else
+        $(this).attr('src', src.substr(0, src.length-8) + 'minus.png');
+    }).css('display', '');
+    if (DOCUMENTATION_OPTIONS.COLLAPSE_INDEX) {
+        togglers.click();
+    }
+  },
+
+  /**
+   * helper function to hide the search marks again
+   */
+  hideSearchWords : function() {
+    $('#searchbox .highlight-link').fadeOut(300);
+    $('span.highlighted').removeClass('highlighted');
+  },
+
+  /**
+   * make the url absolute
+   */
+  makeURL : function(relativeURL) {
+    return DOCUMENTATION_OPTIONS.URL_ROOT + '/' + relativeURL;
+  },
+
+  /**
+   * get the current relative url
+   */
+  getCurrentURL : function() {
+    var path = document.location.pathname;
+    var parts = path.split(/\//);
+    $.each(DOCUMENTATION_OPTIONS.URL_ROOT.split(/\//), function() {
+      if (this === '..')
+        parts.pop();
+    });
+    var url = parts.join('/');
+    return path.substring(url.lastIndexOf('/') + 1, path.length - 1);
+  },
+
+  initOnKeyListeners: function() {
+    $(document).keydown(function(event) {
+      var activeElementType = document.activeElement.tagName;
+      // don't navigate when in search box, textarea, dropdown or button
+      if (activeElementType !== 'TEXTAREA' && activeElementType !== 'INPUT' && activeElementType !== 'SELECT'
+          && activeElementType !== 'BUTTON' && !event.altKey && !event.ctrlKey && !event.metaKey
+          && !event.shiftKey) {
+        switch (event.keyCode) {
+          case 37: // left
+            var prevHref = $('link[rel="prev"]').prop('href');
+            if (prevHref) {
+              window.location.href = prevHref;
+              return false;
+            }
+            break;
+          case 39: // right
+            var nextHref = $('link[rel="next"]').prop('href');
+            if (nextHref) {
+              window.location.href = nextHref;
+              return false;
+            }
+            break;
+        }
+      }
+    });
+  }
+};
+
+// quick alias for translations
+_ = Documentation.gettext;
+
+$(document).ready(function() {
+  Documentation.init();
+});
diff --git a/_static/documentation_options.js b/_static/documentation_options.js
new file mode 100644
index 000000000..170fae217
--- /dev/null
+++ b/_static/documentation_options.js
@@ -0,0 +1,12 @@
+var DOCUMENTATION_OPTIONS = {
+    URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'),
+    VERSION: '3.16.01',
+    LANGUAGE: 'None',
+    COLLAPSE_INDEX: false,
+    BUILDER: 'html',
+    FILE_SUFFIX: '.html',
+    LINK_SUFFIX: '.html',
+    HAS_SOURCE: true,
+    SOURCELINK_SUFFIX: '.txt',
+    NAVIGATION_WITH_KEYS: false
+};
\ No newline at end of file
diff --git a/_static/file.png b/_static/file.png
new file mode 100644
index 000000000..a858a410e
Binary files /dev/null and b/_static/file.png differ
diff --git a/_static/fonts/Lato-Bold.ttf b/_static/fonts/Lato-Bold.ttf
new file mode 100644
index 000000000..70c4dd92b
Binary files /dev/null and b/_static/fonts/Lato-Bold.ttf differ
diff --git a/_static/fonts/Lato-Bold.woff2 b/_static/fonts/Lato-Bold.woff2
new file mode 100644
index 000000000..2ab3f6de6
Binary files /dev/null and b/_static/fonts/Lato-Bold.woff2 differ
diff --git a/_static/fonts/Lato-BoldItalic.ttf b/_static/fonts/Lato-BoldItalic.ttf
new file mode 100644
index 000000000..c0e84bc79
Binary files /dev/null and b/_static/fonts/Lato-BoldItalic.ttf differ
diff --git a/_static/fonts/Lato-BoldItalic.woff2 b/_static/fonts/Lato-BoldItalic.woff2
new file mode 100644
index 000000000..3cedab637
Binary files /dev/null and b/_static/fonts/Lato-BoldItalic.woff2 differ
diff --git a/_static/fonts/Lato-Italic.ttf b/_static/fonts/Lato-Italic.ttf
new file mode 100644
index 000000000..e7a31ce36
Binary files /dev/null and b/_static/fonts/Lato-Italic.ttf differ
diff --git a/_static/fonts/Lato-Italic.woff2 b/_static/fonts/Lato-Italic.woff2
new file mode 100644
index 000000000..005bd62b5
Binary files /dev/null and b/_static/fonts/Lato-Italic.woff2 differ
diff --git a/_static/fonts/Lato-Regular.ttf b/_static/fonts/Lato-Regular.ttf
new file mode 100644
index 000000000..b536f9558
Binary files /dev/null and b/_static/fonts/Lato-Regular.ttf differ
diff --git a/_static/fonts/Lato-Regular.woff2 b/_static/fonts/Lato-Regular.woff2
new file mode 100644
index 000000000..597115a06
Binary files /dev/null and b/_static/fonts/Lato-Regular.woff2 differ
diff --git a/_static/fonts/RobotoSlab-Bold.woff2 b/_static/fonts/RobotoSlab-Bold.woff2
new file mode 100644
index 000000000..40a6cbc8e
Binary files /dev/null and b/_static/fonts/RobotoSlab-Bold.woff2 differ
diff --git a/_static/fonts/RobotoSlab-Regular.woff2 b/_static/fonts/RobotoSlab-Regular.woff2
new file mode 100644
index 000000000..d36556f28
Binary files /dev/null and b/_static/fonts/RobotoSlab-Regular.woff2 differ
diff --git a/_static/fonts/fontawesome-webfont.eot b/_static/fonts/fontawesome-webfont.eot
new file mode 100644
index 000000000..e9f60ca95
Binary files /dev/null and b/_static/fonts/fontawesome-webfont.eot differ
diff --git a/_static/fonts/fontawesome-webfont.svg b/_static/fonts/fontawesome-webfont.svg
new file mode 100644
index 000000000..855c845e5
--- /dev/null
+++ b/_static/fonts/fontawesome-webfont.svg
@@ -0,0 +1,2671 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >
+<svg>
+<metadata>
+Created by FontForge 20120731 at Mon Oct 24 17:37:40 2016
+ By ,,,
+Copyright Dave Gandy 2016. All rights reserved.
+</metadata>
+<defs>
+<font id="FontAwesome" horiz-adv-x="1536" >
+  <font-face 
+    font-family="FontAwesome"
+    font-weight="400"
+    font-stretch="normal"
+    units-per-em="1792"
+    panose-1="0 0 0 0 0 0 0 0 0 0"
+    ascent="1536"
+    descent="-256"
+    bbox="-1.02083 -256.962 2304.6 1537.02"
+    underline-thickness="0"
+    underline-position="0"
+    unicode-range="U+0020-F500"
+  />
+<missing-glyph horiz-adv-x="896" 
+d="M224 112h448v1312h-448v-1312zM112 0v1536h672v-1536h-672z" />
+    <glyph glyph-name=".notdef" horiz-adv-x="896" 
+d="M224 112h448v1312h-448v-1312zM112 0v1536h672v-1536h-672z" />
+    <glyph glyph-name=".null" horiz-adv-x="0" 
+ />
+    <glyph glyph-name="nonmarkingreturn" horiz-adv-x="597" 
+ />
+    <glyph glyph-name="space" unicode=" " horiz-adv-x="448" 
+ />
+    <glyph glyph-name="dieresis" unicode="&#xa8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="copyright" unicode="&#xa9;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="registered" unicode="&#xae;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="acute" unicode="&#xb4;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="AE" unicode="&#xc6;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="Oslash" unicode="&#xd8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="trademark" unicode="&#x2122;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="infinity" unicode="&#x221e;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="notequal" unicode="&#x2260;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="glass" unicode="&#xf000;" horiz-adv-x="1792" 
+d="M1699 1350q0 -35 -43 -78l-632 -632v-768h320q26 0 45 -19t19 -45t-19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45t45 19h320v768l-632 632q-43 43 -43 78q0 23 18 36.5t38 17.5t43 4h1408q23 0 43 -4t38 -17.5t18 -36.5z" />
+    <glyph glyph-name="music" unicode="&#xf001;" 
+d="M1536 1312v-1120q0 -50 -34 -89t-86 -60.5t-103.5 -32t-96.5 -10.5t-96.5 10.5t-103.5 32t-86 60.5t-34 89t34 89t86 60.5t103.5 32t96.5 10.5q105 0 192 -39v537l-768 -237v-709q0 -50 -34 -89t-86 -60.5t-103.5 -32t-96.5 -10.5t-96.5 10.5t-103.5 32t-86 60.5t-34 89
+t34 89t86 60.5t103.5 32t96.5 10.5q105 0 192 -39v967q0 31 19 56.5t49 35.5l832 256q12 4 28 4q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="search" unicode="&#xf002;" horiz-adv-x="1664" 
+d="M1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1664 -128q0 -52 -38 -90t-90 -38q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5
+t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z" />
+    <glyph glyph-name="envelope" unicode="&#xf003;" horiz-adv-x="1792" 
+d="M1664 32v768q-32 -36 -69 -66q-268 -206 -426 -338q-51 -43 -83 -67t-86.5 -48.5t-102.5 -24.5h-1h-1q-48 0 -102.5 24.5t-86.5 48.5t-83 67q-158 132 -426 338q-37 30 -69 66v-768q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1664 1083v11v13.5t-0.5 13
+t-3 12.5t-5.5 9t-9 7.5t-14 2.5h-1472q-13 0 -22.5 -9.5t-9.5 -22.5q0 -168 147 -284q193 -152 401 -317q6 -5 35 -29.5t46 -37.5t44.5 -31.5t50.5 -27.5t43 -9h1h1q20 0 43 9t50.5 27.5t44.5 31.5t46 37.5t35 29.5q208 165 401 317q54 43 100.5 115.5t46.5 131.5z
+M1792 1120v-1088q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="heart" unicode="&#xf004;" horiz-adv-x="1792" 
+d="M896 -128q-26 0 -44 18l-624 602q-10 8 -27.5 26t-55.5 65.5t-68 97.5t-53.5 121t-23.5 138q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5q224 0 351 -124t127 -344q0 -221 -229 -450l-623 -600
+q-18 -18 -44 -18z" />
+    <glyph glyph-name="star" unicode="&#xf005;" horiz-adv-x="1664" 
+d="M1664 889q0 -22 -26 -48l-363 -354l86 -500q1 -7 1 -20q0 -21 -10.5 -35.5t-30.5 -14.5q-19 0 -40 12l-449 236l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41t49 -41l225 -455
+l502 -73q56 -9 56 -46z" />
+    <glyph glyph-name="star_empty" unicode="&#xf006;" horiz-adv-x="1664" 
+d="M1137 532l306 297l-422 62l-189 382l-189 -382l-422 -62l306 -297l-73 -421l378 199l377 -199zM1664 889q0 -22 -26 -48l-363 -354l86 -500q1 -7 1 -20q0 -50 -41 -50q-19 0 -40 12l-449 236l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500
+l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41t49 -41l225 -455l502 -73q56 -9 56 -46z" />
+    <glyph glyph-name="user" unicode="&#xf007;" horiz-adv-x="1280" 
+d="M1280 137q0 -109 -62.5 -187t-150.5 -78h-854q-88 0 -150.5 78t-62.5 187q0 85 8.5 160.5t31.5 152t58.5 131t94 89t134.5 34.5q131 -128 313 -128t313 128q76 0 134.5 -34.5t94 -89t58.5 -131t31.5 -152t8.5 -160.5zM1024 1024q0 -159 -112.5 -271.5t-271.5 -112.5
+t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="film" unicode="&#xf008;" horiz-adv-x="1920" 
+d="M384 -64v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM384 320v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM384 704v128q0 26 -19 45t-45 19h-128
+q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1408 -64v512q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-512q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM384 1088v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45
+t45 -19h128q26 0 45 19t19 45zM1792 -64v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1408 704v512q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-512q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM1792 320v128
+q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1792 704v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1792 1088v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19
+t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1920 1248v-1344q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1344q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="th_large" unicode="&#xf009;" horiz-adv-x="1664" 
+d="M768 512v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM768 1280v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM1664 512v-384q0 -52 -38 -90t-90 -38
+h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM1664 1280v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="th" unicode="&#xf00a;" horiz-adv-x="1792" 
+d="M512 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 288v-192q0 -40 -28 -68t-68 -28h-320
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28
+h320q40 0 68 -28t28 -68zM1792 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 800v-192
+q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="th_list" unicode="&#xf00b;" horiz-adv-x="1792" 
+d="M512 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 288v-192q0 -40 -28 -68t-68 -28h-960
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h960q40 0 68 -28t28 -68zM512 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 800v-192q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v192q0 40 28 68t68 28
+h960q40 0 68 -28t28 -68zM1792 1312v-192q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h960q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="ok" unicode="&#xf00c;" horiz-adv-x="1792" 
+d="M1671 970q0 -40 -28 -68l-724 -724l-136 -136q-28 -28 -68 -28t-68 28l-136 136l-362 362q-28 28 -28 68t28 68l136 136q28 28 68 28t68 -28l294 -295l656 657q28 28 68 28t68 -28l136 -136q28 -28 28 -68z" />
+    <glyph glyph-name="remove" unicode="&#xf00d;" horiz-adv-x="1408" 
+d="M1298 214q0 -40 -28 -68l-136 -136q-28 -28 -68 -28t-68 28l-294 294l-294 -294q-28 -28 -68 -28t-68 28l-136 136q-28 28 -28 68t28 68l294 294l-294 294q-28 28 -28 68t28 68l136 136q28 28 68 28t68 -28l294 -294l294 294q28 28 68 28t68 -28l136 -136q28 -28 28 -68
+t-28 -68l-294 -294l294 -294q28 -28 28 -68z" />
+    <glyph glyph-name="zoom_in" unicode="&#xf00e;" horiz-adv-x="1664" 
+d="M1024 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-224v-224q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v224h-224q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h224v224q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5v-224h224
+q13 0 22.5 -9.5t9.5 -22.5zM1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1664 -128q0 -53 -37.5 -90.5t-90.5 -37.5q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5
+t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z" />
+    <glyph glyph-name="zoom_out" unicode="&#xf010;" horiz-adv-x="1664" 
+d="M1024 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-576q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h576q13 0 22.5 -9.5t9.5 -22.5zM1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5z
+M1664 -128q0 -53 -37.5 -90.5t-90.5 -37.5q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z
+" />
+    <glyph glyph-name="off" unicode="&#xf011;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61t-298 61t-245 164t-164 245t-61 298q0 182 80.5 343t226.5 270q43 32 95.5 25t83.5 -50q32 -42 24.5 -94.5t-49.5 -84.5q-98 -74 -151.5 -181t-53.5 -228q0 -104 40.5 -198.5t109.5 -163.5t163.5 -109.5
+t198.5 -40.5t198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5q0 121 -53.5 228t-151.5 181q-42 32 -49.5 84.5t24.5 94.5q31 43 84 50t95 -25q146 -109 226.5 -270t80.5 -343zM896 1408v-640q0 -52 -38 -90t-90 -38t-90 38t-38 90v640q0 52 38 90t90 38t90 -38t38 -90z" />
+    <glyph glyph-name="signal" unicode="&#xf012;" horiz-adv-x="1792" 
+d="M256 96v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM640 224v-320q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v320q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1024 480v-576q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23
+v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1408 864v-960q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 1376v-1472q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v1472q0 14 9 23t23 9h192q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="cog" unicode="&#xf013;" 
+d="M1024 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1536 749v-222q0 -12 -8 -23t-20 -13l-185 -28q-19 -54 -39 -91q35 -50 107 -138q10 -12 10 -25t-9 -23q-27 -37 -99 -108t-94 -71q-12 0 -26 9l-138 108q-44 -23 -91 -38
+q-16 -136 -29 -186q-7 -28 -36 -28h-222q-14 0 -24.5 8.5t-11.5 21.5l-28 184q-49 16 -90 37l-141 -107q-10 -9 -25 -9q-14 0 -25 11q-126 114 -165 168q-7 10 -7 23q0 12 8 23q15 21 51 66.5t54 70.5q-27 50 -41 99l-183 27q-13 2 -21 12.5t-8 23.5v222q0 12 8 23t19 13
+l186 28q14 46 39 92q-40 57 -107 138q-10 12 -10 24q0 10 9 23q26 36 98.5 107.5t94.5 71.5q13 0 26 -10l138 -107q44 23 91 38q16 136 29 186q7 28 36 28h222q14 0 24.5 -8.5t11.5 -21.5l28 -184q49 -16 90 -37l142 107q9 9 24 9q13 0 25 -10q129 -119 165 -170q7 -8 7 -22
+q0 -12 -8 -23q-15 -21 -51 -66.5t-54 -70.5q26 -50 41 -98l183 -28q13 -2 21 -12.5t8 -23.5z" />
+    <glyph glyph-name="trash" unicode="&#xf014;" horiz-adv-x="1408" 
+d="M512 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM768 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1024 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576
+q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1152 76v948h-896v-948q0 -22 7 -40.5t14.5 -27t10.5 -8.5h832q3 0 10.5 8.5t14.5 27t7 40.5zM480 1152h448l-48 117q-7 9 -17 11h-317q-10 -2 -17 -11zM1408 1120v-64q0 -14 -9 -23t-23 -9h-96v-948q0 -83 -47 -143.5t-113 -60.5h-832
+q-66 0 -113 58.5t-47 141.5v952h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h309l70 167q15 37 54 63t79 26h320q40 0 79 -26t54 -63l70 -167h309q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="home" unicode="&#xf015;" horiz-adv-x="1664" 
+d="M1408 544v-480q0 -26 -19 -45t-45 -19h-384v384h-256v-384h-384q-26 0 -45 19t-19 45v480q0 1 0.5 3t0.5 3l575 474l575 -474q1 -2 1 -6zM1631 613l-62 -74q-8 -9 -21 -11h-3q-13 0 -21 7l-692 577l-692 -577q-12 -8 -24 -7q-13 2 -21 11l-62 74q-8 10 -7 23.5t11 21.5
+l719 599q32 26 76 26t76 -26l244 -204v195q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-408l219 -182q10 -8 11 -21.5t-7 -23.5z" />
+    <glyph glyph-name="file_alt" unicode="&#xf016;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+" />
+    <glyph glyph-name="time" unicode="&#xf017;" 
+d="M896 992v-448q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="road" unicode="&#xf018;" horiz-adv-x="1920" 
+d="M1111 540v4l-24 320q-1 13 -11 22.5t-23 9.5h-186q-13 0 -23 -9.5t-11 -22.5l-24 -320v-4q-1 -12 8 -20t21 -8h244q12 0 21 8t8 20zM1870 73q0 -73 -46 -73h-704q13 0 22 9.5t8 22.5l-20 256q-1 13 -11 22.5t-23 9.5h-272q-13 0 -23 -9.5t-11 -22.5l-20 -256
+q-1 -13 8 -22.5t22 -9.5h-704q-46 0 -46 73q0 54 26 116l417 1044q8 19 26 33t38 14h339q-13 0 -23 -9.5t-11 -22.5l-15 -192q-1 -14 8 -23t22 -9h166q13 0 22 9t8 23l-15 192q-1 13 -11 22.5t-23 9.5h339q20 0 38 -14t26 -33l417 -1044q26 -62 26 -116z" />
+    <glyph glyph-name="download_alt" unicode="&#xf019;" horiz-adv-x="1664" 
+d="M1280 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 416v-320q0 -40 -28 -68t-68 -28h-1472q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h465l135 -136
+q58 -56 136 -56t136 56l136 136h464q40 0 68 -28t28 -68zM1339 985q17 -41 -14 -70l-448 -448q-18 -19 -45 -19t-45 19l-448 448q-31 29 -14 70q17 39 59 39h256v448q0 26 19 45t45 19h256q26 0 45 -19t19 -45v-448h256q42 0 59 -39z" />
+    <glyph glyph-name="download" unicode="&#xf01a;" 
+d="M1120 608q0 -12 -10 -24l-319 -319q-11 -9 -23 -9t-23 9l-320 320q-15 16 -7 35q8 20 30 20h192v352q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-352h192q14 0 23 -9t9 -23zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273
+t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="upload" unicode="&#xf01b;" 
+d="M1118 660q-8 -20 -30 -20h-192v-352q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v352h-192q-14 0 -23 9t-9 23q0 12 10 24l319 319q11 9 23 9t23 -9l320 -320q15 -16 7 -35zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198
+t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="inbox" unicode="&#xf01c;" 
+d="M1023 576h316q-1 3 -2.5 8.5t-2.5 7.5l-212 496h-708l-212 -496q-1 -3 -2.5 -8.5t-2.5 -7.5h316l95 -192h320zM1536 546v-482q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v482q0 62 25 123l238 552q10 25 36.5 42t52.5 17h832q26 0 52.5 -17t36.5 -42l238 -552
+q25 -61 25 -123z" />
+    <glyph glyph-name="play_circle" unicode="&#xf01d;" 
+d="M1184 640q0 -37 -32 -55l-544 -320q-15 -9 -32 -9q-16 0 -32 8q-32 19 -32 56v640q0 37 32 56q33 18 64 -1l544 -320q32 -18 32 -55zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="repeat" unicode="&#xf01e;" 
+d="M1536 1280v-448q0 -26 -19 -45t-45 -19h-448q-42 0 -59 40q-17 39 14 69l138 138q-148 137 -349 137q-104 0 -198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5q119 0 225 52t179 147q7 10 23 12q15 0 25 -9
+l137 -138q9 -8 9.5 -20.5t-7.5 -22.5q-109 -132 -264 -204.5t-327 -72.5q-156 0 -298 61t-245 164t-164 245t-61 298t61 298t164 245t245 164t298 61q147 0 284.5 -55.5t244.5 -156.5l130 129q29 31 70 14q39 -17 39 -59z" />
+    <glyph glyph-name="refresh" unicode="&#xf021;" 
+d="M1511 480q0 -5 -1 -7q-64 -268 -268 -434.5t-478 -166.5q-146 0 -282.5 55t-243.5 157l-129 -129q-19 -19 -45 -19t-45 19t-19 45v448q0 26 19 45t45 19h448q26 0 45 -19t19 -45t-19 -45l-137 -137q71 -66 161 -102t187 -36q134 0 250 65t186 179q11 17 53 117
+q8 23 30 23h192q13 0 22.5 -9.5t9.5 -22.5zM1536 1280v-448q0 -26 -19 -45t-45 -19h-448q-26 0 -45 19t-19 45t19 45l138 138q-148 137 -349 137q-134 0 -250 -65t-186 -179q-11 -17 -53 -117q-8 -23 -30 -23h-199q-13 0 -22.5 9.5t-9.5 22.5v7q65 268 270 434.5t480 166.5
+q146 0 284 -55.5t245 -156.5l130 129q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="list_alt" unicode="&#xf022;" horiz-adv-x="1792" 
+d="M384 352v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 608v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M384 864v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1536 352v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5t9.5 -22.5z
+M1536 608v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5t9.5 -22.5zM1536 864v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5
+t9.5 -22.5zM1664 160v832q0 13 -9.5 22.5t-22.5 9.5h-1472q-13 0 -22.5 -9.5t-9.5 -22.5v-832q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1792 1248v-1088q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1472q66 0 113 -47
+t47 -113z" />
+    <glyph glyph-name="lock" unicode="&#xf023;" horiz-adv-x="1152" 
+d="M320 768h512v192q0 106 -75 181t-181 75t-181 -75t-75 -181v-192zM1152 672v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h32v192q0 184 132 316t316 132t316 -132t132 -316v-192h32q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="flag" unicode="&#xf024;" horiz-adv-x="1792" 
+d="M320 1280q0 -72 -64 -110v-1266q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v1266q-64 38 -64 110q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -25 -12.5 -38.5t-39.5 -27.5q-215 -116 -369 -116q-61 0 -123.5 22t-108.5 48
+t-115.5 48t-142.5 22q-192 0 -464 -146q-17 -9 -33 -9q-26 0 -45 19t-19 45v742q0 32 31 55q21 14 79 43q236 120 421 120q107 0 200 -29t219 -88q38 -19 88 -19q54 0 117.5 21t110 47t88 47t54.5 21q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="headphones" unicode="&#xf025;" horiz-adv-x="1664" 
+d="M1664 650q0 -166 -60 -314l-20 -49l-185 -33q-22 -83 -90.5 -136.5t-156.5 -53.5v-32q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-32q71 0 130 -35.5t93 -95.5l68 12q29 95 29 193q0 148 -88 279t-236.5 209t-315.5 78
+t-315.5 -78t-236.5 -209t-88 -279q0 -98 29 -193l68 -12q34 60 93 95.5t130 35.5v32q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v32q-88 0 -156.5 53.5t-90.5 136.5l-185 33l-20 49q-60 148 -60 314q0 151 67 291t179 242.5
+t266 163.5t320 61t320 -61t266 -163.5t179 -242.5t67 -291z" />
+    <glyph glyph-name="volume_off" unicode="&#xf026;" horiz-adv-x="768" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="volume_down" unicode="&#xf027;" horiz-adv-x="1152" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45zM1152 640q0 -76 -42.5 -141.5t-112.5 -93.5q-10 -5 -25 -5q-26 0 -45 18.5t-19 45.5q0 21 12 35.5t29 25t34 23t29 36
+t12 56.5t-12 56.5t-29 36t-34 23t-29 25t-12 35.5q0 27 19 45.5t45 18.5q15 0 25 -5q70 -27 112.5 -93t42.5 -142z" />
+    <glyph glyph-name="volume_up" unicode="&#xf028;" horiz-adv-x="1664" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45zM1152 640q0 -76 -42.5 -141.5t-112.5 -93.5q-10 -5 -25 -5q-26 0 -45 18.5t-19 45.5q0 21 12 35.5t29 25t34 23t29 36
+t12 56.5t-12 56.5t-29 36t-34 23t-29 25t-12 35.5q0 27 19 45.5t45 18.5q15 0 25 -5q70 -27 112.5 -93t42.5 -142zM1408 640q0 -153 -85 -282.5t-225 -188.5q-13 -5 -25 -5q-27 0 -46 19t-19 45q0 39 39 59q56 29 76 44q74 54 115.5 135.5t41.5 173.5t-41.5 173.5
+t-115.5 135.5q-20 15 -76 44q-39 20 -39 59q0 26 19 45t45 19q13 0 26 -5q140 -59 225 -188.5t85 -282.5zM1664 640q0 -230 -127 -422.5t-338 -283.5q-13 -5 -26 -5q-26 0 -45 19t-19 45q0 36 39 59q7 4 22.5 10.5t22.5 10.5q46 25 82 51q123 91 192 227t69 289t-69 289
+t-192 227q-36 26 -82 51q-7 4 -22.5 10.5t-22.5 10.5q-39 23 -39 59q0 26 19 45t45 19q13 0 26 -5q211 -91 338 -283.5t127 -422.5z" />
+    <glyph glyph-name="qrcode" unicode="&#xf029;" horiz-adv-x="1408" 
+d="M384 384v-128h-128v128h128zM384 1152v-128h-128v128h128zM1152 1152v-128h-128v128h128zM128 129h384v383h-384v-383zM128 896h384v384h-384v-384zM896 896h384v384h-384v-384zM640 640v-640h-640v640h640zM1152 128v-128h-128v128h128zM1408 128v-128h-128v128h128z
+M1408 640v-384h-384v128h-128v-384h-128v640h384v-128h128v128h128zM640 1408v-640h-640v640h640zM1408 1408v-640h-640v640h640z" />
+    <glyph glyph-name="barcode" unicode="&#xf02a;" horiz-adv-x="1792" 
+d="M63 0h-63v1408h63v-1408zM126 1h-32v1407h32v-1407zM220 1h-31v1407h31v-1407zM377 1h-31v1407h31v-1407zM534 1h-62v1407h62v-1407zM660 1h-31v1407h31v-1407zM723 1h-31v1407h31v-1407zM786 1h-31v1407h31v-1407zM943 1h-63v1407h63v-1407zM1100 1h-63v1407h63v-1407z
+M1226 1h-63v1407h63v-1407zM1352 1h-63v1407h63v-1407zM1446 1h-63v1407h63v-1407zM1635 1h-94v1407h94v-1407zM1698 1h-32v1407h32v-1407zM1792 0h-63v1408h63v-1408z" />
+    <glyph glyph-name="tag" unicode="&#xf02b;" 
+d="M448 1088q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1515 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-53 0 -90 37l-715 716q-38 37 -64.5 101t-26.5 117v416q0 52 38 90t90 38h416q53 0 117 -26.5t102 -64.5
+l715 -714q37 -39 37 -91z" />
+    <glyph glyph-name="tags" unicode="&#xf02c;" horiz-adv-x="1920" 
+d="M448 1088q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1515 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-53 0 -90 37l-715 716q-38 37 -64.5 101t-26.5 117v416q0 52 38 90t90 38h416q53 0 117 -26.5t102 -64.5
+l715 -714q37 -39 37 -91zM1899 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-36 0 -59 14t-53 45l470 470q37 37 37 90q0 52 -37 91l-715 714q-38 38 -102 64.5t-117 26.5h224q53 0 117 -26.5t102 -64.5l715 -714q37 -39 37 -91z" />
+    <glyph glyph-name="book" unicode="&#xf02d;" horiz-adv-x="1664" 
+d="M1639 1058q40 -57 18 -129l-275 -906q-19 -64 -76.5 -107.5t-122.5 -43.5h-923q-77 0 -148.5 53.5t-99.5 131.5q-24 67 -2 127q0 4 3 27t4 37q1 8 -3 21.5t-3 19.5q2 11 8 21t16.5 23.5t16.5 23.5q23 38 45 91.5t30 91.5q3 10 0.5 30t-0.5 28q3 11 17 28t17 23
+q21 36 42 92t25 90q1 9 -2.5 32t0.5 28q4 13 22 30.5t22 22.5q19 26 42.5 84.5t27.5 96.5q1 8 -3 25.5t-2 26.5q2 8 9 18t18 23t17 21q8 12 16.5 30.5t15 35t16 36t19.5 32t26.5 23.5t36 11.5t47.5 -5.5l-1 -3q38 9 51 9h761q74 0 114 -56t18 -130l-274 -906
+q-36 -119 -71.5 -153.5t-128.5 -34.5h-869q-27 0 -38 -15q-11 -16 -1 -43q24 -70 144 -70h923q29 0 56 15.5t35 41.5l300 987q7 22 5 57q38 -15 59 -43zM575 1056q-4 -13 2 -22.5t20 -9.5h608q13 0 25.5 9.5t16.5 22.5l21 64q4 13 -2 22.5t-20 9.5h-608q-13 0 -25.5 -9.5
+t-16.5 -22.5zM492 800q-4 -13 2 -22.5t20 -9.5h608q13 0 25.5 9.5t16.5 22.5l21 64q4 13 -2 22.5t-20 9.5h-608q-13 0 -25.5 -9.5t-16.5 -22.5z" />
+    <glyph glyph-name="bookmark" unicode="&#xf02e;" horiz-adv-x="1280" 
+d="M1164 1408q23 0 44 -9q33 -13 52.5 -41t19.5 -62v-1289q0 -34 -19.5 -62t-52.5 -41q-19 -8 -44 -8q-48 0 -83 32l-441 424l-441 -424q-36 -33 -83 -33q-23 0 -44 9q-33 13 -52.5 41t-19.5 62v1289q0 34 19.5 62t52.5 41q21 9 44 9h1048z" />
+    <glyph glyph-name="print" unicode="&#xf02f;" horiz-adv-x="1664" 
+d="M384 0h896v256h-896v-256zM384 640h896v384h-160q-40 0 -68 28t-28 68v160h-640v-640zM1536 576q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 576v-416q0 -13 -9.5 -22.5t-22.5 -9.5h-224v-160q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68
+v160h-224q-13 0 -22.5 9.5t-9.5 22.5v416q0 79 56.5 135.5t135.5 56.5h64v544q0 40 28 68t68 28h672q40 0 88 -20t76 -48l152 -152q28 -28 48 -76t20 -88v-256h64q79 0 135.5 -56.5t56.5 -135.5z" />
+    <glyph glyph-name="camera" unicode="&#xf030;" horiz-adv-x="1920" 
+d="M960 864q119 0 203.5 -84.5t84.5 -203.5t-84.5 -203.5t-203.5 -84.5t-203.5 84.5t-84.5 203.5t84.5 203.5t203.5 84.5zM1664 1280q106 0 181 -75t75 -181v-896q0 -106 -75 -181t-181 -75h-1408q-106 0 -181 75t-75 181v896q0 106 75 181t181 75h224l51 136
+q19 49 69.5 84.5t103.5 35.5h512q53 0 103.5 -35.5t69.5 -84.5l51 -136h224zM960 128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="font" unicode="&#xf031;" horiz-adv-x="1664" 
+d="M725 977l-170 -450q33 0 136.5 -2t160.5 -2q19 0 57 2q-87 253 -184 452zM0 -128l2 79q23 7 56 12.5t57 10.5t49.5 14.5t44.5 29t31 50.5l237 616l280 724h75h53q8 -14 11 -21l205 -480q33 -78 106 -257.5t114 -274.5q15 -34 58 -144.5t72 -168.5q20 -45 35 -57
+q19 -15 88 -29.5t84 -20.5q6 -38 6 -57q0 -5 -0.5 -13.5t-0.5 -12.5q-63 0 -190 8t-191 8q-76 0 -215 -7t-178 -8q0 43 4 78l131 28q1 0 12.5 2.5t15.5 3.5t14.5 4.5t15 6.5t11 8t9 11t2.5 14q0 16 -31 96.5t-72 177.5t-42 100l-450 2q-26 -58 -76.5 -195.5t-50.5 -162.5
+q0 -22 14 -37.5t43.5 -24.5t48.5 -13.5t57 -8.5t41 -4q1 -19 1 -58q0 -9 -2 -27q-58 0 -174.5 10t-174.5 10q-8 0 -26.5 -4t-21.5 -4q-80 -14 -188 -14z" />
+    <glyph glyph-name="bold" unicode="&#xf032;" horiz-adv-x="1408" 
+d="M555 15q74 -32 140 -32q376 0 376 335q0 114 -41 180q-27 44 -61.5 74t-67.5 46.5t-80.5 25t-84 10.5t-94.5 2q-73 0 -101 -10q0 -53 -0.5 -159t-0.5 -158q0 -8 -1 -67.5t-0.5 -96.5t4.5 -83.5t12 -66.5zM541 761q42 -7 109 -7q82 0 143 13t110 44.5t74.5 89.5t25.5 142
+q0 70 -29 122.5t-79 82t-108 43.5t-124 14q-50 0 -130 -13q0 -50 4 -151t4 -152q0 -27 -0.5 -80t-0.5 -79q0 -46 1 -69zM0 -128l2 94q15 4 85 16t106 27q7 12 12.5 27t8.5 33.5t5.5 32.5t3 37.5t0.5 34v35.5v30q0 982 -22 1025q-4 8 -22 14.5t-44.5 11t-49.5 7t-48.5 4.5
+t-30.5 3l-4 83q98 2 340 11.5t373 9.5q23 0 68 -0.5t68 -0.5q70 0 136.5 -13t128.5 -42t108 -71t74 -104.5t28 -137.5q0 -52 -16.5 -95.5t-39 -72t-64.5 -57.5t-73 -45t-84 -40q154 -35 256.5 -134t102.5 -248q0 -100 -35 -179.5t-93.5 -130.5t-138 -85.5t-163.5 -48.5
+t-176 -14q-44 0 -132 3t-132 3q-106 0 -307 -11t-231 -12z" />
+    <glyph glyph-name="italic" unicode="&#xf033;" horiz-adv-x="1024" 
+d="M0 -126l17 85q22 7 61.5 16.5t72 19t59.5 23.5q28 35 41 101q1 7 62 289t114 543.5t52 296.5v25q-24 13 -54.5 18.5t-69.5 8t-58 5.5l19 103q33 -2 120 -6.5t149.5 -7t120.5 -2.5q48 0 98.5 2.5t121 7t98.5 6.5q-5 -39 -19 -89q-30 -10 -101.5 -28.5t-108.5 -33.5
+q-8 -19 -14 -42.5t-9 -40t-7.5 -45.5t-6.5 -42q-27 -148 -87.5 -419.5t-77.5 -355.5q-2 -9 -13 -58t-20 -90t-16 -83.5t-6 -57.5l1 -18q17 -4 185 -31q-3 -44 -16 -99q-11 0 -32.5 -1.5t-32.5 -1.5q-29 0 -87 10t-86 10q-138 2 -206 2q-51 0 -143 -9t-121 -11z" />
+    <glyph glyph-name="text_height" unicode="&#xf034;" horiz-adv-x="1792" 
+d="M1744 128q33 0 42 -18.5t-11 -44.5l-126 -162q-20 -26 -49 -26t-49 26l-126 162q-20 26 -11 44.5t42 18.5h80v1024h-80q-33 0 -42 18.5t11 44.5l126 162q20 26 49 26t49 -26l126 -162q20 -26 11 -44.5t-42 -18.5h-80v-1024h80zM81 1407l54 -27q12 -5 211 -5q44 0 132 2
+t132 2q36 0 107.5 -0.5t107.5 -0.5h293q6 0 21 -0.5t20.5 0t16 3t17.5 9t15 17.5l42 1q4 0 14 -0.5t14 -0.5q2 -112 2 -336q0 -80 -5 -109q-39 -14 -68 -18q-25 44 -54 128q-3 9 -11 48t-14.5 73.5t-7.5 35.5q-6 8 -12 12.5t-15.5 6t-13 2.5t-18 0.5t-16.5 -0.5
+q-17 0 -66.5 0.5t-74.5 0.5t-64 -2t-71 -6q-9 -81 -8 -136q0 -94 2 -388t2 -455q0 -16 -2.5 -71.5t0 -91.5t12.5 -69q40 -21 124 -42.5t120 -37.5q5 -40 5 -50q0 -14 -3 -29l-34 -1q-76 -2 -218 8t-207 10q-50 0 -151 -9t-152 -9q-3 51 -3 52v9q17 27 61.5 43t98.5 29t78 27
+q19 42 19 383q0 101 -3 303t-3 303v117q0 2 0.5 15.5t0.5 25t-1 25.5t-3 24t-5 14q-11 12 -162 12q-33 0 -93 -12t-80 -26q-19 -13 -34 -72.5t-31.5 -111t-42.5 -53.5q-42 26 -56 44v383z" />
+    <glyph glyph-name="text_width" unicode="&#xf035;" 
+d="M81 1407l54 -27q12 -5 211 -5q44 0 132 2t132 2q70 0 246.5 1t304.5 0.5t247 -4.5q33 -1 56 31l42 1q4 0 14 -0.5t14 -0.5q2 -112 2 -336q0 -80 -5 -109q-39 -14 -68 -18q-25 44 -54 128q-3 9 -11 47.5t-15 73.5t-7 36q-10 13 -27 19q-5 2 -66 2q-30 0 -93 1t-103 1
+t-94 -2t-96 -7q-9 -81 -8 -136l1 -152v52q0 -55 1 -154t1.5 -180t0.5 -153q0 -16 -2.5 -71.5t0 -91.5t12.5 -69q40 -21 124 -42.5t120 -37.5q5 -40 5 -50q0 -14 -3 -29l-34 -1q-76 -2 -218 8t-207 10q-50 0 -151 -9t-152 -9q-3 51 -3 52v9q17 27 61.5 43t98.5 29t78 27
+q7 16 11.5 74t6 145.5t1.5 155t-0.5 153.5t-0.5 89q0 7 -2.5 21.5t-2.5 22.5q0 7 0.5 44t1 73t0 76.5t-3 67.5t-6.5 32q-11 12 -162 12q-41 0 -163 -13.5t-138 -24.5q-19 -12 -34 -71.5t-31.5 -111.5t-42.5 -54q-42 26 -56 44v383zM1310 125q12 0 42 -19.5t57.5 -41.5
+t59.5 -49t36 -30q26 -21 26 -49t-26 -49q-4 -3 -36 -30t-59.5 -49t-57.5 -41.5t-42 -19.5q-13 0 -20.5 10.5t-10 28.5t-2.5 33.5t1.5 33t1.5 19.5h-1024q0 -2 1.5 -19.5t1.5 -33t-2.5 -33.5t-10 -28.5t-20.5 -10.5q-12 0 -42 19.5t-57.5 41.5t-59.5 49t-36 30q-26 21 -26 49
+t26 49q4 3 36 30t59.5 49t57.5 41.5t42 19.5q13 0 20.5 -10.5t10 -28.5t2.5 -33.5t-1.5 -33t-1.5 -19.5h1024q0 2 -1.5 19.5t-1.5 33t2.5 33.5t10 28.5t20.5 10.5z" />
+    <glyph glyph-name="align_left" unicode="&#xf036;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1408 576v-128q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1280q26 0 45 -19t19 -45zM1664 960v-128q0 -26 -19 -45
+t-45 -19h-1536q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1536q26 0 45 -19t19 -45zM1280 1344v-128q0 -26 -19 -45t-45 -19h-1152q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_center" unicode="&#xf037;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1408 576v-128q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h896q26 0 45 -19t19 -45zM1664 960v-128q0 -26 -19 -45t-45 -19
+h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1280 1344v-128q0 -26 -19 -45t-45 -19h-640q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h640q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_right" unicode="&#xf038;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 576v-128q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1280q26 0 45 -19t19 -45zM1792 960v-128q0 -26 -19 -45
+t-45 -19h-1536q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1536q26 0 45 -19t19 -45zM1792 1344v-128q0 -26 -19 -45t-45 -19h-1152q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_justify" unicode="&#xf039;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 576v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 960v-128q0 -26 -19 -45
+t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 1344v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="list" unicode="&#xf03a;" horiz-adv-x="1792" 
+d="M256 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM256 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5
+t9.5 -22.5zM256 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1344
+q13 0 22.5 -9.5t9.5 -22.5zM256 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5
+t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192
+q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="indent_left" unicode="&#xf03b;" horiz-adv-x="1792" 
+d="M384 992v-576q0 -13 -9.5 -22.5t-22.5 -9.5q-14 0 -23 9l-288 288q-9 9 -9 23t9 23l288 288q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5
+t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088
+q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="indent_right" unicode="&#xf03c;" horiz-adv-x="1792" 
+d="M352 704q0 -14 -9 -23l-288 -288q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v576q0 13 9.5 22.5t22.5 9.5q14 0 23 -9l288 -288q9 -9 9 -23zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5
+t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088
+q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="facetime_video" unicode="&#xf03d;" horiz-adv-x="1792" 
+d="M1792 1184v-1088q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-403 403v-166q0 -119 -84.5 -203.5t-203.5 -84.5h-704q-119 0 -203.5 84.5t-84.5 203.5v704q0 119 84.5 203.5t203.5 84.5h704q119 0 203.5 -84.5t84.5 -203.5v-165l403 402q18 19 45 19q12 0 25 -5
+q39 -17 39 -59z" />
+    <glyph glyph-name="picture" unicode="&#xf03e;" horiz-adv-x="1920" 
+d="M640 960q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 576v-448h-1408v192l320 320l160 -160l512 512zM1760 1280h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-1216q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5v1216
+q0 13 -9.5 22.5t-22.5 9.5zM1920 1248v-1216q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="pencil" unicode="&#xf040;" 
+d="M363 0l91 91l-235 235l-91 -91v-107h128v-128h107zM886 928q0 22 -22 22q-10 0 -17 -7l-542 -542q-7 -7 -7 -17q0 -22 22 -22q10 0 17 7l542 542q7 7 7 17zM832 1120l416 -416l-832 -832h-416v416zM1515 1024q0 -53 -37 -90l-166 -166l-416 416l166 165q36 38 90 38
+q53 0 91 -38l235 -234q37 -39 37 -91z" />
+    <glyph glyph-name="map_marker" unicode="&#xf041;" horiz-adv-x="1024" 
+d="M768 896q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1024 896q0 -109 -33 -179l-364 -774q-16 -33 -47.5 -52t-67.5 -19t-67.5 19t-46.5 52l-365 774q-33 70 -33 179q0 212 150 362t362 150t362 -150t150 -362z" />
+    <glyph glyph-name="adjust" unicode="&#xf042;" 
+d="M768 96v1088q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="tint" unicode="&#xf043;" horiz-adv-x="1024" 
+d="M512 384q0 36 -20 69q-1 1 -15.5 22.5t-25.5 38t-25 44t-21 50.5q-4 16 -21 16t-21 -16q-7 -23 -21 -50.5t-25 -44t-25.5 -38t-15.5 -22.5q-20 -33 -20 -69q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 512q0 -212 -150 -362t-362 -150t-362 150t-150 362
+q0 145 81 275q6 9 62.5 90.5t101 151t99.5 178t83 201.5q9 30 34 47t51 17t51.5 -17t33.5 -47q28 -93 83 -201.5t99.5 -178t101 -151t62.5 -90.5q81 -127 81 -275z" />
+    <glyph glyph-name="edit" unicode="&#xf044;" horiz-adv-x="1792" 
+d="M888 352l116 116l-152 152l-116 -116v-56h96v-96h56zM1328 1072q-16 16 -33 -1l-350 -350q-17 -17 -1 -33t33 1l350 350q17 17 1 33zM1408 478v-190q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832
+q63 0 117 -25q15 -7 18 -23q3 -17 -9 -29l-49 -49q-14 -14 -32 -8q-23 6 -45 6h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v126q0 13 9 22l64 64q15 15 35 7t20 -29zM1312 1216l288 -288l-672 -672h-288v288zM1756 1084l-92 -92
+l-288 288l92 92q28 28 68 28t68 -28l152 -152q28 -28 28 -68t-28 -68z" />
+    <glyph glyph-name="share" unicode="&#xf045;" horiz-adv-x="1664" 
+d="M1408 547v-259q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h255v0q13 0 22.5 -9.5t9.5 -22.5q0 -27 -26 -32q-77 -26 -133 -60q-10 -4 -16 -4h-112q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832
+q66 0 113 47t47 113v214q0 19 18 29q28 13 54 37q16 16 35 8q21 -9 21 -29zM1645 1043l-384 -384q-18 -19 -45 -19q-12 0 -25 5q-39 17 -39 59v192h-160q-323 0 -438 -131q-119 -137 -74 -473q3 -23 -20 -34q-8 -2 -12 -2q-16 0 -26 13q-10 14 -21 31t-39.5 68.5t-49.5 99.5
+t-38.5 114t-17.5 122q0 49 3.5 91t14 90t28 88t47 81.5t68.5 74t94.5 61.5t124.5 48.5t159.5 30.5t196.5 11h160v192q0 42 39 59q13 5 25 5q26 0 45 -19l384 -384q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="check" unicode="&#xf046;" horiz-adv-x="1664" 
+d="M1408 606v-318q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q63 0 117 -25q15 -7 18 -23q3 -17 -9 -29l-49 -49q-10 -10 -23 -10q-3 0 -9 2q-23 6 -45 6h-832q-66 0 -113 -47t-47 -113v-832
+q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v254q0 13 9 22l64 64q10 10 23 10q6 0 12 -3q20 -8 20 -29zM1639 1095l-814 -814q-24 -24 -57 -24t-57 24l-430 430q-24 24 -24 57t24 57l110 110q24 24 57 24t57 -24l263 -263l647 647q24 24 57 24t57 -24l110 -110
+q24 -24 24 -57t-24 -57z" />
+    <glyph glyph-name="move" unicode="&#xf047;" horiz-adv-x="1792" 
+d="M1792 640q0 -26 -19 -45l-256 -256q-19 -19 -45 -19t-45 19t-19 45v128h-384v-384h128q26 0 45 -19t19 -45t-19 -45l-256 -256q-19 -19 -45 -19t-45 19l-256 256q-19 19 -19 45t19 45t45 19h128v384h-384v-128q0 -26 -19 -45t-45 -19t-45 19l-256 256q-19 19 -19 45
+t19 45l256 256q19 19 45 19t45 -19t19 -45v-128h384v384h-128q-26 0 -45 19t-19 45t19 45l256 256q19 19 45 19t45 -19l256 -256q19 -19 19 -45t-19 -45t-45 -19h-128v-384h384v128q0 26 19 45t45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="step_backward" unicode="&#xf048;" horiz-adv-x="1024" 
+d="M979 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-678q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-678q4 10 13 19z" />
+    <glyph glyph-name="fast_backward" unicode="&#xf049;" horiz-adv-x="1792" 
+d="M1747 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-710q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-678q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-678q4 10 13 19l710 710
+q19 19 32 13t13 -32v-710q4 10 13 19z" />
+    <glyph glyph-name="backward" unicode="&#xf04a;" horiz-adv-x="1664" 
+d="M1619 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-710q0 -26 -13 -32t-32 13l-710 710q-19 19 -19 45t19 45l710 710q19 19 32 13t13 -32v-710q4 10 13 19z" />
+    <glyph glyph-name="play" unicode="&#xf04b;" horiz-adv-x="1408" 
+d="M1384 609l-1328 -738q-23 -13 -39.5 -3t-16.5 36v1472q0 26 16.5 36t39.5 -3l1328 -738q23 -13 23 -31t-23 -31z" />
+    <glyph glyph-name="pause" unicode="&#xf04c;" 
+d="M1536 1344v-1408q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h512q26 0 45 -19t19 -45zM640 1344v-1408q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h512q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="stop" unicode="&#xf04d;" 
+d="M1536 1344v-1408q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="forward" unicode="&#xf04e;" horiz-adv-x="1664" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v710q0 26 13 32t32 -13l710 -710q19 -19 19 -45t-19 -45l-710 -710q-19 -19 -32 -13t-13 32v710q-4 -10 -13 -19z" />
+    <glyph glyph-name="fast_forward" unicode="&#xf050;" horiz-adv-x="1792" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v710q0 26 13 32t32 -13l710 -710q9 -9 13 -19v678q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-1408q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v678q-4 -10 -13 -19l-710 -710
+q-19 -19 -32 -13t-13 32v710q-4 -10 -13 -19z" />
+    <glyph glyph-name="step_forward" unicode="&#xf051;" horiz-adv-x="1024" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v678q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-1408q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v678q-4 -10 -13 -19z" />
+    <glyph glyph-name="eject" unicode="&#xf052;" horiz-adv-x="1538" 
+d="M14 557l710 710q19 19 45 19t45 -19l710 -710q19 -19 13 -32t-32 -13h-1472q-26 0 -32 13t13 32zM1473 0h-1408q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1408q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19z" />
+    <glyph glyph-name="chevron_left" unicode="&#xf053;" horiz-adv-x="1280" 
+d="M1171 1235l-531 -531l531 -531q19 -19 19 -45t-19 -45l-166 -166q-19 -19 -45 -19t-45 19l-742 742q-19 19 -19 45t19 45l742 742q19 19 45 19t45 -19l166 -166q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="chevron_right" unicode="&#xf054;" horiz-adv-x="1280" 
+d="M1107 659l-742 -742q-19 -19 -45 -19t-45 19l-166 166q-19 19 -19 45t19 45l531 531l-531 531q-19 19 -19 45t19 45l166 166q19 19 45 19t45 -19l742 -742q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="plus_sign" unicode="&#xf055;" 
+d="M1216 576v128q0 26 -19 45t-45 19h-256v256q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-256h-256q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h256v-256q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v256h256q26 0 45 19t19 45zM1536 640q0 -209 -103 -385.5
+t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="minus_sign" unicode="&#xf056;" 
+d="M1216 576v128q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="remove_sign" unicode="&#xf057;" 
+d="M1149 414q0 26 -19 45l-181 181l181 181q19 19 19 45q0 27 -19 46l-90 90q-19 19 -46 19q-26 0 -45 -19l-181 -181l-181 181q-19 19 -45 19q-27 0 -46 -19l-90 -90q-19 -19 -19 -46q0 -26 19 -45l181 -181l-181 -181q-19 -19 -19 -45q0 -27 19 -46l90 -90q19 -19 46 -19
+q26 0 45 19l181 181l181 -181q19 -19 45 -19q27 0 46 19l90 90q19 19 19 46zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ok_sign" unicode="&#xf058;" 
+d="M1284 802q0 28 -18 46l-91 90q-19 19 -45 19t-45 -19l-408 -407l-226 226q-19 19 -45 19t-45 -19l-91 -90q-18 -18 -18 -46q0 -27 18 -45l362 -362q19 -19 45 -19q27 0 46 19l543 543q18 18 18 45zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="question_sign" unicode="&#xf059;" 
+d="M896 160v192q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h192q14 0 23 9t9 23zM1152 832q0 88 -55.5 163t-138.5 116t-170 41q-243 0 -371 -213q-15 -24 8 -42l132 -100q7 -6 19 -6q16 0 25 12q53 68 86 92q34 24 86 24q48 0 85.5 -26t37.5 -59
+q0 -38 -20 -61t-68 -45q-63 -28 -115.5 -86.5t-52.5 -125.5v-36q0 -14 9 -23t23 -9h192q14 0 23 9t9 23q0 19 21.5 49.5t54.5 49.5q32 18 49 28.5t46 35t44.5 48t28 60.5t12.5 81zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="info_sign" unicode="&#xf05a;" 
+d="M1024 160v160q0 14 -9 23t-23 9h-96v512q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23t23 -9h96v-320h-96q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23t23 -9h448q14 0 23 9t9 23zM896 1056v160q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23
+t23 -9h192q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="screenshot" unicode="&#xf05b;" 
+d="M1197 512h-109q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h109q-32 108 -112.5 188.5t-188.5 112.5v-109q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v109q-108 -32 -188.5 -112.5t-112.5 -188.5h109q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-109
+q32 -108 112.5 -188.5t188.5 -112.5v109q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-109q108 32 188.5 112.5t112.5 188.5zM1536 704v-128q0 -26 -19 -45t-45 -19h-143q-37 -161 -154.5 -278.5t-278.5 -154.5v-143q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v143
+q-161 37 -278.5 154.5t-154.5 278.5h-143q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h143q37 161 154.5 278.5t278.5 154.5v143q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-143q161 -37 278.5 -154.5t154.5 -278.5h143q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="remove_circle" unicode="&#xf05c;" 
+d="M1097 457l-146 -146q-10 -10 -23 -10t-23 10l-137 137l-137 -137q-10 -10 -23 -10t-23 10l-146 146q-10 10 -10 23t10 23l137 137l-137 137q-10 10 -10 23t10 23l146 146q10 10 23 10t23 -10l137 -137l137 137q10 10 23 10t23 -10l146 -146q10 -10 10 -23t-10 -23
+l-137 -137l137 -137q10 -10 10 -23t-10 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5
+t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ok_circle" unicode="&#xf05d;" 
+d="M1171 723l-422 -422q-19 -19 -45 -19t-45 19l-294 294q-19 19 -19 45t19 45l102 102q19 19 45 19t45 -19l147 -147l275 275q19 19 45 19t45 -19l102 -102q19 -19 19 -45t-19 -45zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198
+t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ban_circle" unicode="&#xf05e;" 
+d="M1312 643q0 161 -87 295l-754 -753q137 -89 297 -89q111 0 211.5 43.5t173.5 116.5t116 174.5t43 212.5zM313 344l755 754q-135 91 -300 91q-148 0 -273 -73t-198 -199t-73 -274q0 -162 89 -299zM1536 643q0 -157 -61 -300t-163.5 -246t-245 -164t-298.5 -61t-298.5 61
+t-245 164t-163.5 246t-61 300t61 299.5t163.5 245.5t245 164t298.5 61t298.5 -61t245 -164t163.5 -245.5t61 -299.5z" />
+    <glyph glyph-name="arrow_left" unicode="&#xf060;" 
+d="M1536 640v-128q0 -53 -32.5 -90.5t-84.5 -37.5h-704l293 -294q38 -36 38 -90t-38 -90l-75 -76q-37 -37 -90 -37q-52 0 -91 37l-651 652q-37 37 -37 90q0 52 37 91l651 650q38 38 91 38q52 0 90 -38l75 -74q38 -38 38 -91t-38 -91l-293 -293h704q52 0 84.5 -37.5
+t32.5 -90.5z" />
+    <glyph glyph-name="arrow_right" unicode="&#xf061;" 
+d="M1472 576q0 -54 -37 -91l-651 -651q-39 -37 -91 -37q-51 0 -90 37l-75 75q-38 38 -38 91t38 91l293 293h-704q-52 0 -84.5 37.5t-32.5 90.5v128q0 53 32.5 90.5t84.5 37.5h704l-293 294q-38 36 -38 90t38 90l75 75q38 38 90 38q53 0 91 -38l651 -651q37 -35 37 -90z" />
+    <glyph glyph-name="arrow_up" unicode="&#xf062;" horiz-adv-x="1664" 
+d="M1611 565q0 -51 -37 -90l-75 -75q-38 -38 -91 -38q-54 0 -90 38l-294 293v-704q0 -52 -37.5 -84.5t-90.5 -32.5h-128q-53 0 -90.5 32.5t-37.5 84.5v704l-294 -293q-36 -38 -90 -38t-90 38l-75 75q-38 38 -38 90q0 53 38 91l651 651q35 37 90 37q54 0 91 -37l651 -651
+q37 -39 37 -91z" />
+    <glyph glyph-name="arrow_down" unicode="&#xf063;" horiz-adv-x="1664" 
+d="M1611 704q0 -53 -37 -90l-651 -652q-39 -37 -91 -37q-53 0 -90 37l-651 652q-38 36 -38 90q0 53 38 91l74 75q39 37 91 37q53 0 90 -37l294 -294v704q0 52 38 90t90 38h128q52 0 90 -38t38 -90v-704l294 294q37 37 90 37q52 0 91 -37l75 -75q37 -39 37 -91z" />
+    <glyph glyph-name="share_alt" unicode="&#xf064;" horiz-adv-x="1792" 
+d="M1792 896q0 -26 -19 -45l-512 -512q-19 -19 -45 -19t-45 19t-19 45v256h-224q-98 0 -175.5 -6t-154 -21.5t-133 -42.5t-105.5 -69.5t-80 -101t-48.5 -138.5t-17.5 -181q0 -55 5 -123q0 -6 2.5 -23.5t2.5 -26.5q0 -15 -8.5 -25t-23.5 -10q-16 0 -28 17q-7 9 -13 22
+t-13.5 30t-10.5 24q-127 285 -127 451q0 199 53 333q162 403 875 403h224v256q0 26 19 45t45 19t45 -19l512 -512q19 -19 19 -45z" />
+    <glyph glyph-name="resize_full" unicode="&#xf065;" 
+d="M755 480q0 -13 -10 -23l-332 -332l144 -144q19 -19 19 -45t-19 -45t-45 -19h-448q-26 0 -45 19t-19 45v448q0 26 19 45t45 19t45 -19l144 -144l332 332q10 10 23 10t23 -10l114 -114q10 -10 10 -23zM1536 1344v-448q0 -26 -19 -45t-45 -19t-45 19l-144 144l-332 -332
+q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l332 332l-144 144q-19 19 -19 45t19 45t45 19h448q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="resize_small" unicode="&#xf066;" 
+d="M768 576v-448q0 -26 -19 -45t-45 -19t-45 19l-144 144l-332 -332q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l332 332l-144 144q-19 19 -19 45t19 45t45 19h448q26 0 45 -19t19 -45zM1523 1248q0 -13 -10 -23l-332 -332l144 -144q19 -19 19 -45t-19 -45
+t-45 -19h-448q-26 0 -45 19t-19 45v448q0 26 19 45t45 19t45 -19l144 -144l332 332q10 10 23 10t23 -10l114 -114q10 -10 10 -23z" />
+    <glyph glyph-name="plus" unicode="&#xf067;" horiz-adv-x="1408" 
+d="M1408 800v-192q0 -40 -28 -68t-68 -28h-416v-416q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v416h-416q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h416v416q0 40 28 68t68 28h192q40 0 68 -28t28 -68v-416h416q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="minus" unicode="&#xf068;" horiz-adv-x="1408" 
+d="M1408 800v-192q0 -40 -28 -68t-68 -28h-1216q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h1216q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="asterisk" unicode="&#xf069;" horiz-adv-x="1664" 
+d="M1482 486q46 -26 59.5 -77.5t-12.5 -97.5l-64 -110q-26 -46 -77.5 -59.5t-97.5 12.5l-266 153v-307q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v307l-266 -153q-46 -26 -97.5 -12.5t-77.5 59.5l-64 110q-26 46 -12.5 97.5t59.5 77.5l266 154l-266 154
+q-46 26 -59.5 77.5t12.5 97.5l64 110q26 46 77.5 59.5t97.5 -12.5l266 -153v307q0 52 38 90t90 38h128q52 0 90 -38t38 -90v-307l266 153q46 26 97.5 12.5t77.5 -59.5l64 -110q26 -46 12.5 -97.5t-59.5 -77.5l-266 -154z" />
+    <glyph glyph-name="exclamation_sign" unicode="&#xf06a;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM896 161v190q0 14 -9 23.5t-22 9.5h-192q-13 0 -23 -10t-10 -23v-190q0 -13 10 -23t23 -10h192
+q13 0 22 9.5t9 23.5zM894 505l18 621q0 12 -10 18q-10 8 -24 8h-220q-14 0 -24 -8q-10 -6 -10 -18l17 -621q0 -10 10 -17.5t24 -7.5h185q14 0 23.5 7.5t10.5 17.5z" />
+    <glyph glyph-name="gift" unicode="&#xf06b;" 
+d="M928 180v56v468v192h-320v-192v-468v-56q0 -25 18 -38.5t46 -13.5h192q28 0 46 13.5t18 38.5zM472 1024h195l-126 161q-26 31 -69 31q-40 0 -68 -28t-28 -68t28 -68t68 -28zM1160 1120q0 40 -28 68t-68 28q-43 0 -69 -31l-125 -161h194q40 0 68 28t28 68zM1536 864v-320
+q0 -14 -9 -23t-23 -9h-96v-416q0 -40 -28 -68t-68 -28h-1088q-40 0 -68 28t-28 68v416h-96q-14 0 -23 9t-9 23v320q0 14 9 23t23 9h440q-93 0 -158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5q107 0 168 -77l128 -165l128 165q61 77 168 77q93 0 158.5 -65.5t65.5 -158.5
+t-65.5 -158.5t-158.5 -65.5h440q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="leaf" unicode="&#xf06c;" horiz-adv-x="1792" 
+d="M1280 832q0 26 -19 45t-45 19q-172 0 -318 -49.5t-259.5 -134t-235.5 -219.5q-19 -21 -19 -45q0 -26 19 -45t45 -19q24 0 45 19q27 24 74 71t67 66q137 124 268.5 176t313.5 52q26 0 45 19t19 45zM1792 1030q0 -95 -20 -193q-46 -224 -184.5 -383t-357.5 -268
+q-214 -108 -438 -108q-148 0 -286 47q-15 5 -88 42t-96 37q-16 0 -39.5 -32t-45 -70t-52.5 -70t-60 -32q-43 0 -63.5 17.5t-45.5 59.5q-2 4 -6 11t-5.5 10t-3 9.5t-1.5 13.5q0 35 31 73.5t68 65.5t68 56t31 48q0 4 -14 38t-16 44q-9 51 -9 104q0 115 43.5 220t119 184.5
+t170.5 139t204 95.5q55 18 145 25.5t179.5 9t178.5 6t163.5 24t113.5 56.5l29.5 29.5t29.5 28t27 20t36.5 16t43.5 4.5q39 0 70.5 -46t47.5 -112t24 -124t8 -96z" />
+    <glyph glyph-name="fire" unicode="&#xf06d;" horiz-adv-x="1408" 
+d="M1408 -160v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1152 896q0 -78 -24.5 -144t-64 -112.5t-87.5 -88t-96 -77.5t-87.5 -72t-64 -81.5t-24.5 -96.5q0 -96 67 -224l-4 1l1 -1
+q-90 41 -160 83t-138.5 100t-113.5 122.5t-72.5 150.5t-27.5 184q0 78 24.5 144t64 112.5t87.5 88t96 77.5t87.5 72t64 81.5t24.5 96.5q0 94 -66 224l3 -1l-1 1q90 -41 160 -83t138.5 -100t113.5 -122.5t72.5 -150.5t27.5 -184z" />
+    <glyph glyph-name="eye_open" unicode="&#xf06e;" horiz-adv-x="1792" 
+d="M1664 576q-152 236 -381 353q61 -104 61 -225q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 121 61 225q-229 -117 -381 -353q133 -205 333.5 -326.5t434.5 -121.5t434.5 121.5t333.5 326.5zM944 960q0 20 -14 34t-34 14q-125 0 -214.5 -89.5
+t-89.5 -214.5q0 -20 14 -34t34 -14t34 14t14 34q0 86 61 147t147 61q20 0 34 14t14 34zM1792 576q0 -34 -20 -69q-140 -230 -376.5 -368.5t-499.5 -138.5t-499.5 139t-376.5 368q-20 35 -20 69t20 69q140 229 376.5 368t499.5 139t499.5 -139t376.5 -368q20 -35 20 -69z" />
+    <glyph glyph-name="eye_close" unicode="&#xf070;" horiz-adv-x="1792" 
+d="M555 201l78 141q-87 63 -136 159t-49 203q0 121 61 225q-229 -117 -381 -353q167 -258 427 -375zM944 960q0 20 -14 34t-34 14q-125 0 -214.5 -89.5t-89.5 -214.5q0 -20 14 -34t34 -14t34 14t14 34q0 86 61 147t147 61q20 0 34 14t14 34zM1307 1151q0 -7 -1 -9
+q-106 -189 -316 -567t-315 -566l-49 -89q-10 -16 -28 -16q-12 0 -134 70q-16 10 -16 28q0 12 44 87q-143 65 -263.5 173t-208.5 245q-20 31 -20 69t20 69q153 235 380 371t496 136q89 0 180 -17l54 97q10 16 28 16q5 0 18 -6t31 -15.5t33 -18.5t31.5 -18.5t19.5 -11.5
+q16 -10 16 -27zM1344 704q0 -139 -79 -253.5t-209 -164.5l280 502q8 -45 8 -84zM1792 576q0 -35 -20 -69q-39 -64 -109 -145q-150 -172 -347.5 -267t-419.5 -95l74 132q212 18 392.5 137t301.5 307q-115 179 -282 294l63 112q95 -64 182.5 -153t144.5 -184q20 -34 20 -69z
+" />
+    <glyph glyph-name="warning_sign" unicode="&#xf071;" horiz-adv-x="1792" 
+d="M1024 161v190q0 14 -9.5 23.5t-22.5 9.5h-192q-13 0 -22.5 -9.5t-9.5 -23.5v-190q0 -14 9.5 -23.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 23.5zM1022 535l18 459q0 12 -10 19q-13 11 -24 11h-220q-11 0 -24 -11q-10 -7 -10 -21l17 -457q0 -10 10 -16.5t24 -6.5h185
+q14 0 23.5 6.5t10.5 16.5zM1008 1469l768 -1408q35 -63 -2 -126q-17 -29 -46.5 -46t-63.5 -17h-1536q-34 0 -63.5 17t-46.5 46q-37 63 -2 126l768 1408q17 31 47 49t65 18t65 -18t47 -49z" />
+    <glyph glyph-name="plane" unicode="&#xf072;" horiz-adv-x="1408" 
+d="M1376 1376q44 -52 12 -148t-108 -172l-161 -161l160 -696q5 -19 -12 -33l-128 -96q-7 -6 -19 -6q-4 0 -7 1q-15 3 -21 16l-279 508l-259 -259l53 -194q5 -17 -8 -31l-96 -96q-9 -9 -23 -9h-2q-15 2 -24 13l-189 252l-252 189q-11 7 -13 23q-1 13 9 25l96 97q9 9 23 9
+q6 0 8 -1l194 -53l259 259l-508 279q-14 8 -17 24q-2 16 9 27l128 128q14 13 30 8l665 -159l160 160q76 76 172 108t148 -12z" />
+    <glyph glyph-name="calendar" unicode="&#xf073;" horiz-adv-x="1664" 
+d="M128 -128h288v288h-288v-288zM480 -128h320v288h-320v-288zM128 224h288v320h-288v-320zM480 224h320v320h-320v-320zM128 608h288v288h-288v-288zM864 -128h320v288h-320v-288zM480 608h320v288h-320v-288zM1248 -128h288v288h-288v-288zM864 224h320v320h-320v-320z
+M512 1088v288q0 13 -9.5 22.5t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-288q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1248 224h288v320h-288v-320zM864 608h320v288h-320v-288zM1248 608h288v288h-288v-288zM1280 1088v288q0 13 -9.5 22.5t-22.5 9.5h-64
+q-13 0 -22.5 -9.5t-9.5 -22.5v-288q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47
+h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="random" unicode="&#xf074;" horiz-adv-x="1792" 
+d="M666 1055q-60 -92 -137 -273q-22 45 -37 72.5t-40.5 63.5t-51 56.5t-63 35t-81.5 14.5h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224q250 0 410 -225zM1792 256q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v192q-32 0 -85 -0.5t-81 -1t-73 1
+t-71 5t-64 10.5t-63 18.5t-58 28.5t-59 40t-55 53.5t-56 69.5q59 93 136 273q22 -45 37 -72.5t40.5 -63.5t51 -56.5t63 -35t81.5 -14.5h256v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23zM1792 1152q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5
+v192h-256q-48 0 -87 -15t-69 -45t-51 -61.5t-45 -77.5q-32 -62 -78 -171q-29 -66 -49.5 -111t-54 -105t-64 -100t-74 -83t-90 -68.5t-106.5 -42t-128 -16.5h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224q48 0 87 15t69 45t51 61.5t45 77.5q32 62 78 171q29 66 49.5 111
+t54 105t64 100t74 83t90 68.5t106.5 42t128 16.5h256v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23z" />
+    <glyph glyph-name="comment" unicode="&#xf075;" horiz-adv-x="1792" 
+d="M1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22q-17 -2 -30.5 9t-17.5 29v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51t27 59t26 76q-157 89 -247.5 220t-90.5 281
+q0 130 71 248.5t191 204.5t286 136.5t348 50.5q244 0 450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="magnet" unicode="&#xf076;" 
+d="M1536 704v-128q0 -201 -98.5 -362t-274 -251.5t-395.5 -90.5t-395.5 90.5t-274 251.5t-98.5 362v128q0 26 19 45t45 19h384q26 0 45 -19t19 -45v-128q0 -52 23.5 -90t53.5 -57t71 -30t64 -13t44 -2t44 2t64 13t71 30t53.5 57t23.5 90v128q0 26 19 45t45 19h384
+q26 0 45 -19t19 -45zM512 1344v-384q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h384q26 0 45 -19t19 -45zM1536 1344v-384q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h384q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="chevron_up" unicode="&#xf077;" horiz-adv-x="1792" 
+d="M1683 205l-166 -165q-19 -19 -45 -19t-45 19l-531 531l-531 -531q-19 -19 -45 -19t-45 19l-166 165q-19 19 -19 45.5t19 45.5l742 741q19 19 45 19t45 -19l742 -741q19 -19 19 -45.5t-19 -45.5z" />
+    <glyph glyph-name="chevron_down" unicode="&#xf078;" horiz-adv-x="1792" 
+d="M1683 728l-742 -741q-19 -19 -45 -19t-45 19l-742 741q-19 19 -19 45.5t19 45.5l166 165q19 19 45 19t45 -19l531 -531l531 531q19 19 45 19t45 -19l166 -165q19 -19 19 -45.5t-19 -45.5z" />
+    <glyph glyph-name="retweet" unicode="&#xf079;" horiz-adv-x="1920" 
+d="M1280 32q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-8 0 -13.5 2t-9 7t-5.5 8t-3 11.5t-1 11.5v13v11v160v416h-192q-26 0 -45 19t-19 45q0 24 15 41l320 384q19 22 49 22t49 -22l320 -384q15 -17 15 -41q0 -26 -19 -45t-45 -19h-192v-384h576q16 0 25 -11l160 -192q7 -10 7 -21
+zM1920 448q0 -24 -15 -41l-320 -384q-20 -23 -49 -23t-49 23l-320 384q-15 17 -15 41q0 26 19 45t45 19h192v384h-576q-16 0 -25 12l-160 192q-7 9 -7 20q0 13 9.5 22.5t22.5 9.5h960q8 0 13.5 -2t9 -7t5.5 -8t3 -11.5t1 -11.5v-13v-11v-160v-416h192q26 0 45 -19t19 -45z
+" />
+    <glyph glyph-name="shopping_cart" unicode="&#xf07a;" horiz-adv-x="1664" 
+d="M640 0q0 -52 -38 -90t-90 -38t-90 38t-38 90t38 90t90 38t90 -38t38 -90zM1536 0q0 -52 -38 -90t-90 -38t-90 38t-38 90t38 90t90 38t90 -38t38 -90zM1664 1088v-512q0 -24 -16.5 -42.5t-40.5 -21.5l-1044 -122q13 -60 13 -70q0 -16 -24 -64h920q26 0 45 -19t19 -45
+t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 11 8 31.5t16 36t21.5 40t15.5 29.5l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t19.5 -15.5t13 -24.5t8 -26t5.5 -29.5t4.5 -26h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="folder_close" unicode="&#xf07b;" horiz-adv-x="1664" 
+d="M1664 928v-704q0 -92 -66 -158t-158 -66h-1216q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h672q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="folder_open" unicode="&#xf07c;" horiz-adv-x="1920" 
+d="M1879 584q0 -31 -31 -66l-336 -396q-43 -51 -120.5 -86.5t-143.5 -35.5h-1088q-34 0 -60.5 13t-26.5 43q0 31 31 66l336 396q43 51 120.5 86.5t143.5 35.5h1088q34 0 60.5 -13t26.5 -43zM1536 928v-160h-832q-94 0 -197 -47.5t-164 -119.5l-337 -396l-5 -6q0 4 -0.5 12.5
+t-0.5 12.5v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h544q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="resize_vertical" unicode="&#xf07d;" horiz-adv-x="768" 
+d="M704 1216q0 -26 -19 -45t-45 -19h-128v-1024h128q26 0 45 -19t19 -45t-19 -45l-256 -256q-19 -19 -45 -19t-45 19l-256 256q-19 19 -19 45t19 45t45 19h128v1024h-128q-26 0 -45 19t-19 45t19 45l256 256q19 19 45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="resize_horizontal" unicode="&#xf07e;" horiz-adv-x="1792" 
+d="M1792 640q0 -26 -19 -45l-256 -256q-19 -19 -45 -19t-45 19t-19 45v128h-1024v-128q0 -26 -19 -45t-45 -19t-45 19l-256 256q-19 19 -19 45t19 45l256 256q19 19 45 19t45 -19t19 -45v-128h1024v128q0 26 19 45t45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="bar_chart" unicode="&#xf080;" horiz-adv-x="2048" 
+d="M640 640v-512h-256v512h256zM1024 1152v-1024h-256v1024h256zM2048 0v-128h-2048v1536h128v-1408h1920zM1408 896v-768h-256v768h256zM1792 1280v-1152h-256v1152h256z" />
+    <glyph glyph-name="twitter_sign" unicode="&#xf081;" 
+d="M1280 926q-56 -25 -121 -34q68 40 93 117q-65 -38 -134 -51q-61 66 -153 66q-87 0 -148.5 -61.5t-61.5 -148.5q0 -29 5 -48q-129 7 -242 65t-192 155q-29 -50 -29 -106q0 -114 91 -175q-47 1 -100 26v-2q0 -75 50 -133.5t123 -72.5q-29 -8 -51 -8q-13 0 -39 4
+q21 -63 74.5 -104t121.5 -42q-116 -90 -261 -90q-26 0 -50 3q148 -94 322 -94q112 0 210 35.5t168 95t120.5 137t75 162t24.5 168.5q0 18 -1 27q63 45 105 109zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5
+t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="facebook_sign" unicode="&#xf082;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-188v595h199l30 232h-229v148q0 56 23.5 84t91.5 28l122 1v207q-63 9 -178 9q-136 0 -217.5 -80t-81.5 -226v-171h-200v-232h200v-595h-532q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960z" />
+    <glyph glyph-name="camera_retro" unicode="&#xf083;" horiz-adv-x="1792" 
+d="M928 704q0 14 -9 23t-23 9q-66 0 -113 -47t-47 -113q0 -14 9 -23t23 -9t23 9t9 23q0 40 28 68t68 28q14 0 23 9t9 23zM1152 574q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM128 0h1536v128h-1536v-128zM1280 574q0 159 -112.5 271.5
+t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM256 1216h384v128h-384v-128zM128 1024h1536v118v138h-828l-64 -128h-644v-128zM1792 1280v-1280q0 -53 -37.5 -90.5t-90.5 -37.5h-1536q-53 0 -90.5 37.5t-37.5 90.5v1280
+q0 53 37.5 90.5t90.5 37.5h1536q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="key" unicode="&#xf084;" horiz-adv-x="1792" 
+d="M832 1024q0 80 -56 136t-136 56t-136 -56t-56 -136q0 -42 19 -83q-41 19 -83 19q-80 0 -136 -56t-56 -136t56 -136t136 -56t136 56t56 136q0 42 -19 83q41 -19 83 -19q80 0 136 56t56 136zM1683 320q0 -17 -49 -66t-66 -49q-9 0 -28.5 16t-36.5 33t-38.5 40t-24.5 26
+l-96 -96l220 -220q28 -28 28 -68q0 -42 -39 -81t-81 -39q-40 0 -68 28l-671 671q-176 -131 -365 -131q-163 0 -265.5 102.5t-102.5 265.5q0 160 95 313t248 248t313 95q163 0 265.5 -102.5t102.5 -265.5q0 -189 -131 -365l355 -355l96 96q-3 3 -26 24.5t-40 38.5t-33 36.5
+t-16 28.5q0 17 49 66t66 49q13 0 23 -10q6 -6 46 -44.5t82 -79.5t86.5 -86t73 -78t28.5 -41z" />
+    <glyph glyph-name="cogs" unicode="&#xf085;" horiz-adv-x="1920" 
+d="M896 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1664 128q0 52 -38 90t-90 38t-90 -38t-38 -90q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 1152q0 52 -38 90t-90 38t-90 -38t-38 -90q0 -53 37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5zM1280 731v-185q0 -10 -7 -19.5t-16 -10.5l-155 -24q-11 -35 -32 -76q34 -48 90 -115q7 -11 7 -20q0 -12 -7 -19q-23 -30 -82.5 -89.5t-78.5 -59.5q-11 0 -21 7l-115 90q-37 -19 -77 -31q-11 -108 -23 -155q-7 -24 -30 -24h-186q-11 0 -20 7.5t-10 17.5
+l-23 153q-34 10 -75 31l-118 -89q-7 -7 -20 -7q-11 0 -21 8q-144 133 -144 160q0 9 7 19q10 14 41 53t47 61q-23 44 -35 82l-152 24q-10 1 -17 9.5t-7 19.5v185q0 10 7 19.5t16 10.5l155 24q11 35 32 76q-34 48 -90 115q-7 11 -7 20q0 12 7 20q22 30 82 89t79 59q11 0 21 -7
+l115 -90q34 18 77 32q11 108 23 154q7 24 30 24h186q11 0 20 -7.5t10 -17.5l23 -153q34 -10 75 -31l118 89q8 7 20 7q11 0 21 -8q144 -133 144 -160q0 -8 -7 -19q-12 -16 -42 -54t-45 -60q23 -48 34 -82l152 -23q10 -2 17 -10.5t7 -19.5zM1920 198v-140q0 -16 -149 -31
+q-12 -27 -30 -52q51 -113 51 -138q0 -4 -4 -7q-122 -71 -124 -71q-8 0 -46 47t-52 68q-20 -2 -30 -2t-30 2q-14 -21 -52 -68t-46 -47q-2 0 -124 71q-4 3 -4 7q0 25 51 138q-18 25 -30 52q-149 15 -149 31v140q0 16 149 31q13 29 30 52q-51 113 -51 138q0 4 4 7q4 2 35 20
+t59 34t30 16q8 0 46 -46.5t52 -67.5q20 2 30 2t30 -2q51 71 92 112l6 2q4 0 124 -70q4 -3 4 -7q0 -25 -51 -138q17 -23 30 -52q149 -15 149 -31zM1920 1222v-140q0 -16 -149 -31q-12 -27 -30 -52q51 -113 51 -138q0 -4 -4 -7q-122 -71 -124 -71q-8 0 -46 47t-52 68
+q-20 -2 -30 -2t-30 2q-14 -21 -52 -68t-46 -47q-2 0 -124 71q-4 3 -4 7q0 25 51 138q-18 25 -30 52q-149 15 -149 31v140q0 16 149 31q13 29 30 52q-51 113 -51 138q0 4 4 7q4 2 35 20t59 34t30 16q8 0 46 -46.5t52 -67.5q20 2 30 2t30 -2q51 71 92 112l6 2q4 0 124 -70
+q4 -3 4 -7q0 -25 -51 -138q17 -23 30 -52q149 -15 149 -31z" />
+    <glyph glyph-name="comments" unicode="&#xf086;" horiz-adv-x="1792" 
+d="M1408 768q0 -139 -94 -257t-256.5 -186.5t-353.5 -68.5q-86 0 -176 16q-124 -88 -278 -128q-36 -9 -86 -16h-3q-11 0 -20.5 8t-11.5 21q-1 3 -1 6.5t0.5 6.5t2 6l2.5 5t3.5 5.5t4 5t4.5 5t4 4.5q5 6 23 25t26 29.5t22.5 29t25 38.5t20.5 44q-124 72 -195 177t-71 224
+q0 139 94 257t256.5 186.5t353.5 68.5t353.5 -68.5t256.5 -186.5t94 -257zM1792 512q0 -120 -71 -224.5t-195 -176.5q10 -24 20.5 -44t25 -38.5t22.5 -29t26 -29.5t23 -25q1 -1 4 -4.5t4.5 -5t4 -5t3.5 -5.5l2.5 -5t2 -6t0.5 -6.5t-1 -6.5q-3 -14 -13 -22t-22 -7
+q-50 7 -86 16q-154 40 -278 128q-90 -16 -176 -16q-271 0 -472 132q58 -4 88 -4q161 0 309 45t264 129q125 92 192 212t67 254q0 77 -23 152q129 -71 204 -178t75 -230z" />
+    <glyph glyph-name="thumbs_up_alt" unicode="&#xf087;" 
+d="M256 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 768q0 51 -39 89.5t-89 38.5h-352q0 58 48 159.5t48 160.5q0 98 -32 145t-128 47q-26 -26 -38 -85t-30.5 -125.5t-59.5 -109.5q-22 -23 -77 -91q-4 -5 -23 -30t-31.5 -41t-34.5 -42.5
+t-40 -44t-38.5 -35.5t-40 -27t-35.5 -9h-32v-640h32q13 0 31.5 -3t33 -6.5t38 -11t35 -11.5t35.5 -12.5t29 -10.5q211 -73 342 -73h121q192 0 192 167q0 26 -5 56q30 16 47.5 52.5t17.5 73.5t-18 69q53 50 53 119q0 25 -10 55.5t-25 47.5q32 1 53.5 47t21.5 81zM1536 769
+q0 -89 -49 -163q9 -33 9 -69q0 -77 -38 -144q3 -21 3 -43q0 -101 -60 -178q1 -139 -85 -219.5t-227 -80.5h-36h-93q-96 0 -189.5 22.5t-216.5 65.5q-116 40 -138 40h-288q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5h274q36 24 137 155q58 75 107 128
+q24 25 35.5 85.5t30.5 126.5t62 108q39 37 90 37q84 0 151 -32.5t102 -101.5t35 -186q0 -93 -48 -192h176q104 0 180 -76t76 -179z" />
+    <glyph glyph-name="thumbs_down_alt" unicode="&#xf088;" 
+d="M256 1088q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 512q0 35 -21.5 81t-53.5 47q15 17 25 47.5t10 55.5q0 69 -53 119q18 31 18 69q0 37 -17.5 73.5t-47.5 52.5q5 30 5 56q0 85 -49 126t-136 41h-128q-131 0 -342 -73q-5 -2 -29 -10.5
+t-35.5 -12.5t-35 -11.5t-38 -11t-33 -6.5t-31.5 -3h-32v-640h32q16 0 35.5 -9t40 -27t38.5 -35.5t40 -44t34.5 -42.5t31.5 -41t23 -30q55 -68 77 -91q41 -43 59.5 -109.5t30.5 -125.5t38 -85q96 0 128 47t32 145q0 59 -48 160.5t-48 159.5h352q50 0 89 38.5t39 89.5z
+M1536 511q0 -103 -76 -179t-180 -76h-176q48 -99 48 -192q0 -118 -35 -186q-35 -69 -102 -101.5t-151 -32.5q-51 0 -90 37q-34 33 -54 82t-25.5 90.5t-17.5 84.5t-31 64q-48 50 -107 127q-101 131 -137 155h-274q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5
+h288q22 0 138 40q128 44 223 66t200 22h112q140 0 226.5 -79t85.5 -216v-5q60 -77 60 -178q0 -22 -3 -43q38 -67 38 -144q0 -36 -9 -69q49 -73 49 -163z" />
+    <glyph glyph-name="star_half" unicode="&#xf089;" horiz-adv-x="896" 
+d="M832 1504v-1339l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41z" />
+    <glyph glyph-name="heart_empty" unicode="&#xf08a;" horiz-adv-x="1792" 
+d="M1664 940q0 81 -21.5 143t-55 98.5t-81.5 59.5t-94 31t-98 8t-112 -25.5t-110.5 -64t-86.5 -72t-60 -61.5q-18 -22 -49 -22t-49 22q-24 28 -60 61.5t-86.5 72t-110.5 64t-112 25.5t-98 -8t-94 -31t-81.5 -59.5t-55 -98.5t-21.5 -143q0 -168 187 -355l581 -560l580 559
+q188 188 188 356zM1792 940q0 -221 -229 -450l-623 -600q-18 -18 -44 -18t-44 18l-624 602q-10 8 -27.5 26t-55.5 65.5t-68 97.5t-53.5 121t-23.5 138q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5
+q224 0 351 -124t127 -344z" />
+    <glyph glyph-name="signout" unicode="&#xf08b;" horiz-adv-x="1664" 
+d="M640 96q0 -4 1 -20t0.5 -26.5t-3 -23.5t-10 -19.5t-20.5 -6.5h-320q-119 0 -203.5 84.5t-84.5 203.5v704q0 119 84.5 203.5t203.5 84.5h320q13 0 22.5 -9.5t9.5 -22.5q0 -4 1 -20t0.5 -26.5t-3 -23.5t-10 -19.5t-20.5 -6.5h-320q-66 0 -113 -47t-47 -113v-704
+q0 -66 47 -113t113 -47h288h11h13t11.5 -1t11.5 -3t8 -5.5t7 -9t2 -13.5zM1568 640q0 -26 -19 -45l-544 -544q-19 -19 -45 -19t-45 19t-19 45v288h-448q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h448v288q0 26 19 45t45 19t45 -19l544 -544q19 -19 19 -45z" />
+    <glyph glyph-name="linkedin_sign" unicode="&#xf08c;" 
+d="M237 122h231v694h-231v-694zM483 1030q-1 52 -36 86t-93 34t-94.5 -34t-36.5 -86q0 -51 35.5 -85.5t92.5 -34.5h1q59 0 95 34.5t36 85.5zM1068 122h231v398q0 154 -73 233t-193 79q-136 0 -209 -117h2v101h-231q3 -66 0 -694h231v388q0 38 7 56q15 35 45 59.5t74 24.5
+q116 0 116 -157v-371zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="pushpin" unicode="&#xf08d;" horiz-adv-x="1152" 
+d="M480 672v448q0 14 -9 23t-23 9t-23 -9t-9 -23v-448q0 -14 9 -23t23 -9t23 9t9 23zM1152 320q0 -26 -19 -45t-45 -19h-429l-51 -483q-2 -12 -10.5 -20.5t-20.5 -8.5h-1q-27 0 -32 27l-76 485h-404q-26 0 -45 19t-19 45q0 123 78.5 221.5t177.5 98.5v512q-52 0 -90 38
+t-38 90t38 90t90 38h640q52 0 90 -38t38 -90t-38 -90t-90 -38v-512q99 0 177.5 -98.5t78.5 -221.5z" />
+    <glyph glyph-name="external_link" unicode="&#xf08e;" horiz-adv-x="1792" 
+d="M1408 608v-320q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h704q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v320
+q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1792 1472v-512q0 -26 -19 -45t-45 -19t-45 19l-176 176l-652 -652q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l652 652l-176 176q-19 19 -19 45t19 45t45 19h512q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="signin" unicode="&#xf090;" 
+d="M1184 640q0 -26 -19 -45l-544 -544q-19 -19 -45 -19t-45 19t-19 45v288h-448q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h448v288q0 26 19 45t45 19t45 -19l544 -544q19 -19 19 -45zM1536 992v-704q0 -119 -84.5 -203.5t-203.5 -84.5h-320q-13 0 -22.5 9.5t-9.5 22.5
+q0 4 -1 20t-0.5 26.5t3 23.5t10 19.5t20.5 6.5h320q66 0 113 47t47 113v704q0 66 -47 113t-113 47h-288h-11h-13t-11.5 1t-11.5 3t-8 5.5t-7 9t-2 13.5q0 4 -1 20t-0.5 26.5t3 23.5t10 19.5t20.5 6.5h320q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="trophy" unicode="&#xf091;" horiz-adv-x="1664" 
+d="M458 653q-74 162 -74 371h-256v-96q0 -78 94.5 -162t235.5 -113zM1536 928v96h-256q0 -209 -74 -371q141 29 235.5 113t94.5 162zM1664 1056v-128q0 -71 -41.5 -143t-112 -130t-173 -97.5t-215.5 -44.5q-42 -54 -95 -95q-38 -34 -52.5 -72.5t-14.5 -89.5q0 -54 30.5 -91
+t97.5 -37q75 0 133.5 -45.5t58.5 -114.5v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v64q0 69 58.5 114.5t133.5 45.5q67 0 97.5 37t30.5 91q0 51 -14.5 89.5t-52.5 72.5q-53 41 -95 95q-113 5 -215.5 44.5t-173 97.5t-112 130t-41.5 143v128q0 40 28 68t68 28h288v96
+q0 66 47 113t113 47h576q66 0 113 -47t47 -113v-96h288q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="github_sign" unicode="&#xf092;" 
+d="M519 336q4 6 -3 13q-9 7 -14 2q-4 -6 3 -13q9 -7 14 -2zM491 377q-5 7 -12 4q-6 -4 0 -12q7 -8 12 -5q6 4 0 13zM450 417q2 4 -5 8q-7 2 -8 -2q-3 -5 4 -8q8 -2 9 2zM471 394q2 1 1.5 4.5t-3.5 5.5q-6 7 -10 3t1 -11q6 -6 11 -2zM557 319q2 7 -9 11q-9 3 -13 -4
+q-2 -7 9 -11q9 -3 13 4zM599 316q0 8 -12 8q-10 0 -10 -8t11 -8t11 8zM638 323q-2 7 -13 5t-9 -9q2 -8 12 -6t10 10zM1280 640q0 212 -150 362t-362 150t-362 -150t-150 -362q0 -167 98 -300.5t252 -185.5q18 -3 26.5 5t8.5 20q0 52 -1 95q-6 -1 -15.5 -2.5t-35.5 -2t-48 4
+t-43.5 20t-29.5 41.5q-23 59 -57 74q-2 1 -4.5 3.5l-8 8t-7 9.5t4 7.5t19.5 3.5q6 0 15 -2t30 -15.5t33 -35.5q16 -28 37.5 -42t43.5 -14t38 3.5t30 9.5q7 47 33 69q-49 6 -86 18.5t-73 39t-55.5 76t-19.5 119.5q0 79 53 137q-24 62 5 136q19 6 54.5 -7.5t60.5 -29.5l26 -16
+q58 17 128 17t128 -17q11 7 28.5 18t55.5 26t57 9q29 -74 5 -136q53 -58 53 -137q0 -57 -14 -100.5t-35.5 -70t-53.5 -44.5t-62.5 -26t-68.5 -12q35 -31 35 -95q0 -40 -0.5 -89t-0.5 -51q0 -12 8.5 -20t26.5 -5q154 52 252 185.5t98 300.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="upload_alt" unicode="&#xf093;" horiz-adv-x="1664" 
+d="M1280 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 288v-320q0 -40 -28 -68t-68 -28h-1472q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h427q21 -56 70.5 -92
+t110.5 -36h256q61 0 110.5 36t70.5 92h427q40 0 68 -28t28 -68zM1339 936q-17 -40 -59 -40h-256v-448q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v448h-256q-42 0 -59 40q-17 39 14 69l448 448q18 19 45 19t45 -19l448 -448q31 -30 14 -69z" />
+    <glyph glyph-name="lemon" unicode="&#xf094;" 
+d="M1407 710q0 44 -7 113.5t-18 96.5q-12 30 -17 44t-9 36.5t-4 48.5q0 23 5 68.5t5 67.5q0 37 -10 55q-4 1 -13 1q-19 0 -58 -4.5t-59 -4.5q-60 0 -176 24t-175 24q-43 0 -94.5 -11.5t-85 -23.5t-89.5 -34q-137 -54 -202 -103q-96 -73 -159.5 -189.5t-88 -236t-24.5 -248.5
+q0 -40 12.5 -120t12.5 -121q0 -23 -11 -66.5t-11 -65.5t12 -36.5t34 -14.5q24 0 72.5 11t73.5 11q57 0 169.5 -15.5t169.5 -15.5q181 0 284 36q129 45 235.5 152.5t166 245.5t59.5 275zM1535 712q0 -165 -70 -327.5t-196 -288t-281 -180.5q-124 -44 -326 -44
+q-57 0 -170 14.5t-169 14.5q-24 0 -72.5 -14.5t-73.5 -14.5q-73 0 -123.5 55.5t-50.5 128.5q0 24 11 68t11 67q0 40 -12.5 120.5t-12.5 121.5q0 111 18 217.5t54.5 209.5t100.5 194t150 156q78 59 232 120q194 78 316 78q60 0 175.5 -24t173.5 -24q19 0 57 5t58 5
+q81 0 118 -50.5t37 -134.5q0 -23 -5 -68t-5 -68q0 -13 2 -25t3.5 -16.5t7.5 -20.5t8 -20q16 -40 25 -118.5t9 -136.5z" />
+    <glyph glyph-name="phone" unicode="&#xf095;" horiz-adv-x="1408" 
+d="M1408 296q0 -27 -10 -70.5t-21 -68.5q-21 -50 -122 -106q-94 -51 -186 -51q-27 0 -53 3.5t-57.5 12.5t-47 14.5t-55.5 20.5t-49 18q-98 35 -175 83q-127 79 -264 216t-216 264q-48 77 -83 175q-3 9 -18 49t-20.5 55.5t-14.5 47t-12.5 57.5t-3.5 53q0 92 51 186
+q56 101 106 122q25 11 68.5 21t70.5 10q14 0 21 -3q18 -6 53 -76q11 -19 30 -54t35 -63.5t31 -53.5q3 -4 17.5 -25t21.5 -35.5t7 -28.5q0 -20 -28.5 -50t-62 -55t-62 -53t-28.5 -46q0 -9 5 -22.5t8.5 -20.5t14 -24t11.5 -19q76 -137 174 -235t235 -174q2 -1 19 -11.5t24 -14
+t20.5 -8.5t22.5 -5q18 0 46 28.5t53 62t55 62t50 28.5q14 0 28.5 -7t35.5 -21.5t25 -17.5q25 -15 53.5 -31t63.5 -35t54 -30q70 -35 76 -53q3 -7 3 -21z" />
+    <glyph glyph-name="check_empty" unicode="&#xf096;" horiz-adv-x="1408" 
+d="M1120 1280h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v832q0 66 -47 113t-113 47zM1408 1120v-832q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832
+q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="bookmark_empty" unicode="&#xf097;" horiz-adv-x="1280" 
+d="M1152 1280h-1024v-1242l423 406l89 85l89 -85l423 -406v1242zM1164 1408q23 0 44 -9q33 -13 52.5 -41t19.5 -62v-1289q0 -34 -19.5 -62t-52.5 -41q-19 -8 -44 -8q-48 0 -83 32l-441 424l-441 -424q-36 -33 -83 -33q-23 0 -44 9q-33 13 -52.5 41t-19.5 62v1289
+q0 34 19.5 62t52.5 41q21 9 44 9h1048z" />
+    <glyph glyph-name="phone_sign" unicode="&#xf098;" 
+d="M1280 343q0 11 -2 16t-18 16.5t-40.5 25t-47.5 26.5t-45.5 25t-28.5 15q-5 3 -19 13t-25 15t-21 5q-15 0 -36.5 -20.5t-39.5 -45t-38.5 -45t-33.5 -20.5q-7 0 -16.5 3.5t-15.5 6.5t-17 9.5t-14 8.5q-99 55 -170 126.5t-127 170.5q-2 3 -8.5 14t-9.5 17t-6.5 15.5
+t-3.5 16.5q0 13 20.5 33.5t45 38.5t45 39.5t20.5 36.5q0 10 -5 21t-15 25t-13 19q-3 6 -15 28.5t-25 45.5t-26.5 47.5t-25 40.5t-16.5 18t-16 2q-48 0 -101 -22q-46 -21 -80 -94.5t-34 -130.5q0 -16 2.5 -34t5 -30.5t9 -33t10 -29.5t12.5 -33t11 -30q60 -164 216.5 -320.5
+t320.5 -216.5q6 -2 30 -11t33 -12.5t29.5 -10t33 -9t30.5 -5t34 -2.5q57 0 130.5 34t94.5 80q22 53 22 101zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z
+" />
+    <glyph glyph-name="twitter" unicode="&#xf099;" horiz-adv-x="1664" 
+d="M1620 1128q-67 -98 -162 -167q1 -14 1 -42q0 -130 -38 -259.5t-115.5 -248.5t-184.5 -210.5t-258 -146t-323 -54.5q-271 0 -496 145q35 -4 78 -4q225 0 401 138q-105 2 -188 64.5t-114 159.5q33 -5 61 -5q43 0 85 11q-112 23 -185.5 111.5t-73.5 205.5v4q68 -38 146 -41
+q-66 44 -105 115t-39 154q0 88 44 163q121 -149 294.5 -238.5t371.5 -99.5q-8 38 -8 74q0 134 94.5 228.5t228.5 94.5q140 0 236 -102q109 21 205 78q-37 -115 -142 -178q93 10 186 50z" />
+    <glyph glyph-name="facebook" unicode="&#xf09a;" horiz-adv-x="1024" 
+d="M959 1524v-264h-157q-86 0 -116 -36t-30 -108v-189h293l-39 -296h-254v-759h-306v759h-255v296h255v218q0 186 104 288.5t277 102.5q147 0 228 -12z" />
+    <glyph glyph-name="github" unicode="&#xf09b;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5q0 -251 -146.5 -451.5t-378.5 -277.5q-27 -5 -40 7t-13 30q0 3 0.5 76.5t0.5 134.5q0 97 -52 142q57 6 102.5 18t94 39t81 66.5t53 105t20.5 150.5q0 119 -79 206q37 91 -8 204q-28 9 -81 -11t-92 -44l-38 -24
+q-93 26 -192 26t-192 -26q-16 11 -42.5 27t-83.5 38.5t-85 13.5q-45 -113 -8 -204q-79 -87 -79 -206q0 -85 20.5 -150t52.5 -105t80.5 -67t94 -39t102.5 -18q-39 -36 -49 -103q-21 -10 -45 -15t-57 -5t-65.5 21.5t-55.5 62.5q-19 32 -48.5 52t-49.5 24l-20 3q-21 0 -29 -4.5
+t-5 -11.5t9 -14t13 -12l7 -5q22 -10 43.5 -38t31.5 -51l10 -23q13 -38 44 -61.5t67 -30t69.5 -7t55.5 3.5l23 4q0 -38 0.5 -88.5t0.5 -54.5q0 -18 -13 -30t-40 -7q-232 77 -378.5 277.5t-146.5 451.5q0 209 103 385.5t279.5 279.5t385.5 103zM291 305q3 7 -7 12
+q-10 3 -13 -2q-3 -7 7 -12q9 -6 13 2zM322 271q7 5 -2 16q-10 9 -16 3q-7 -5 2 -16q10 -10 16 -3zM352 226q9 7 0 19q-8 13 -17 6q-9 -5 0 -18t17 -7zM394 184q8 8 -4 19q-12 12 -20 3q-9 -8 4 -19q12 -12 20 -3zM451 159q3 11 -13 16q-15 4 -19 -7t13 -15q15 -6 19 6z
+M514 154q0 13 -17 11q-16 0 -16 -11q0 -13 17 -11q16 0 16 11zM572 164q-2 11 -18 9q-16 -3 -14 -15t18 -8t14 14z" />
+    <glyph glyph-name="unlock" unicode="&#xf09c;" horiz-adv-x="1664" 
+d="M1664 960v-256q0 -26 -19 -45t-45 -19h-64q-26 0 -45 19t-19 45v256q0 106 -75 181t-181 75t-181 -75t-75 -181v-192h96q40 0 68 -28t28 -68v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h672v192q0 185 131.5 316.5t316.5 131.5
+t316.5 -131.5t131.5 -316.5z" />
+    <glyph glyph-name="credit_card" unicode="&#xf09d;" horiz-adv-x="1920" 
+d="M1760 1408q66 0 113 -47t47 -113v-1216q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1600zM160 1280q-13 0 -22.5 -9.5t-9.5 -22.5v-224h1664v224q0 13 -9.5 22.5t-22.5 9.5h-1600zM1760 0q13 0 22.5 9.5t9.5 22.5v608h-1664v-608
+q0 -13 9.5 -22.5t22.5 -9.5h1600zM256 128v128h256v-128h-256zM640 128v128h384v-128h-384z" />
+    <glyph glyph-name="rss" unicode="&#xf09e;" horiz-adv-x="1408" 
+d="M384 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 69q2 -28 -17 -48q-18 -21 -47 -21h-135q-25 0 -43 16.5t-20 41.5q-22 229 -184.5 391.5t-391.5 184.5q-25 2 -41.5 20t-16.5 43v135q0 29 21 47q17 17 43 17h5q160 -13 306 -80.5
+t259 -181.5q114 -113 181.5 -259t80.5 -306zM1408 67q2 -27 -18 -47q-18 -20 -46 -20h-143q-26 0 -44.5 17.5t-19.5 42.5q-12 215 -101 408.5t-231.5 336t-336 231.5t-408.5 102q-25 1 -42.5 19.5t-17.5 43.5v143q0 28 20 46q18 18 44 18h3q262 -13 501.5 -120t425.5 -294
+q187 -186 294 -425.5t120 -501.5z" />
+    <glyph glyph-name="hdd" unicode="&#xf0a0;" 
+d="M1040 320q0 -33 -23.5 -56.5t-56.5 -23.5t-56.5 23.5t-23.5 56.5t23.5 56.5t56.5 23.5t56.5 -23.5t23.5 -56.5zM1296 320q0 -33 -23.5 -56.5t-56.5 -23.5t-56.5 23.5t-23.5 56.5t23.5 56.5t56.5 23.5t56.5 -23.5t23.5 -56.5zM1408 160v320q0 13 -9.5 22.5t-22.5 9.5
+h-1216q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h1216q13 0 22.5 9.5t9.5 22.5zM178 640h1180l-157 482q-4 13 -16 21.5t-26 8.5h-782q-14 0 -26 -8.5t-16 -21.5zM1536 480v-320q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v320q0 25 16 75
+l197 606q17 53 63 86t101 33h782q55 0 101 -33t63 -86l197 -606q16 -50 16 -75z" />
+    <glyph glyph-name="bullhorn" unicode="&#xf0a1;" horiz-adv-x="1792" 
+d="M1664 896q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5v-384q0 -52 -38 -90t-90 -38q-417 347 -812 380q-58 -19 -91 -66t-31 -100.5t40 -92.5q-20 -33 -23 -65.5t6 -58t33.5 -55t48 -50t61.5 -50.5q-29 -58 -111.5 -83t-168.5 -11.5t-132 55.5q-7 23 -29.5 87.5
+t-32 94.5t-23 89t-15 101t3.5 98.5t22 110.5h-122q-66 0 -113 47t-47 113v192q0 66 47 113t113 47h480q435 0 896 384q52 0 90 -38t38 -90v-384zM1536 292v954q-394 -302 -768 -343v-270q377 -42 768 -341z" />
+    <glyph glyph-name="bell" unicode="&#xf0a2;" horiz-adv-x="1792" 
+d="M912 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM246 128h1300q-266 300 -266 832q0 51 -24 105t-69 103t-121.5 80.5t-169.5 31.5t-169.5 -31.5t-121.5 -80.5t-69 -103t-24 -105q0 -532 -266 -832z
+M1728 128q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-181 75t-75 181h-448q-52 0 -90 38t-38 90q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q190 -28 307 -158.5
+t117 -282.5q0 -139 19.5 -260t50 -206t74.5 -158.5t85 -119.5t91 -88z" />
+    <glyph glyph-name="certificate" unicode="&#xf0a3;" 
+d="M1376 640l138 -135q30 -28 20 -70q-12 -41 -52 -51l-188 -48l53 -186q12 -41 -19 -70q-29 -31 -70 -19l-186 53l-48 -188q-10 -40 -51 -52q-12 -2 -19 -2q-31 0 -51 22l-135 138l-135 -138q-28 -30 -70 -20q-41 11 -51 52l-48 188l-186 -53q-41 -12 -70 19q-31 29 -19 70
+l53 186l-188 48q-40 10 -52 51q-10 42 20 70l138 135l-138 135q-30 28 -20 70q12 41 52 51l188 48l-53 186q-12 41 19 70q29 31 70 19l186 -53l48 188q10 41 51 51q41 12 70 -19l135 -139l135 139q29 30 70 19q41 -10 51 -51l48 -188l186 53q41 12 70 -19q31 -29 19 -70
+l-53 -186l188 -48q40 -10 52 -51q10 -42 -20 -70z" />
+    <glyph glyph-name="hand_right" unicode="&#xf0a4;" horiz-adv-x="1792" 
+d="M256 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 768q0 51 -39 89.5t-89 38.5h-576q0 20 15 48.5t33 55t33 68t15 84.5q0 67 -44.5 97.5t-115.5 30.5q-24 0 -90 -139q-24 -44 -37 -65q-40 -64 -112 -145q-71 -81 -101 -106
+q-69 -57 -140 -57h-32v-640h32q72 0 167 -32t193.5 -64t179.5 -32q189 0 189 167q0 26 -5 56q30 16 47.5 52.5t17.5 73.5t-18 69q53 50 53 119q0 25 -10 55.5t-25 47.5h331q52 0 90 38t38 90zM1792 769q0 -105 -75.5 -181t-180.5 -76h-169q-4 -62 -37 -119q3 -21 3 -43
+q0 -101 -60 -178q1 -139 -85 -219.5t-227 -80.5q-133 0 -322 69q-164 59 -223 59h-288q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5h288q10 0 21.5 4.5t23.5 14t22.5 18t24 22.5t20.5 21.5t19 21.5t14 17q65 74 100 129q13 21 33 62t37 72t40.5 63t55 49.5
+t69.5 17.5q125 0 206.5 -67t81.5 -189q0 -68 -22 -128h374q104 0 180 -76t76 -179z" />
+    <glyph glyph-name="hand_left" unicode="&#xf0a5;" horiz-adv-x="1792" 
+d="M1376 128h32v640h-32q-35 0 -67.5 12t-62.5 37t-50 46t-49 54q-8 9 -12 14q-72 81 -112 145q-14 22 -38 68q-1 3 -10.5 22.5t-18.5 36t-20 35.5t-21.5 30.5t-18.5 11.5q-71 0 -115.5 -30.5t-44.5 -97.5q0 -43 15 -84.5t33 -68t33 -55t15 -48.5h-576q-50 0 -89 -38.5
+t-39 -89.5q0 -52 38 -90t90 -38h331q-15 -17 -25 -47.5t-10 -55.5q0 -69 53 -119q-18 -32 -18 -69t17.5 -73.5t47.5 -52.5q-4 -24 -4 -56q0 -85 48.5 -126t135.5 -41q84 0 183 32t194 64t167 32zM1664 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45z
+M1792 768v-640q0 -53 -37.5 -90.5t-90.5 -37.5h-288q-59 0 -223 -59q-190 -69 -317 -69q-142 0 -230 77.5t-87 217.5l1 5q-61 76 -61 178q0 22 3 43q-33 57 -37 119h-169q-105 0 -180.5 76t-75.5 181q0 103 76 179t180 76h374q-22 60 -22 128q0 122 81.5 189t206.5 67
+q38 0 69.5 -17.5t55 -49.5t40.5 -63t37 -72t33 -62q35 -55 100 -129q2 -3 14 -17t19 -21.5t20.5 -21.5t24 -22.5t22.5 -18t23.5 -14t21.5 -4.5h288q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="hand_up" unicode="&#xf0a6;" 
+d="M1280 -64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 700q0 189 -167 189q-26 0 -56 -5q-16 30 -52.5 47.5t-73.5 17.5t-69 -18q-50 53 -119 53q-25 0 -55.5 -10t-47.5 -25v331q0 52 -38 90t-90 38q-51 0 -89.5 -39t-38.5 -89v-576
+q-20 0 -48.5 15t-55 33t-68 33t-84.5 15q-67 0 -97.5 -44.5t-30.5 -115.5q0 -24 139 -90q44 -24 65 -37q64 -40 145 -112q81 -71 106 -101q57 -69 57 -140v-32h640v32q0 72 32 167t64 193.5t32 179.5zM1536 705q0 -133 -69 -322q-59 -164 -59 -223v-288q0 -53 -37.5 -90.5
+t-90.5 -37.5h-640q-53 0 -90.5 37.5t-37.5 90.5v288q0 10 -4.5 21.5t-14 23.5t-18 22.5t-22.5 24t-21.5 20.5t-21.5 19t-17 14q-74 65 -129 100q-21 13 -62 33t-72 37t-63 40.5t-49.5 55t-17.5 69.5q0 125 67 206.5t189 81.5q68 0 128 -22v374q0 104 76 180t179 76
+q105 0 181 -75.5t76 -180.5v-169q62 -4 119 -37q21 3 43 3q101 0 178 -60q139 1 219.5 -85t80.5 -227z" />
+    <glyph glyph-name="hand_down" unicode="&#xf0a7;" 
+d="M1408 576q0 84 -32 183t-64 194t-32 167v32h-640v-32q0 -35 -12 -67.5t-37 -62.5t-46 -50t-54 -49q-9 -8 -14 -12q-81 -72 -145 -112q-22 -14 -68 -38q-3 -1 -22.5 -10.5t-36 -18.5t-35.5 -20t-30.5 -21.5t-11.5 -18.5q0 -71 30.5 -115.5t97.5 -44.5q43 0 84.5 15t68 33
+t55 33t48.5 15v-576q0 -50 38.5 -89t89.5 -39q52 0 90 38t38 90v331q46 -35 103 -35q69 0 119 53q32 -18 69 -18t73.5 17.5t52.5 47.5q24 -4 56 -4q85 0 126 48.5t41 135.5zM1280 1344q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 580
+q0 -142 -77.5 -230t-217.5 -87l-5 1q-76 -61 -178 -61q-22 0 -43 3q-54 -30 -119 -37v-169q0 -105 -76 -180.5t-181 -75.5q-103 0 -179 76t-76 180v374q-54 -22 -128 -22q-121 0 -188.5 81.5t-67.5 206.5q0 38 17.5 69.5t49.5 55t63 40.5t72 37t62 33q55 35 129 100
+q3 2 17 14t21.5 19t21.5 20.5t22.5 24t18 22.5t14 23.5t4.5 21.5v288q0 53 37.5 90.5t90.5 37.5h640q53 0 90.5 -37.5t37.5 -90.5v-288q0 -59 59 -223q69 -190 69 -317z" />
+    <glyph glyph-name="circle_arrow_left" unicode="&#xf0a8;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-502l189 189q19 19 19 45t-19 45l-91 91q-18 18 -45 18t-45 -18l-362 -362l-91 -91q-18 -18 -18 -45t18 -45l91 -91l362 -362q18 -18 45 -18t45 18l91 91q18 18 18 45t-18 45l-189 189h502q26 0 45 19t19 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_right" unicode="&#xf0a9;" 
+d="M1285 640q0 27 -18 45l-91 91l-362 362q-18 18 -45 18t-45 -18l-91 -91q-18 -18 -18 -45t18 -45l189 -189h-502q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h502l-189 -189q-19 -19 -19 -45t19 -45l91 -91q18 -18 45 -18t45 18l362 362l91 91q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_up" unicode="&#xf0aa;" 
+d="M1284 641q0 27 -18 45l-362 362l-91 91q-18 18 -45 18t-45 -18l-91 -91l-362 -362q-18 -18 -18 -45t18 -45l91 -91q18 -18 45 -18t45 18l189 189v-502q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v502l189 -189q19 -19 45 -19t45 19l91 91q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_down" unicode="&#xf0ab;" 
+d="M1284 639q0 27 -18 45l-91 91q-18 18 -45 18t-45 -18l-189 -189v502q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-502l-189 189q-19 19 -45 19t-45 -19l-91 -91q-18 -18 -18 -45t18 -45l362 -362l91 -91q18 -18 45 -18t45 18l91 91l362 362q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="globe" unicode="&#xf0ac;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM1042 887q-2 -1 -9.5 -9.5t-13.5 -9.5q2 0 4.5 5t5 11t3.5 7q6 7 22 15q14 6 52 12q34 8 51 -11
+q-2 2 9.5 13t14.5 12q3 2 15 4.5t15 7.5l2 22q-12 -1 -17.5 7t-6.5 21q0 -2 -6 -8q0 7 -4.5 8t-11.5 -1t-9 -1q-10 3 -15 7.5t-8 16.5t-4 15q-2 5 -9.5 11t-9.5 10q-1 2 -2.5 5.5t-3 6.5t-4 5.5t-5.5 2.5t-7 -5t-7.5 -10t-4.5 -5q-3 2 -6 1.5t-4.5 -1t-4.5 -3t-5 -3.5
+q-3 -2 -8.5 -3t-8.5 -2q15 5 -1 11q-10 4 -16 3q9 4 7.5 12t-8.5 14h5q-1 4 -8.5 8.5t-17.5 8.5t-13 6q-8 5 -34 9.5t-33 0.5q-5 -6 -4.5 -10.5t4 -14t3.5 -12.5q1 -6 -5.5 -13t-6.5 -12q0 -7 14 -15.5t10 -21.5q-3 -8 -16 -16t-16 -12q-5 -8 -1.5 -18.5t10.5 -16.5
+q2 -2 1.5 -4t-3.5 -4.5t-5.5 -4t-6.5 -3.5l-3 -2q-11 -5 -20.5 6t-13.5 26q-7 25 -16 30q-23 8 -29 -1q-5 13 -41 26q-25 9 -58 4q6 1 0 15q-7 15 -19 12q3 6 4 17.5t1 13.5q3 13 12 23q1 1 7 8.5t9.5 13.5t0.5 6q35 -4 50 11q5 5 11.5 17t10.5 17q9 6 14 5.5t14.5 -5.5
+t14.5 -5q14 -1 15.5 11t-7.5 20q12 -1 3 17q-4 7 -8 9q-12 4 -27 -5q-8 -4 2 -8q-1 1 -9.5 -10.5t-16.5 -17.5t-16 5q-1 1 -5.5 13.5t-9.5 13.5q-8 0 -16 -15q3 8 -11 15t-24 8q19 12 -8 27q-7 4 -20.5 5t-19.5 -4q-5 -7 -5.5 -11.5t5 -8t10.5 -5.5t11.5 -4t8.5 -3
+q14 -10 8 -14q-2 -1 -8.5 -3.5t-11.5 -4.5t-6 -4q-3 -4 0 -14t-2 -14q-5 5 -9 17.5t-7 16.5q7 -9 -25 -6l-10 1q-4 0 -16 -2t-20.5 -1t-13.5 8q-4 8 0 20q1 4 4 2q-4 3 -11 9.5t-10 8.5q-46 -15 -94 -41q6 -1 12 1q5 2 13 6.5t10 5.5q34 14 42 7l5 5q14 -16 20 -25
+q-7 4 -30 1q-20 -6 -22 -12q7 -12 5 -18q-4 3 -11.5 10t-14.5 11t-15 5q-16 0 -22 -1q-146 -80 -235 -222q7 -7 12 -8q4 -1 5 -9t2.5 -11t11.5 3q9 -8 3 -19q1 1 44 -27q19 -17 21 -21q3 -11 -10 -18q-1 2 -9 9t-9 4q-3 -5 0.5 -18.5t10.5 -12.5q-7 0 -9.5 -16t-2.5 -35.5
+t-1 -23.5l2 -1q-3 -12 5.5 -34.5t21.5 -19.5q-13 -3 20 -43q6 -8 8 -9q3 -2 12 -7.5t15 -10t10 -10.5q4 -5 10 -22.5t14 -23.5q-2 -6 9.5 -20t10.5 -23q-1 0 -2.5 -1t-2.5 -1q3 -7 15.5 -14t15.5 -13q1 -3 2 -10t3 -11t8 -2q2 20 -24 62q-15 25 -17 29q-3 5 -5.5 15.5
+t-4.5 14.5q2 0 6 -1.5t8.5 -3.5t7.5 -4t2 -3q-3 -7 2 -17.5t12 -18.5t17 -19t12 -13q6 -6 14 -19.5t0 -13.5q9 0 20 -10.5t17 -19.5q5 -8 8 -26t5 -24q2 -7 8.5 -13.5t12.5 -9.5l16 -8t13 -7q5 -2 18.5 -10.5t21.5 -11.5q10 -4 16 -4t14.5 2.5t13.5 3.5q15 2 29 -15t21 -21
+q36 -19 55 -11q-2 -1 0.5 -7.5t8 -15.5t9 -14.5t5.5 -8.5q5 -6 18 -15t18 -15q6 4 7 9q-3 -8 7 -20t18 -10q14 3 14 32q-31 -15 -49 18q0 1 -2.5 5.5t-4 8.5t-2.5 8.5t0 7.5t5 3q9 0 10 3.5t-2 12.5t-4 13q-1 8 -11 20t-12 15q-5 -9 -16 -8t-16 9q0 -1 -1.5 -5.5t-1.5 -6.5
+q-13 0 -15 1q1 3 2.5 17.5t3.5 22.5q1 4 5.5 12t7.5 14.5t4 12.5t-4.5 9.5t-17.5 2.5q-19 -1 -26 -20q-1 -3 -3 -10.5t-5 -11.5t-9 -7q-7 -3 -24 -2t-24 5q-13 8 -22.5 29t-9.5 37q0 10 2.5 26.5t3 25t-5.5 24.5q3 2 9 9.5t10 10.5q2 1 4.5 1.5t4.5 0t4 1.5t3 6q-1 1 -4 3
+q-3 3 -4 3q7 -3 28.5 1.5t27.5 -1.5q15 -11 22 2q0 1 -2.5 9.5t-0.5 13.5q5 -27 29 -9q3 -3 15.5 -5t17.5 -5q3 -2 7 -5.5t5.5 -4.5t5 0.5t8.5 6.5q10 -14 12 -24q11 -40 19 -44q7 -3 11 -2t4.5 9.5t0 14t-1.5 12.5l-1 8v18l-1 8q-15 3 -18.5 12t1.5 18.5t15 18.5q1 1 8 3.5
+t15.5 6.5t12.5 8q21 19 15 35q7 0 11 9q-1 0 -5 3t-7.5 5t-4.5 2q9 5 2 16q5 3 7.5 11t7.5 10q9 -12 21 -2q8 8 1 16q5 7 20.5 10.5t18.5 9.5q7 -2 8 2t1 12t3 12q4 5 15 9t13 5l17 11q3 4 0 4q18 -2 31 11q10 11 -6 20q3 6 -3 9.5t-15 5.5q3 1 11.5 0.5t10.5 1.5
+q15 10 -7 16q-17 5 -43 -12zM879 10q206 36 351 189q-3 3 -12.5 4.5t-12.5 3.5q-18 7 -24 8q1 7 -2.5 13t-8 9t-12.5 8t-11 7q-2 2 -7 6t-7 5.5t-7.5 4.5t-8.5 2t-10 -1l-3 -1q-3 -1 -5.5 -2.5t-5.5 -3t-4 -3t0 -2.5q-21 17 -36 22q-5 1 -11 5.5t-10.5 7t-10 1.5t-11.5 -7
+q-5 -5 -6 -15t-2 -13q-7 5 0 17.5t2 18.5q-3 6 -10.5 4.5t-12 -4.5t-11.5 -8.5t-9 -6.5t-8.5 -5.5t-8.5 -7.5q-3 -4 -6 -12t-5 -11q-2 4 -11.5 6.5t-9.5 5.5q2 -10 4 -35t5 -38q7 -31 -12 -48q-27 -25 -29 -40q-4 -22 12 -26q0 -7 -8 -20.5t-7 -21.5q0 -6 2 -16z" />
+    <glyph glyph-name="wrench" unicode="&#xf0ad;" horiz-adv-x="1664" 
+d="M384 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1028 484l-682 -682q-37 -37 -90 -37q-52 0 -91 37l-106 108q-38 36 -38 90q0 53 38 91l681 681q39 -98 114.5 -173.5t173.5 -114.5zM1662 919q0 -39 -23 -106q-47 -134 -164.5 -217.5
+t-258.5 -83.5q-185 0 -316.5 131.5t-131.5 316.5t131.5 316.5t316.5 131.5q58 0 121.5 -16.5t107.5 -46.5q16 -11 16 -28t-16 -28l-293 -169v-224l193 -107q5 3 79 48.5t135.5 81t70.5 35.5q15 0 23.5 -10t8.5 -25z" />
+    <glyph glyph-name="tasks" unicode="&#xf0ae;" horiz-adv-x="1792" 
+d="M1024 128h640v128h-640v-128zM640 640h1024v128h-1024v-128zM1280 1152h384v128h-384v-128zM1792 320v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 832v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19
+t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 1344v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="filter" unicode="&#xf0b0;" horiz-adv-x="1408" 
+d="M1403 1241q17 -41 -14 -70l-493 -493v-742q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-256 256q-19 19 -19 45v486l-493 493q-31 29 -14 70q17 39 59 39h1280q42 0 59 -39z" />
+    <glyph glyph-name="briefcase" unicode="&#xf0b1;" horiz-adv-x="1792" 
+d="M640 1280h512v128h-512v-128zM1792 640v-480q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v480h672v-160q0 -26 19 -45t45 -19h320q26 0 45 19t19 45v160h672zM1024 640v-128h-256v128h256zM1792 1120v-384h-1792v384q0 66 47 113t113 47h352v160q0 40 28 68
+t68 28h576q40 0 68 -28t28 -68v-160h352q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="fullscreen" unicode="&#xf0b2;" 
+d="M1283 995l-355 -355l355 -355l144 144q29 31 70 14q39 -17 39 -59v-448q0 -26 -19 -45t-45 -19h-448q-42 0 -59 40q-17 39 14 69l144 144l-355 355l-355 -355l144 -144q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l144 -144
+l355 355l-355 355l-144 -144q-19 -19 -45 -19q-12 0 -24 5q-40 17 -40 59v448q0 26 19 45t45 19h448q42 0 59 -40q17 -39 -14 -69l-144 -144l355 -355l355 355l-144 144q-31 30 -14 69q17 40 59 40h448q26 0 45 -19t19 -45v-448q0 -42 -39 -59q-13 -5 -25 -5q-26 0 -45 19z
+" />
+    <glyph glyph-name="group" unicode="&#xf0c0;" horiz-adv-x="1920" 
+d="M593 640q-162 -5 -265 -128h-134q-82 0 -138 40.5t-56 118.5q0 353 124 353q6 0 43.5 -21t97.5 -42.5t119 -21.5q67 0 133 23q-5 -37 -5 -66q0 -139 81 -256zM1664 3q0 -120 -73 -189.5t-194 -69.5h-874q-121 0 -194 69.5t-73 189.5q0 53 3.5 103.5t14 109t26.5 108.5
+t43 97.5t62 81t85.5 53.5t111.5 20q10 0 43 -21.5t73 -48t107 -48t135 -21.5t135 21.5t107 48t73 48t43 21.5q61 0 111.5 -20t85.5 -53.5t62 -81t43 -97.5t26.5 -108.5t14 -109t3.5 -103.5zM640 1280q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75
+t75 -181zM1344 896q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5zM1920 671q0 -78 -56 -118.5t-138 -40.5h-134q-103 123 -265 128q81 117 81 256q0 29 -5 66q66 -23 133 -23q59 0 119 21.5t97.5 42.5
+t43.5 21q124 0 124 -353zM1792 1280q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181z" />
+    <glyph glyph-name="link" unicode="&#xf0c1;" horiz-adv-x="1664" 
+d="M1456 320q0 40 -28 68l-208 208q-28 28 -68 28q-42 0 -72 -32q3 -3 19 -18.5t21.5 -21.5t15 -19t13 -25.5t3.5 -27.5q0 -40 -28 -68t-68 -28q-15 0 -27.5 3.5t-25.5 13t-19 15t-21.5 21.5t-18.5 19q-33 -31 -33 -73q0 -40 28 -68l206 -207q27 -27 68 -27q40 0 68 26
+l147 146q28 28 28 67zM753 1025q0 40 -28 68l-206 207q-28 28 -68 28q-39 0 -68 -27l-147 -146q-28 -28 -28 -67q0 -40 28 -68l208 -208q27 -27 68 -27q42 0 72 31q-3 3 -19 18.5t-21.5 21.5t-15 19t-13 25.5t-3.5 27.5q0 40 28 68t68 28q15 0 27.5 -3.5t25.5 -13t19 -15
+t21.5 -21.5t18.5 -19q33 31 33 73zM1648 320q0 -120 -85 -203l-147 -146q-83 -83 -203 -83q-121 0 -204 85l-206 207q-83 83 -83 203q0 123 88 209l-88 88q-86 -88 -208 -88q-120 0 -204 84l-208 208q-84 84 -84 204t85 203l147 146q83 83 203 83q121 0 204 -85l206 -207
+q83 -83 83 -203q0 -123 -88 -209l88 -88q86 88 208 88q120 0 204 -84l208 -208q84 -84 84 -204z" />
+    <glyph glyph-name="cloud" unicode="&#xf0c2;" horiz-adv-x="1920" 
+d="M1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088q-185 0 -316.5 131.5t-131.5 316.5q0 132 71 241.5t187 163.5q-2 28 -2 43q0 212 150 362t362 150q158 0 286.5 -88t187.5 -230q70 62 166 62q106 0 181 -75t75 -181q0 -75 -41 -138q129 -30 213 -134.5t84 -239.5z
+" />
+    <glyph glyph-name="beaker" unicode="&#xf0c3;" horiz-adv-x="1664" 
+d="M1527 88q56 -89 21.5 -152.5t-140.5 -63.5h-1152q-106 0 -140.5 63.5t21.5 152.5l503 793v399h-64q-26 0 -45 19t-19 45t19 45t45 19h512q26 0 45 -19t19 -45t-19 -45t-45 -19h-64v-399zM748 813l-272 -429h712l-272 429l-20 31v37v399h-128v-399v-37z" />
+    <glyph glyph-name="cut" unicode="&#xf0c4;" horiz-adv-x="1792" 
+d="M960 640q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1260 576l507 -398q28 -20 25 -56q-5 -35 -35 -51l-128 -64q-13 -7 -29 -7q-17 0 -31 8l-690 387l-110 -66q-8 -4 -12 -5q14 -49 10 -97q-7 -77 -56 -147.5t-132 -123.5q-132 -84 -277 -84
+q-136 0 -222 78q-90 84 -79 207q7 76 56 147t131 124q132 84 278 84q83 0 151 -31q9 13 22 22l122 73l-122 73q-13 9 -22 22q-68 -31 -151 -31q-146 0 -278 84q-82 53 -131 124t-56 147q-5 59 15.5 113t63.5 93q85 79 222 79q145 0 277 -84q83 -52 132 -123t56 -148
+q4 -48 -10 -97q4 -1 12 -5l110 -66l690 387q14 8 31 8q16 0 29 -7l128 -64q30 -16 35 -51q3 -36 -25 -56zM579 836q46 42 21 108t-106 117q-92 59 -192 59q-74 0 -113 -36q-46 -42 -21 -108t106 -117q92 -59 192 -59q74 0 113 36zM494 91q81 51 106 117t-21 108
+q-39 36 -113 36q-100 0 -192 -59q-81 -51 -106 -117t21 -108q39 -36 113 -36q100 0 192 59zM672 704l96 -58v11q0 36 33 56l14 8l-79 47l-26 -26q-3 -3 -10 -11t-12 -12q-2 -2 -4 -3.5t-3 -2.5zM896 480l96 -32l736 576l-128 64l-768 -431v-113l-160 -96l9 -8q2 -2 7 -6
+q4 -4 11 -12t11 -12l26 -26zM1600 64l128 64l-520 408l-177 -138q-2 -3 -13 -7z" />
+    <glyph glyph-name="copy" unicode="&#xf0c5;" horiz-adv-x="1792" 
+d="M1696 1152q40 0 68 -28t28 -68v-1216q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v288h-544q-40 0 -68 28t-28 68v672q0 40 20 88t48 76l408 408q28 28 76 48t88 20h416q40 0 68 -28t28 -68v-328q68 40 128 40h416zM1152 939l-299 -299h299v299zM512 1323l-299 -299
+h299v299zM708 676l316 316v416h-384v-416q0 -40 -28 -68t-68 -28h-416v-640h512v256q0 40 20 88t48 76zM1664 -128v1152h-384v-416q0 -40 -28 -68t-68 -28h-416v-640h896z" />
+    <glyph glyph-name="paper_clip" unicode="&#xf0c6;" horiz-adv-x="1408" 
+d="M1404 151q0 -117 -79 -196t-196 -79q-135 0 -235 100l-777 776q-113 115 -113 271q0 159 110 270t269 111q158 0 273 -113l605 -606q10 -10 10 -22q0 -16 -30.5 -46.5t-46.5 -30.5q-13 0 -23 10l-606 607q-79 77 -181 77q-106 0 -179 -75t-73 -181q0 -105 76 -181
+l776 -777q63 -63 145 -63q64 0 106 42t42 106q0 82 -63 145l-581 581q-26 24 -60 24q-29 0 -48 -19t-19 -48q0 -32 25 -59l410 -410q10 -10 10 -22q0 -16 -31 -47t-47 -31q-12 0 -22 10l-410 410q-63 61 -63 149q0 82 57 139t139 57q88 0 149 -63l581 -581q100 -98 100 -235
+z" />
+    <glyph glyph-name="save" unicode="&#xf0c7;" 
+d="M384 0h768v384h-768v-384zM1280 0h128v896q0 14 -10 38.5t-20 34.5l-281 281q-10 10 -34 20t-39 10v-416q0 -40 -28 -68t-68 -28h-576q-40 0 -68 28t-28 68v416h-128v-1280h128v416q0 40 28 68t68 28h832q40 0 68 -28t28 -68v-416zM896 928v320q0 13 -9.5 22.5t-22.5 9.5
+h-192q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 22.5zM1536 896v-928q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h928q40 0 88 -20t76 -48l280 -280q28 -28 48 -76t20 -88z" />
+    <glyph glyph-name="sign_blank" unicode="&#xf0c8;" 
+d="M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="reorder" unicode="&#xf0c9;" 
+d="M1536 192v-128q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1536 704v-128q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1536 1216v-128q0 -26 -19 -45
+t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="ul" unicode="&#xf0ca;" horiz-adv-x="1792" 
+d="M384 128q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 640q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5
+t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5zM384 1152q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1792 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z
+M1792 1248v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="ol" unicode="&#xf0cb;" horiz-adv-x="1792" 
+d="M381 -84q0 -80 -54.5 -126t-135.5 -46q-106 0 -172 66l57 88q49 -45 106 -45q29 0 50.5 14.5t21.5 42.5q0 64 -105 56l-26 56q8 10 32.5 43.5t42.5 54t37 38.5v1q-16 0 -48.5 -1t-48.5 -1v-53h-106v152h333v-88l-95 -115q51 -12 81 -49t30 -88zM383 543v-159h-362
+q-6 36 -6 54q0 51 23.5 93t56.5 68t66 47.5t56.5 43.5t23.5 45q0 25 -14.5 38.5t-39.5 13.5q-46 0 -81 -58l-85 59q24 51 71.5 79.5t105.5 28.5q73 0 123 -41.5t50 -112.5q0 -50 -34 -91.5t-75 -64.5t-75.5 -50.5t-35.5 -52.5h127v60h105zM1792 224v-192q0 -13 -9.5 -22.5
+t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 14 9 23t23 9h1216q13 0 22.5 -9.5t9.5 -22.5zM384 1123v-99h-335v99h107q0 41 0.5 121.5t0.5 121.5v12h-2q-8 -17 -50 -54l-71 76l136 127h106v-404h108zM1792 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216
+q-13 0 -22.5 9.5t-9.5 22.5v192q0 14 9 23t23 9h1216q13 0 22.5 -9.5t9.5 -22.5zM1792 1248v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="strikethrough" unicode="&#xf0cc;" horiz-adv-x="1792" 
+d="M1760 640q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1728q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h1728zM483 704q-28 35 -51 80q-48 98 -48 188q0 181 134 309q133 127 393 127q50 0 167 -19q66 -12 177 -48q10 -38 21 -118q14 -123 14 -183q0 -18 -5 -45l-12 -3l-84 6
+l-14 2q-50 149 -103 205q-88 91 -210 91q-114 0 -182 -59q-67 -58 -67 -146q0 -73 66 -140t279 -129q69 -20 173 -66q58 -28 95 -52h-743zM990 448h411q7 -39 7 -92q0 -111 -41 -212q-23 -56 -71 -104q-37 -35 -109 -81q-80 -48 -153 -66q-80 -21 -203 -21q-114 0 -195 23
+l-140 40q-57 16 -72 28q-8 8 -8 22v13q0 108 -2 156q-1 30 0 68l2 37v44l102 2q15 -34 30 -71t22.5 -56t12.5 -27q35 -57 80 -94q43 -36 105 -57q59 -22 132 -22q64 0 139 27q77 26 122 86q47 61 47 129q0 84 -81 157q-34 29 -137 71z" />
+    <glyph glyph-name="underline" unicode="&#xf0cd;" 
+d="M48 1313q-37 2 -45 4l-3 88q13 1 40 1q60 0 112 -4q132 -7 166 -7q86 0 168 3q116 4 146 5q56 0 86 2l-1 -14l2 -64v-9q-60 -9 -124 -9q-60 0 -79 -25q-13 -14 -13 -132q0 -13 0.5 -32.5t0.5 -25.5l1 -229l14 -280q6 -124 51 -202q35 -59 96 -92q88 -47 177 -47
+q104 0 191 28q56 18 99 51q48 36 65 64q36 56 53 114q21 73 21 229q0 79 -3.5 128t-11 122.5t-13.5 159.5l-4 59q-5 67 -24 88q-34 35 -77 34l-100 -2l-14 3l2 86h84l205 -10q76 -3 196 10l18 -2q6 -38 6 -51q0 -7 -4 -31q-45 -12 -84 -13q-73 -11 -79 -17q-15 -15 -15 -41
+q0 -7 1.5 -27t1.5 -31q8 -19 22 -396q6 -195 -15 -304q-15 -76 -41 -122q-38 -65 -112 -123q-75 -57 -182 -89q-109 -33 -255 -33q-167 0 -284 46q-119 47 -179 122q-61 76 -83 195q-16 80 -16 237v333q0 188 -17 213q-25 36 -147 39zM1536 -96v64q0 14 -9 23t-23 9h-1472
+q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h1472q14 0 23 9t9 23z" />
+    <glyph glyph-name="table" unicode="&#xf0ce;" horiz-adv-x="1664" 
+d="M512 160v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM512 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 160v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23
+v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM512 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 160v192
+q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192
+q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1664 1248v-1088q0 -66 -47 -113t-113 -47h-1344q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1344q66 0 113 -47t47 -113
+z" />
+    <glyph glyph-name="magic" unicode="&#xf0d0;" horiz-adv-x="1664" 
+d="M1190 955l293 293l-107 107l-293 -293zM1637 1248q0 -27 -18 -45l-1286 -1286q-18 -18 -45 -18t-45 18l-198 198q-18 18 -18 45t18 45l1286 1286q18 18 45 18t45 -18l198 -198q18 -18 18 -45zM286 1438l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98zM636 1276
+l196 -60l-196 -60l-60 -196l-60 196l-196 60l196 60l60 196zM1566 798l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98zM926 1438l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98z" />
+    <glyph glyph-name="truck" unicode="&#xf0d1;" horiz-adv-x="1792" 
+d="M640 128q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM256 640h384v256h-158q-13 0 -22 -9l-195 -195q-9 -9 -9 -22v-30zM1536 128q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM1792 1216v-1024q0 -15 -4 -26.5t-13.5 -18.5
+t-16.5 -11.5t-23.5 -6t-22.5 -2t-25.5 0t-22.5 0.5q0 -106 -75 -181t-181 -75t-181 75t-75 181h-384q0 -106 -75 -181t-181 -75t-181 75t-75 181h-64q-3 0 -22.5 -0.5t-25.5 0t-22.5 2t-23.5 6t-16.5 11.5t-13.5 18.5t-4 26.5q0 26 19 45t45 19v320q0 8 -0.5 35t0 38
+t2.5 34.5t6.5 37t14 30.5t22.5 30l198 198q19 19 50.5 32t58.5 13h160v192q0 26 19 45t45 19h1024q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="pinterest" unicode="&#xf0d2;" 
+d="M1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103q-111 0 -218 32q59 93 78 164q9 34 54 211q20 -39 73 -67.5t114 -28.5q121 0 216 68.5t147 188.5t52 270q0 114 -59.5 214t-172.5 163t-255 63q-105 0 -196 -29t-154.5 -77t-109 -110.5t-67 -129.5t-21.5 -134
+q0 -104 40 -183t117 -111q30 -12 38 20q2 7 8 31t8 30q6 23 -11 43q-51 61 -51 151q0 151 104.5 259.5t273.5 108.5q151 0 235.5 -82t84.5 -213q0 -170 -68.5 -289t-175.5 -119q-61 0 -98 43.5t-23 104.5q8 35 26.5 93.5t30 103t11.5 75.5q0 50 -27 83t-77 33
+q-62 0 -105 -57t-43 -142q0 -73 25 -122l-99 -418q-17 -70 -13 -177q-206 91 -333 281t-127 423q0 209 103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="pinterest_sign" unicode="&#xf0d3;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-725q85 122 108 210q9 34 53 209q21 -39 73.5 -67t112.5 -28q181 0 295.5 147.5t114.5 373.5q0 84 -35 162.5t-96.5 139t-152.5 97t-197 36.5q-104 0 -194.5 -28.5t-153 -76.5
+t-107.5 -109.5t-66.5 -128t-21.5 -132.5q0 -102 39.5 -180t116.5 -110q13 -5 23.5 0t14.5 19q10 44 15 61q6 23 -11 42q-50 62 -50 150q0 150 103.5 256.5t270.5 106.5q149 0 232.5 -81t83.5 -210q0 -168 -67.5 -286t-173.5 -118q-60 0 -97 43.5t-23 103.5q8 34 26.5 92.5
+t29.5 102t11 74.5q0 49 -26.5 81.5t-75.5 32.5q-61 0 -103.5 -56.5t-42.5 -139.5q0 -72 24 -121l-98 -414q-24 -100 -7 -254h-183q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960z" />
+    <glyph glyph-name="google_plus_sign" unicode="&#xf0d4;" 
+d="M917 631q0 26 -6 64h-362v-132h217q-3 -24 -16.5 -50t-37.5 -53t-66.5 -44.5t-96.5 -17.5q-99 0 -169 71t-70 171t70 171t169 71q92 0 153 -59l104 101q-108 100 -257 100q-160 0 -272 -112.5t-112 -271.5t112 -271.5t272 -112.5q165 0 266.5 105t101.5 270zM1262 585
+h109v110h-109v110h-110v-110h-110v-110h110v-110h110v110zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="google_plus" unicode="&#xf0d5;" horiz-adv-x="2304" 
+d="M1437 623q0 -208 -87 -370.5t-248 -254t-369 -91.5q-149 0 -285 58t-234 156t-156 234t-58 285t58 285t156 234t234 156t285 58q286 0 491 -192l-199 -191q-117 113 -292 113q-123 0 -227.5 -62t-165.5 -168.5t-61 -232.5t61 -232.5t165.5 -168.5t227.5 -62
+q83 0 152.5 23t114.5 57.5t78.5 78.5t49 83t21.5 74h-416v252h692q12 -63 12 -122zM2304 745v-210h-209v-209h-210v209h-209v210h209v209h210v-209h209z" />
+    <glyph glyph-name="money" unicode="&#xf0d6;" horiz-adv-x="1920" 
+d="M768 384h384v96h-128v448h-114l-148 -137l77 -80q42 37 55 57h2v-288h-128v-96zM1280 640q0 -70 -21 -142t-59.5 -134t-101.5 -101t-138 -39t-138 39t-101.5 101t-59.5 134t-21 142t21 142t59.5 134t101.5 101t138 39t138 -39t101.5 -101t59.5 -134t21 -142zM1792 384
+v512q-106 0 -181 75t-75 181h-1152q0 -106 -75 -181t-181 -75v-512q106 0 181 -75t75 -181h1152q0 106 75 181t181 75zM1920 1216v-1152q0 -26 -19 -45t-45 -19h-1792q-26 0 -45 19t-19 45v1152q0 26 19 45t45 19h1792q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="caret_down" unicode="&#xf0d7;" horiz-adv-x="1024" 
+d="M1024 832q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="caret_up" unicode="&#xf0d8;" horiz-adv-x="1024" 
+d="M1024 320q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="caret_left" unicode="&#xf0d9;" horiz-adv-x="640" 
+d="M640 1088v-896q0 -26 -19 -45t-45 -19t-45 19l-448 448q-19 19 -19 45t19 45l448 448q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="caret_right" unicode="&#xf0da;" horiz-adv-x="640" 
+d="M576 640q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19t-19 45v896q0 26 19 45t45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="columns" unicode="&#xf0db;" horiz-adv-x="1664" 
+d="M160 0h608v1152h-640v-1120q0 -13 9.5 -22.5t22.5 -9.5zM1536 32v1120h-640v-1152h608q13 0 22.5 9.5t9.5 22.5zM1664 1248v-1216q0 -66 -47 -113t-113 -47h-1344q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1344q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="sort" unicode="&#xf0dc;" horiz-adv-x="1024" 
+d="M1024 448q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45zM1024 832q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="sort_down" unicode="&#xf0dd;" horiz-adv-x="1024" 
+d="M1024 448q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="sort_up" unicode="&#xf0de;" horiz-adv-x="1024" 
+d="M1024 832q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="envelope_alt" unicode="&#xf0e0;" horiz-adv-x="1792" 
+d="M1792 826v-794q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v794q44 -49 101 -87q362 -246 497 -345q57 -42 92.5 -65.5t94.5 -48t110 -24.5h1h1q51 0 110 24.5t94.5 48t92.5 65.5q170 123 498 345q57 39 100 87zM1792 1120q0 -79 -49 -151t-122 -123
+q-376 -261 -468 -325q-10 -7 -42.5 -30.5t-54 -38t-52 -32.5t-57.5 -27t-50 -9h-1h-1q-23 0 -50 9t-57.5 27t-52 32.5t-54 38t-42.5 30.5q-91 64 -262 182.5t-205 142.5q-62 42 -117 115.5t-55 136.5q0 78 41.5 130t118.5 52h1472q65 0 112.5 -47t47.5 -113z" />
+    <glyph glyph-name="linkedin" unicode="&#xf0e1;" 
+d="M349 911v-991h-330v991h330zM370 1217q1 -73 -50.5 -122t-135.5 -49h-2q-82 0 -132 49t-50 122q0 74 51.5 122.5t134.5 48.5t133 -48.5t51 -122.5zM1536 488v-568h-329v530q0 105 -40.5 164.5t-126.5 59.5q-63 0 -105.5 -34.5t-63.5 -85.5q-11 -30 -11 -81v-553h-329
+q2 399 2 647t-1 296l-1 48h329v-144h-2q20 32 41 56t56.5 52t87 43.5t114.5 15.5q171 0 275 -113.5t104 -332.5z" />
+    <glyph glyph-name="undo" unicode="&#xf0e2;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61q-172 0 -327 72.5t-264 204.5q-7 10 -6.5 22.5t8.5 20.5l137 138q10 9 25 9q16 -2 23 -12q73 -95 179 -147t225 -52q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5
+t-163.5 109.5t-198.5 40.5q-98 0 -188 -35.5t-160 -101.5l137 -138q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l130 -129q107 101 244.5 156.5t284.5 55.5q156 0 298 -61t245 -164t164 -245t61 -298z" />
+    <glyph glyph-name="legal" unicode="&#xf0e3;" horiz-adv-x="1792" 
+d="M1771 0q0 -53 -37 -90l-107 -108q-39 -37 -91 -37q-53 0 -90 37l-363 364q-38 36 -38 90q0 53 43 96l-256 256l-126 -126q-14 -14 -34 -14t-34 14q2 -2 12.5 -12t12.5 -13t10 -11.5t10 -13.5t6 -13.5t5.5 -16.5t1.5 -18q0 -38 -28 -68q-3 -3 -16.5 -18t-19 -20.5
+t-18.5 -16.5t-22 -15.5t-22 -9t-26 -4.5q-40 0 -68 28l-408 408q-28 28 -28 68q0 13 4.5 26t9 22t15.5 22t16.5 18.5t20.5 19t18 16.5q30 28 68 28q10 0 18 -1.5t16.5 -5.5t13.5 -6t13.5 -10t11.5 -10t13 -12.5t12 -12.5q-14 14 -14 34t14 34l348 348q14 14 34 14t34 -14
+q-2 2 -12.5 12t-12.5 13t-10 11.5t-10 13.5t-6 13.5t-5.5 16.5t-1.5 18q0 38 28 68q3 3 16.5 18t19 20.5t18.5 16.5t22 15.5t22 9t26 4.5q40 0 68 -28l408 -408q28 -28 28 -68q0 -13 -4.5 -26t-9 -22t-15.5 -22t-16.5 -18.5t-20.5 -19t-18 -16.5q-30 -28 -68 -28
+q-10 0 -18 1.5t-16.5 5.5t-13.5 6t-13.5 10t-11.5 10t-13 12.5t-12 12.5q14 -14 14 -34t-14 -34l-126 -126l256 -256q43 43 96 43q52 0 91 -37l363 -363q37 -39 37 -91z" />
+    <glyph glyph-name="dashboard" unicode="&#xf0e4;" horiz-adv-x="1792" 
+d="M384 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM576 832q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1004 351l101 382q6 26 -7.5 48.5t-38.5 29.5
+t-48 -6.5t-30 -39.5l-101 -382q-60 -5 -107 -43.5t-63 -98.5q-20 -77 20 -146t117 -89t146 20t89 117q16 60 -6 117t-72 91zM1664 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 1024q0 53 -37.5 90.5
+t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1472 832q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1792 384q0 -261 -141 -483q-19 -29 -54 -29h-1402q-35 0 -54 29
+q-141 221 -141 483q0 182 71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="comment_alt" unicode="&#xf0e5;" horiz-adv-x="1792" 
+d="M896 1152q-204 0 -381.5 -69.5t-282 -187.5t-104.5 -255q0 -112 71.5 -213.5t201.5 -175.5l87 -50l-27 -96q-24 -91 -70 -172q152 63 275 171l43 38l57 -6q69 -8 130 -8q204 0 381.5 69.5t282 187.5t104.5 255t-104.5 255t-282 187.5t-381.5 69.5zM1792 640
+q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22h-5q-15 0 -27 10.5t-16 27.5v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51t27 59t26 76q-157 89 -247.5 220t-90.5 281q0 174 120 321.5
+t326 233t450 85.5t450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="comments_alt" unicode="&#xf0e6;" horiz-adv-x="1792" 
+d="M704 1152q-153 0 -286 -52t-211.5 -141t-78.5 -191q0 -82 53 -158t149 -132l97 -56l-35 -84q34 20 62 39l44 31l53 -10q78 -14 153 -14q153 0 286 52t211.5 141t78.5 191t-78.5 191t-211.5 141t-286 52zM704 1280q191 0 353.5 -68.5t256.5 -186.5t94 -257t-94 -257
+t-256.5 -186.5t-353.5 -68.5q-86 0 -176 16q-124 -88 -278 -128q-36 -9 -86 -16h-3q-11 0 -20.5 8t-11.5 21q-1 3 -1 6.5t0.5 6.5t2 6l2.5 5t3.5 5.5t4 5t4.5 5t4 4.5q5 6 23 25t26 29.5t22.5 29t25 38.5t20.5 44q-124 72 -195 177t-71 224q0 139 94 257t256.5 186.5
+t353.5 68.5zM1526 111q10 -24 20.5 -44t25 -38.5t22.5 -29t26 -29.5t23 -25q1 -1 4 -4.5t4.5 -5t4 -5t3.5 -5.5l2.5 -5t2 -6t0.5 -6.5t-1 -6.5q-3 -14 -13 -22t-22 -7q-50 7 -86 16q-154 40 -278 128q-90 -16 -176 -16q-271 0 -472 132q58 -4 88 -4q161 0 309 45t264 129
+q125 92 192 212t67 254q0 77 -23 152q129 -71 204 -178t75 -230q0 -120 -71 -224.5t-195 -176.5z" />
+    <glyph glyph-name="bolt" unicode="&#xf0e7;" horiz-adv-x="896" 
+d="M885 970q18 -20 7 -44l-540 -1157q-13 -25 -42 -25q-4 0 -14 2q-17 5 -25.5 19t-4.5 30l197 808l-406 -101q-4 -1 -12 -1q-18 0 -31 11q-18 15 -13 39l201 825q4 14 16 23t28 9h328q19 0 32 -12.5t13 -29.5q0 -8 -5 -18l-171 -463l396 98q8 2 12 2q19 0 34 -15z" />
+    <glyph glyph-name="sitemap" unicode="&#xf0e8;" horiz-adv-x="1792" 
+d="M1792 288v-320q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192h-512v-192h96q40 0 68 -28t28 -68v-320q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192h-512v-192h96q40 0 68 -28t28 -68v-320
+q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192q0 52 38 90t90 38h512v192h-96q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h320q40 0 68 -28t28 -68v-320q0 -40 -28 -68t-68 -28h-96v-192h512q52 0 90 -38t38 -90v-192h96q40 0 68 -28t28 -68
+z" />
+    <glyph glyph-name="umbrella" unicode="&#xf0e9;" horiz-adv-x="1664" 
+d="M896 708v-580q0 -104 -76 -180t-180 -76t-180 76t-76 180q0 26 19 45t45 19t45 -19t19 -45q0 -50 39 -89t89 -39t89 39t39 89v580q33 11 64 11t64 -11zM1664 681q0 -13 -9.5 -22.5t-22.5 -9.5q-11 0 -23 10q-49 46 -93 69t-102 23q-68 0 -128 -37t-103 -97
+q-7 -10 -17.5 -28t-14.5 -24q-11 -17 -28 -17q-18 0 -29 17q-4 6 -14.5 24t-17.5 28q-43 60 -102.5 97t-127.5 37t-127.5 -37t-102.5 -97q-7 -10 -17.5 -28t-14.5 -24q-11 -17 -29 -17q-17 0 -28 17q-4 6 -14.5 24t-17.5 28q-43 60 -103 97t-128 37q-58 0 -102 -23t-93 -69
+q-12 -10 -23 -10q-13 0 -22.5 9.5t-9.5 22.5q0 5 1 7q45 183 172.5 319.5t298 204.5t360.5 68q140 0 274.5 -40t246.5 -113.5t194.5 -187t115.5 -251.5q1 -2 1 -7zM896 1408v-98q-42 2 -64 2t-64 -2v98q0 26 19 45t45 19t45 -19t19 -45z" />
+    <glyph glyph-name="paste" unicode="&#xf0ea;" horiz-adv-x="1792" 
+d="M768 -128h896v640h-416q-40 0 -68 28t-28 68v416h-384v-1152zM1024 1312v64q0 13 -9.5 22.5t-22.5 9.5h-704q-13 0 -22.5 -9.5t-9.5 -22.5v-64q0 -13 9.5 -22.5t22.5 -9.5h704q13 0 22.5 9.5t9.5 22.5zM1280 640h299l-299 299v-299zM1792 512v-672q0 -40 -28 -68t-68 -28
+h-960q-40 0 -68 28t-28 68v160h-544q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1088q40 0 68 -28t28 -68v-328q21 -13 36 -28l408 -408q28 -28 48 -76t20 -88z" />
+    <glyph glyph-name="light_bulb" unicode="&#xf0eb;" horiz-adv-x="1024" 
+d="M736 960q0 -13 -9.5 -22.5t-22.5 -9.5t-22.5 9.5t-9.5 22.5q0 46 -54 71t-106 25q-13 0 -22.5 9.5t-9.5 22.5t9.5 22.5t22.5 9.5q50 0 99.5 -16t87 -54t37.5 -90zM896 960q0 72 -34.5 134t-90 101.5t-123 62t-136.5 22.5t-136.5 -22.5t-123 -62t-90 -101.5t-34.5 -134
+q0 -101 68 -180q10 -11 30.5 -33t30.5 -33q128 -153 141 -298h228q13 145 141 298q10 11 30.5 33t30.5 33q68 79 68 180zM1024 960q0 -155 -103 -268q-45 -49 -74.5 -87t-59.5 -95.5t-34 -107.5q47 -28 47 -82q0 -37 -25 -64q25 -27 25 -64q0 -52 -45 -81q13 -23 13 -47
+q0 -46 -31.5 -71t-77.5 -25q-20 -44 -60 -70t-87 -26t-87 26t-60 70q-46 0 -77.5 25t-31.5 71q0 24 13 47q-45 29 -45 81q0 37 25 64q-25 27 -25 64q0 54 47 82q-4 50 -34 107.5t-59.5 95.5t-74.5 87q-103 113 -103 268q0 99 44.5 184.5t117 142t164 89t186.5 32.5
+t186.5 -32.5t164 -89t117 -142t44.5 -184.5z" />
+    <glyph glyph-name="exchange" unicode="&#xf0ec;" horiz-adv-x="1792" 
+d="M1792 352v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5q-12 0 -24 10l-319 320q-9 9 -9 22q0 14 9 23l320 320q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5v-192h1376q13 0 22.5 -9.5t9.5 -22.5zM1792 896q0 -14 -9 -23l-320 -320q-9 -9 -23 -9
+q-13 0 -22.5 9.5t-9.5 22.5v192h-1376q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1376v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23z" />
+    <glyph glyph-name="cloud_download" unicode="&#xf0ed;" horiz-adv-x="1920" 
+d="M1280 608q0 14 -9 23t-23 9h-224v352q0 13 -9.5 22.5t-22.5 9.5h-192q-13 0 -22.5 -9.5t-9.5 -22.5v-352h-224q-13 0 -22.5 -9.5t-9.5 -22.5q0 -14 9 -23l352 -352q9 -9 23 -9t23 9l351 351q10 12 10 24zM1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088
+q-185 0 -316.5 131.5t-131.5 316.5q0 130 70 240t188 165q-2 30 -2 43q0 212 150 362t362 150q156 0 285.5 -87t188.5 -231q71 62 166 62q106 0 181 -75t75 -181q0 -76 -41 -138q130 -31 213.5 -135.5t83.5 -238.5z" />
+    <glyph glyph-name="cloud_upload" unicode="&#xf0ee;" horiz-adv-x="1920" 
+d="M1280 672q0 14 -9 23l-352 352q-9 9 -23 9t-23 -9l-351 -351q-10 -12 -10 -24q0 -14 9 -23t23 -9h224v-352q0 -13 9.5 -22.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 22.5v352h224q13 0 22.5 9.5t9.5 22.5zM1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088
+q-185 0 -316.5 131.5t-131.5 316.5q0 130 70 240t188 165q-2 30 -2 43q0 212 150 362t362 150q156 0 285.5 -87t188.5 -231q71 62 166 62q106 0 181 -75t75 -181q0 -76 -41 -138q130 -31 213.5 -135.5t83.5 -238.5z" />
+    <glyph glyph-name="user_md" unicode="&#xf0f0;" horiz-adv-x="1408" 
+d="M384 192q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM1408 131q0 -121 -73 -190t-194 -69h-874q-121 0 -194 69t-73 190q0 68 5.5 131t24 138t47.5 132.5t81 103t120 60.5q-22 -52 -22 -120v-203q-58 -20 -93 -70t-35 -111q0 -80 56 -136t136 -56
+t136 56t56 136q0 61 -35.5 111t-92.5 70v203q0 62 25 93q132 -104 295 -104t295 104q25 -31 25 -93v-64q-106 0 -181 -75t-75 -181v-89q-32 -29 -32 -71q0 -40 28 -68t68 -28t68 28t28 68q0 42 -32 71v89q0 52 38 90t90 38t90 -38t38 -90v-89q-32 -29 -32 -71q0 -40 28 -68
+t68 -28t68 28t28 68q0 42 -32 71v89q0 68 -34.5 127.5t-93.5 93.5q0 10 0.5 42.5t0 48t-2.5 41.5t-7 47t-13 40q68 -15 120 -60.5t81 -103t47.5 -132.5t24 -138t5.5 -131zM1088 1024q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5
+t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="stethoscope" unicode="&#xf0f1;" horiz-adv-x="1408" 
+d="M1280 832q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 832q0 -62 -35.5 -111t-92.5 -70v-395q0 -159 -131.5 -271.5t-316.5 -112.5t-316.5 112.5t-131.5 271.5v132q-164 20 -274 128t-110 252v512q0 26 19 45t45 19q6 0 16 -2q17 30 47 48
+t65 18q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5q-33 0 -64 18v-402q0 -106 94 -181t226 -75t226 75t94 181v402q-31 -18 -64 -18q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5q35 0 65 -18t47 -48q10 2 16 2q26 0 45 -19t19 -45v-512q0 -144 -110 -252
+t-274 -128v-132q0 -106 94 -181t226 -75t226 75t94 181v395q-57 21 -92.5 70t-35.5 111q0 80 56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="suitcase" unicode="&#xf0f2;" horiz-adv-x="1792" 
+d="M640 1152h512v128h-512v-128zM288 1152v-1280h-64q-92 0 -158 66t-66 158v832q0 92 66 158t158 66h64zM1408 1152v-1280h-1024v1280h128v160q0 40 28 68t68 28h576q40 0 68 -28t28 -68v-160h128zM1792 928v-832q0 -92 -66 -158t-158 -66h-64v1280h64q92 0 158 -66
+t66 -158z" />
+    <glyph glyph-name="bell_alt" unicode="&#xf0f3;" horiz-adv-x="1792" 
+d="M912 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM1728 128q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-181 75t-75 181h-448q-52 0 -90 38t-38 90q50 42 91 88t85 119.5t74.5 158.5
+t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q190 -28 307 -158.5t117 -282.5q0 -139 19.5 -260t50 -206t74.5 -158.5t85 -119.5t91 -88z" />
+    <glyph glyph-name="coffee" unicode="&#xf0f4;" horiz-adv-x="1920" 
+d="M1664 896q0 80 -56 136t-136 56h-64v-384h64q80 0 136 56t56 136zM0 128h1792q0 -106 -75 -181t-181 -75h-1280q-106 0 -181 75t-75 181zM1856 896q0 -159 -112.5 -271.5t-271.5 -112.5h-64v-32q0 -92 -66 -158t-158 -66h-704q-92 0 -158 66t-66 158v736q0 26 19 45
+t45 19h1152q159 0 271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="food" unicode="&#xf0f5;" horiz-adv-x="1408" 
+d="M640 1472v-640q0 -61 -35.5 -111t-92.5 -70v-779q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v779q-57 20 -92.5 70t-35.5 111v640q0 26 19 45t45 19t45 -19t19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45v416q0 26 19 45t45 19t45 -19t19 -45v-416q0 -26 19 -45
+t45 -19t45 19t19 45v416q0 26 19 45t45 19t45 -19t19 -45zM1408 1472v-1600q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v512h-224q-13 0 -22.5 9.5t-9.5 22.5v800q0 132 94 226t226 94h256q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="file_text_alt" unicode="&#xf0f6;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M384 736q0 14 9 23t23 9h704q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64zM1120 512q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704zM1120 256q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704
+q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704z" />
+    <glyph glyph-name="building" unicode="&#xf0f7;" horiz-adv-x="1408" 
+d="M384 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 -128h384v1536h-1152v-1536h384v224q0 13 9.5 22.5t22.5 9.5h320q13 0 22.5 -9.5t9.5 -22.5v-224zM1408 1472v-1664q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h1280q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="hospital" unicode="&#xf0f8;" horiz-adv-x="1408" 
+d="M384 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 -128h384v1152h-256v-32q0 -40 -28 -68t-68 -28h-448q-40 0 -68 28t-28 68v32h-256v-1152h384v224q0 13 9.5 22.5t22.5 9.5h320q13 0 22.5 -9.5t9.5 -22.5v-224zM896 1056v320q0 13 -9.5 22.5t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-96h-128v96q0 13 -9.5 22.5
+t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5v96h128v-96q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1408 1088v-1280q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1280q0 26 19 45t45 19h320
+v288q0 40 28 68t68 28h448q40 0 68 -28t28 -68v-288h320q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="ambulance" unicode="&#xf0f9;" horiz-adv-x="1920" 
+d="M640 128q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM256 640h384v256h-158q-14 -2 -22 -9l-195 -195q-7 -12 -9 -22v-30zM1536 128q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5zM1664 800v192q0 14 -9 23t-23 9h-224v224q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-224h-224q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h224v-224q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v224h224q14 0 23 9t9 23zM1920 1344v-1152
+q0 -26 -19 -45t-45 -19h-192q0 -106 -75 -181t-181 -75t-181 75t-75 181h-384q0 -106 -75 -181t-181 -75t-181 75t-75 181h-128q-26 0 -45 19t-19 45t19 45t45 19v416q0 26 13 58t32 51l198 198q19 19 51 32t58 13h160v320q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="medkit" unicode="&#xf0fa;" horiz-adv-x="1792" 
+d="M1280 416v192q0 14 -9 23t-23 9h-224v224q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-224h-224q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h224v-224q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v224h224q14 0 23 9t9 23zM640 1152h512v128h-512v-128zM256 1152v-1280h-32
+q-92 0 -158 66t-66 158v832q0 92 66 158t158 66h32zM1440 1152v-1280h-1088v1280h160v160q0 40 28 68t68 28h576q40 0 68 -28t28 -68v-160h160zM1792 928v-832q0 -92 -66 -158t-158 -66h-32v1280h32q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="fighter_jet" unicode="&#xf0fb;" horiz-adv-x="1920" 
+d="M1920 576q-1 -32 -288 -96l-352 -32l-224 -64h-64l-293 -352h69q26 0 45 -4.5t19 -11.5t-19 -11.5t-45 -4.5h-96h-160h-64v32h64v416h-160l-192 -224h-96l-32 32v192h32v32h128v8l-192 24v128l192 24v8h-128v32h-32v192l32 32h96l192 -224h160v416h-64v32h64h160h96
+q26 0 45 -4.5t19 -11.5t-19 -11.5t-45 -4.5h-69l293 -352h64l224 -64l352 -32q128 -28 200 -52t80 -34z" />
+    <glyph glyph-name="beer" unicode="&#xf0fc;" horiz-adv-x="1664" 
+d="M640 640v384h-256v-256q0 -53 37.5 -90.5t90.5 -37.5h128zM1664 192v-192h-1152v192l128 192h-128q-159 0 -271.5 112.5t-112.5 271.5v320l-64 64l32 128h480l32 128h960l32 -192l-64 -32v-800z" />
+    <glyph glyph-name="h_sign" unicode="&#xf0fd;" 
+d="M1280 192v896q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-320h-512v320q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-896q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v320h512v-320q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="f0fe" unicode="&#xf0fe;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-320v320q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-320h-320q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h320v-320q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v320h320q26 0 45 19t19 45zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="double_angle_left" unicode="&#xf100;" horiz-adv-x="1024" 
+d="M627 160q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23zM1011 160q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23
+t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_right" unicode="&#xf101;" horiz-adv-x="1024" 
+d="M595 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23zM979 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23
+l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_up" unicode="&#xf102;" horiz-adv-x="1152" 
+d="M1075 224q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23zM1075 608q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393
+q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_down" unicode="&#xf103;" horiz-adv-x="1152" 
+d="M1075 672q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23zM1075 1056q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23
+t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="angle_left" unicode="&#xf104;" horiz-adv-x="640" 
+d="M627 992q0 -13 -10 -23l-393 -393l393 -393q10 -10 10 -23t-10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="angle_right" unicode="&#xf105;" horiz-adv-x="640" 
+d="M595 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="angle_up" unicode="&#xf106;" horiz-adv-x="1152" 
+d="M1075 352q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="angle_down" unicode="&#xf107;" horiz-adv-x="1152" 
+d="M1075 800q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="desktop" unicode="&#xf108;" horiz-adv-x="1920" 
+d="M1792 544v832q0 13 -9.5 22.5t-22.5 9.5h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-832q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5zM1920 1376v-1088q0 -66 -47 -113t-113 -47h-544q0 -37 16 -77.5t32 -71t16 -43.5q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19
+t-19 45q0 14 16 44t32 70t16 78h-544q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="laptop" unicode="&#xf109;" horiz-adv-x="1920" 
+d="M416 256q-66 0 -113 47t-47 113v704q0 66 47 113t113 47h1088q66 0 113 -47t47 -113v-704q0 -66 -47 -113t-113 -47h-1088zM384 1120v-704q0 -13 9.5 -22.5t22.5 -9.5h1088q13 0 22.5 9.5t9.5 22.5v704q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5z
+M1760 192h160v-96q0 -40 -47 -68t-113 -28h-1600q-66 0 -113 28t-47 68v96h160h1600zM1040 96q16 0 16 16t-16 16h-160q-16 0 -16 -16t16 -16h160z" />
+    <glyph glyph-name="tablet" unicode="&#xf10a;" horiz-adv-x="1152" 
+d="M640 128q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1024 288v960q0 13 -9.5 22.5t-22.5 9.5h-832q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h832q13 0 22.5 9.5t9.5 22.5zM1152 1248v-1088q0 -66 -47 -113t-113 -47h-832
+q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h832q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="mobile_phone" unicode="&#xf10b;" horiz-adv-x="768" 
+d="M464 128q0 33 -23.5 56.5t-56.5 23.5t-56.5 -23.5t-23.5 -56.5t23.5 -56.5t56.5 -23.5t56.5 23.5t23.5 56.5zM672 288v704q0 13 -9.5 22.5t-22.5 9.5h-512q-13 0 -22.5 -9.5t-9.5 -22.5v-704q0 -13 9.5 -22.5t22.5 -9.5h512q13 0 22.5 9.5t9.5 22.5zM480 1136
+q0 16 -16 16h-160q-16 0 -16 -16t16 -16h160q16 0 16 16zM768 1152v-1024q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v1024q0 52 38 90t90 38h512q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="circle_blank" unicode="&#xf10c;" 
+d="M768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103
+t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="quote_left" unicode="&#xf10d;" horiz-adv-x="1664" 
+d="M768 576v-384q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v704q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5h64q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-64q-106 0 -181 -75t-75 -181v-32q0 -40 28 -68t68 -28h224q80 0 136 -56t56 -136z
+M1664 576v-384q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v704q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5h64q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-64q-106 0 -181 -75t-75 -181v-32q0 -40 28 -68t68 -28h224q80 0 136 -56t56 -136z" />
+    <glyph glyph-name="quote_right" unicode="&#xf10e;" horiz-adv-x="1664" 
+d="M768 1216v-704q0 -104 -40.5 -198.5t-109.5 -163.5t-163.5 -109.5t-198.5 -40.5h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64q106 0 181 75t75 181v32q0 40 -28 68t-68 28h-224q-80 0 -136 56t-56 136v384q0 80 56 136t136 56h384q80 0 136 -56t56 -136zM1664 1216
+v-704q0 -104 -40.5 -198.5t-109.5 -163.5t-163.5 -109.5t-198.5 -40.5h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64q106 0 181 75t75 181v32q0 40 -28 68t-68 28h-224q-80 0 -136 56t-56 136v384q0 80 56 136t136 56h384q80 0 136 -56t56 -136z" />
+    <glyph glyph-name="spinner" unicode="&#xf110;" horiz-adv-x="1792" 
+d="M526 142q0 -53 -37.5 -90.5t-90.5 -37.5q-52 0 -90 38t-38 90q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1024 -64q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM320 640q0 -53 -37.5 -90.5t-90.5 -37.5
+t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1522 142q0 -52 -38 -90t-90 -38q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM558 1138q0 -66 -47 -113t-113 -47t-113 47t-47 113t47 113t113 47t113 -47t47 -113z
+M1728 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1088 1344q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1618 1138q0 -93 -66 -158.5t-158 -65.5q-93 0 -158.5 65.5t-65.5 158.5
+q0 92 65.5 158t158.5 66q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="circle" unicode="&#xf111;" 
+d="M1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="reply" unicode="&#xf112;" horiz-adv-x="1792" 
+d="M1792 416q0 -166 -127 -451q-3 -7 -10.5 -24t-13.5 -30t-13 -22q-12 -17 -28 -17q-15 0 -23.5 10t-8.5 25q0 9 2.5 26.5t2.5 23.5q5 68 5 123q0 101 -17.5 181t-48.5 138.5t-80 101t-105.5 69.5t-133 42.5t-154 21.5t-175.5 6h-224v-256q0 -26 -19 -45t-45 -19t-45 19
+l-512 512q-19 19 -19 45t19 45l512 512q19 19 45 19t45 -19t19 -45v-256h224q713 0 875 -403q53 -134 53 -333z" />
+    <glyph glyph-name="github_alt" unicode="&#xf113;" horiz-adv-x="1664" 
+d="M640 320q0 -40 -12.5 -82t-43 -76t-72.5 -34t-72.5 34t-43 76t-12.5 82t12.5 82t43 76t72.5 34t72.5 -34t43 -76t12.5 -82zM1280 320q0 -40 -12.5 -82t-43 -76t-72.5 -34t-72.5 34t-43 76t-12.5 82t12.5 82t43 76t72.5 34t72.5 -34t43 -76t12.5 -82zM1440 320
+q0 120 -69 204t-187 84q-41 0 -195 -21q-71 -11 -157 -11t-157 11q-152 21 -195 21q-118 0 -187 -84t-69 -204q0 -88 32 -153.5t81 -103t122 -60t140 -29.5t149 -7h168q82 0 149 7t140 29.5t122 60t81 103t32 153.5zM1664 496q0 -207 -61 -331q-38 -77 -105.5 -133t-141 -86
+t-170 -47.5t-171.5 -22t-167 -4.5q-78 0 -142 3t-147.5 12.5t-152.5 30t-137 51.5t-121 81t-86 115q-62 123 -62 331q0 237 136 396q-27 82 -27 170q0 116 51 218q108 0 190 -39.5t189 -123.5q147 35 309 35q148 0 280 -32q105 82 187 121t189 39q51 -102 51 -218
+q0 -87 -27 -168q136 -160 136 -398z" />
+    <glyph glyph-name="folder_close_alt" unicode="&#xf114;" horiz-adv-x="1664" 
+d="M1536 224v704q0 40 -28 68t-68 28h-704q-40 0 -68 28t-28 68v64q0 40 -28 68t-68 28h-320q-40 0 -68 -28t-28 -68v-960q0 -40 28 -68t68 -28h1216q40 0 68 28t28 68zM1664 928v-704q0 -92 -66 -158t-158 -66h-1216q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320
+q92 0 158 -66t66 -158v-32h672q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="folder_open_alt" unicode="&#xf115;" horiz-adv-x="1920" 
+d="M1781 605q0 35 -53 35h-1088q-40 0 -85.5 -21.5t-71.5 -52.5l-294 -363q-18 -24 -18 -40q0 -35 53 -35h1088q40 0 86 22t71 53l294 363q18 22 18 39zM640 768h768v160q0 40 -28 68t-68 28h-576q-40 0 -68 28t-28 68v64q0 40 -28 68t-68 28h-320q-40 0 -68 -28t-28 -68
+v-853l256 315q44 53 116 87.5t140 34.5zM1909 605q0 -62 -46 -120l-295 -363q-43 -53 -116 -87.5t-140 -34.5h-1088q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h544q92 0 158 -66t66 -158v-160h192q54 0 99 -24.5t67 -70.5q15 -32 15 -68z
+" />
+    <glyph glyph-name="expand_alt" unicode="&#xf116;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="collapse_alt" unicode="&#xf117;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="smile" unicode="&#xf118;" 
+d="M1134 461q-37 -121 -138 -195t-228 -74t-228 74t-138 195q-8 25 4 48.5t38 31.5q25 8 48.5 -4t31.5 -38q25 -80 92.5 -129.5t151.5 -49.5t151.5 49.5t92.5 129.5q8 26 32 38t49 4t37 -31.5t4 -48.5zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5
+t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="frown" unicode="&#xf119;" 
+d="M1134 307q8 -25 -4 -48.5t-37 -31.5t-49 4t-32 38q-25 80 -92.5 129.5t-151.5 49.5t-151.5 -49.5t-92.5 -129.5q-8 -26 -31.5 -38t-48.5 -4q-26 8 -38 31.5t-4 48.5q37 121 138 195t228 74t228 -74t138 -195zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204
+t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="meh" unicode="&#xf11a;" 
+d="M1152 448q0 -26 -19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h640q26 0 45 -19t19 -45zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="gamepad" unicode="&#xf11b;" horiz-adv-x="1920" 
+d="M832 448v128q0 14 -9 23t-23 9h-192v192q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-192h-192q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h192v-192q0 -14 9 -23t23 -9h128q14 0 23 9t9 23v192h192q14 0 23 9t9 23zM1408 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5
+t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1920 512q0 -212 -150 -362t-362 -150q-192 0 -338 128h-220q-146 -128 -338 -128q-212 0 -362 150
+t-150 362t150 362t362 150h896q212 0 362 -150t150 -362z" />
+    <glyph glyph-name="keyboard" unicode="&#xf11c;" horiz-adv-x="1920" 
+d="M384 368v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM512 624v-96q0 -16 -16 -16h-224q-16 0 -16 16v96q0 16 16 16h224q16 0 16 -16zM384 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1408 368v-96q0 -16 -16 -16
+h-864q-16 0 -16 16v96q0 16 16 16h864q16 0 16 -16zM768 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM640 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1024 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16
+h96q16 0 16 -16zM896 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1280 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1664 368v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1152 880v-96
+q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1408 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1664 880v-352q0 -16 -16 -16h-224q-16 0 -16 16v96q0 16 16 16h112v240q0 16 16 16h96q16 0 16 -16zM1792 128v896h-1664v-896
+h1664zM1920 1024v-896q0 -53 -37.5 -90.5t-90.5 -37.5h-1664q-53 0 -90.5 37.5t-37.5 90.5v896q0 53 37.5 90.5t90.5 37.5h1664q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="flag_alt" unicode="&#xf11d;" horiz-adv-x="1792" 
+d="M1664 491v616q-169 -91 -306 -91q-82 0 -145 32q-100 49 -184 76.5t-178 27.5q-173 0 -403 -127v-599q245 113 433 113q55 0 103.5 -7.5t98 -26t77 -31t82.5 -39.5l28 -14q44 -22 101 -22q120 0 293 92zM320 1280q0 -35 -17.5 -64t-46.5 -46v-1266q0 -14 -9 -23t-23 -9
+h-64q-14 0 -23 9t-9 23v1266q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -39 -35 -57q-10 -5 -17 -9q-218 -116 -369 -116q-88 0 -158 35l-28 14q-64 33 -99 48t-91 29t-114 14q-102 0 -235.5 -44t-228.5 -102
+q-15 -9 -33 -9q-16 0 -32 8q-32 19 -32 56v742q0 35 31 55q35 21 78.5 42.5t114 52t152.5 49.5t155 19q112 0 209 -31t209 -86q38 -19 89 -19q122 0 310 112q22 12 31 17q31 16 62 -2q31 -20 31 -55z" />
+    <glyph glyph-name="flag_checkered" unicode="&#xf11e;" horiz-adv-x="1792" 
+d="M832 536v192q-181 -16 -384 -117v-185q205 96 384 110zM832 954v197q-172 -8 -384 -126v-189q215 111 384 118zM1664 491v184q-235 -116 -384 -71v224q-20 6 -39 15q-5 3 -33 17t-34.5 17t-31.5 15t-34.5 15.5t-32.5 13t-36 12.5t-35 8.5t-39.5 7.5t-39.5 4t-44 2
+q-23 0 -49 -3v-222h19q102 0 192.5 -29t197.5 -82q19 -9 39 -15v-188q42 -17 91 -17q120 0 293 92zM1664 918v189q-169 -91 -306 -91q-45 0 -78 8v-196q148 -42 384 90zM320 1280q0 -35 -17.5 -64t-46.5 -46v-1266q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v1266
+q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -39 -35 -57q-10 -5 -17 -9q-218 -116 -369 -116q-88 0 -158 35l-28 14q-64 33 -99 48t-91 29t-114 14q-102 0 -235.5 -44t-228.5 -102q-15 -9 -33 -9q-16 0 -32 8
+q-32 19 -32 56v742q0 35 31 55q35 21 78.5 42.5t114 52t152.5 49.5t155 19q112 0 209 -31t209 -86q38 -19 89 -19q122 0 310 112q22 12 31 17q31 16 62 -2q31 -20 31 -55z" />
+    <glyph glyph-name="terminal" unicode="&#xf120;" horiz-adv-x="1664" 
+d="M585 553l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23t-10 -23zM1664 96v-64q0 -14 -9 -23t-23 -9h-960q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h960q14 0 23 -9
+t9 -23z" />
+    <glyph glyph-name="code" unicode="&#xf121;" horiz-adv-x="1920" 
+d="M617 137l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23t-10 -23zM1208 1204l-373 -1291q-4 -13 -15.5 -19.5t-23.5 -2.5l-62 17q-13 4 -19.5 15.5t-2.5 24.5
+l373 1291q4 13 15.5 19.5t23.5 2.5l62 -17q13 -4 19.5 -15.5t2.5 -24.5zM1865 553l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23t-10 -23z" />
+    <glyph glyph-name="reply_all" unicode="&#xf122;" horiz-adv-x="1792" 
+d="M640 454v-70q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-512 512q-19 19 -19 45t19 45l512 512q29 31 70 14q39 -17 39 -59v-69l-397 -398q-19 -19 -19 -45t19 -45zM1792 416q0 -58 -17 -133.5t-38.5 -138t-48 -125t-40.5 -90.5l-20 -40q-8 -17 -28 -17q-6 0 -9 1
+q-25 8 -23 34q43 400 -106 565q-64 71 -170.5 110.5t-267.5 52.5v-251q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-512 512q-19 19 -19 45t19 45l512 512q29 31 70 14q39 -17 39 -59v-262q411 -28 599 -221q169 -173 169 -509z" />
+    <glyph glyph-name="star_half_empty" unicode="&#xf123;" horiz-adv-x="1664" 
+d="M1186 579l257 250l-356 52l-66 10l-30 60l-159 322v-963l59 -31l318 -168l-60 355l-12 66zM1638 841l-363 -354l86 -500q5 -33 -6 -51.5t-34 -18.5q-17 0 -40 12l-449 236l-449 -236q-23 -12 -40 -12q-23 0 -34 18.5t-6 51.5l86 500l-364 354q-32 32 -23 59.5t54 34.5
+l502 73l225 455q20 41 49 41q28 0 49 -41l225 -455l502 -73q45 -7 54 -34.5t-24 -59.5z" />
+    <glyph glyph-name="location_arrow" unicode="&#xf124;" horiz-adv-x="1408" 
+d="M1401 1187l-640 -1280q-17 -35 -57 -35q-5 0 -15 2q-22 5 -35.5 22.5t-13.5 39.5v576h-576q-22 0 -39.5 13.5t-22.5 35.5t4 42t29 30l1280 640q13 7 29 7q27 0 45 -19q15 -14 18.5 -34.5t-6.5 -39.5z" />
+    <glyph glyph-name="crop" unicode="&#xf125;" horiz-adv-x="1664" 
+d="M557 256h595v595zM512 301l595 595h-595v-595zM1664 224v-192q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v224h-864q-14 0 -23 9t-9 23v864h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224v224q0 14 9 23t23 9h192q14 0 23 -9t9 -23
+v-224h851l246 247q10 9 23 9t23 -9q9 -10 9 -23t-9 -23l-247 -246v-851h224q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="code_fork" unicode="&#xf126;" horiz-adv-x="1024" 
+d="M288 64q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM288 1216q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM928 1088q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1024 1088q0 -52 -26 -96.5t-70 -69.5
+q-2 -287 -226 -414q-67 -38 -203 -81q-128 -40 -169.5 -71t-41.5 -100v-26q44 -25 70 -69.5t26 -96.5q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 52 26 96.5t70 69.5v820q-44 25 -70 69.5t-26 96.5q0 80 56 136t136 56t136 -56t56 -136q0 -52 -26 -96.5t-70 -69.5v-497
+q54 26 154 57q55 17 87.5 29.5t70.5 31t59 39.5t40.5 51t28 69.5t8.5 91.5q-44 25 -70 69.5t-26 96.5q0 80 56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="unlink" unicode="&#xf127;" horiz-adv-x="1664" 
+d="M439 265l-256 -256q-11 -9 -23 -9t-23 9q-9 10 -9 23t9 23l256 256q10 9 23 9t23 -9q9 -10 9 -23t-9 -23zM608 224v-320q0 -14 -9 -23t-23 -9t-23 9t-9 23v320q0 14 9 23t23 9t23 -9t9 -23zM384 448q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23t9 23t23 9h320
+q14 0 23 -9t9 -23zM1648 320q0 -120 -85 -203l-147 -146q-83 -83 -203 -83q-121 0 -204 85l-334 335q-21 21 -42 56l239 18l273 -274q27 -27 68 -27.5t68 26.5l147 146q28 28 28 67q0 40 -28 68l-274 275l18 239q35 -21 56 -42l336 -336q84 -86 84 -204zM1031 1044l-239 -18
+l-273 274q-28 28 -68 28q-39 0 -68 -27l-147 -146q-28 -28 -28 -67q0 -40 28 -68l274 -274l-18 -240q-35 21 -56 42l-336 336q-84 86 -84 204q0 120 85 203l147 146q83 83 203 83q121 0 204 -85l334 -335q21 -21 42 -56zM1664 960q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9
+t-9 23t9 23t23 9h320q14 0 23 -9t9 -23zM1120 1504v-320q0 -14 -9 -23t-23 -9t-23 9t-9 23v320q0 14 9 23t23 9t23 -9t9 -23zM1527 1353l-256 -256q-11 -9 -23 -9t-23 9q-9 10 -9 23t9 23l256 256q10 9 23 9t23 -9q9 -10 9 -23t-9 -23z" />
+    <glyph glyph-name="question" unicode="&#xf128;" horiz-adv-x="1024" 
+d="M704 280v-240q0 -16 -12 -28t-28 -12h-240q-16 0 -28 12t-12 28v240q0 16 12 28t28 12h240q16 0 28 -12t12 -28zM1020 880q0 -54 -15.5 -101t-35 -76.5t-55 -59.5t-57.5 -43.5t-61 -35.5q-41 -23 -68.5 -65t-27.5 -67q0 -17 -12 -32.5t-28 -15.5h-240q-15 0 -25.5 18.5
+t-10.5 37.5v45q0 83 65 156.5t143 108.5q59 27 84 56t25 76q0 42 -46.5 74t-107.5 32q-65 0 -108 -29q-35 -25 -107 -115q-13 -16 -31 -16q-12 0 -25 8l-164 125q-13 10 -15.5 25t5.5 28q160 266 464 266q80 0 161 -31t146 -83t106 -127.5t41 -158.5z" />
+    <glyph glyph-name="_279" unicode="&#xf129;" horiz-adv-x="640" 
+d="M640 192v-128q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64v384h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h384q26 0 45 -19t19 -45v-576h64q26 0 45 -19t19 -45zM512 1344v-192q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v192
+q0 26 19 45t45 19h256q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="exclamation" unicode="&#xf12a;" horiz-adv-x="640" 
+d="M512 288v-224q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v224q0 26 19 45t45 19h256q26 0 45 -19t19 -45zM542 1344l-28 -768q-1 -26 -20.5 -45t-45.5 -19h-256q-26 0 -45.5 19t-20.5 45l-28 768q-1 26 17.5 45t44.5 19h320q26 0 44.5 -19t17.5 -45z" />
+    <glyph glyph-name="superscript" unicode="&#xf12b;" 
+d="M897 167v-167h-248l-159 252l-24 42q-8 9 -11 21h-3q-1 -3 -2.5 -6.5t-3.5 -8t-3 -6.5q-10 -20 -25 -44l-155 -250h-258v167h128l197 291l-185 272h-137v168h276l139 -228q2 -4 23 -42q8 -9 11 -21h3q3 9 11 21l25 42l140 228h257v-168h-125l-184 -267l204 -296h109z
+M1534 846v-206h-514l-3 27q-4 28 -4 46q0 64 26 117t65 86.5t84 65t84 54.5t65 54t26 64q0 38 -29.5 62.5t-70.5 24.5q-51 0 -97 -39q-14 -11 -36 -38l-105 92q26 37 63 66q83 65 188 65q110 0 178 -59.5t68 -158.5q0 -56 -24.5 -103t-62 -76.5t-81.5 -58.5t-82 -50.5
+t-65.5 -51.5t-30.5 -63h232v80h126z" />
+    <glyph glyph-name="subscript" unicode="&#xf12c;" 
+d="M897 167v-167h-248l-159 252l-24 42q-8 9 -11 21h-3q-1 -3 -2.5 -6.5t-3.5 -8t-3 -6.5q-10 -20 -25 -44l-155 -250h-258v167h128l197 291l-185 272h-137v168h276l139 -228q2 -4 23 -42q8 -9 11 -21h3q3 9 11 21l25 42l140 228h257v-168h-125l-184 -267l204 -296h109z
+M1536 -50v-206h-514l-4 27q-3 45 -3 46q0 64 26 117t65 86.5t84 65t84 54.5t65 54t26 64q0 38 -29.5 62.5t-70.5 24.5q-51 0 -97 -39q-14 -11 -36 -38l-105 92q26 37 63 66q80 65 188 65q110 0 178 -59.5t68 -158.5q0 -66 -34.5 -118.5t-84 -86t-99.5 -62.5t-87 -63t-41 -73
+h232v80h126z" />
+    <glyph glyph-name="_283" unicode="&#xf12d;" horiz-adv-x="1920" 
+d="M896 128l336 384h-768l-336 -384h768zM1909 1205q15 -34 9.5 -71.5t-30.5 -65.5l-896 -1024q-38 -44 -96 -44h-768q-38 0 -69.5 20.5t-47.5 54.5q-15 34 -9.5 71.5t30.5 65.5l896 1024q38 44 96 44h768q38 0 69.5 -20.5t47.5 -54.5z" />
+    <glyph glyph-name="puzzle_piece" unicode="&#xf12e;" horiz-adv-x="1664" 
+d="M1664 438q0 -81 -44.5 -135t-123.5 -54q-41 0 -77.5 17.5t-59 38t-56.5 38t-71 17.5q-110 0 -110 -124q0 -39 16 -115t15 -115v-5q-22 0 -33 -1q-34 -3 -97.5 -11.5t-115.5 -13.5t-98 -5q-61 0 -103 26.5t-42 83.5q0 37 17.5 71t38 56.5t38 59t17.5 77.5q0 79 -54 123.5
+t-135 44.5q-84 0 -143 -45.5t-59 -127.5q0 -43 15 -83t33.5 -64.5t33.5 -53t15 -50.5q0 -45 -46 -89q-37 -35 -117 -35q-95 0 -245 24q-9 2 -27.5 4t-27.5 4l-13 2q-1 0 -3 1q-2 0 -2 1v1024q2 -1 17.5 -3.5t34 -5t21.5 -3.5q150 -24 245 -24q80 0 117 35q46 44 46 89
+q0 22 -15 50.5t-33.5 53t-33.5 64.5t-15 83q0 82 59 127.5t144 45.5q80 0 134 -44.5t54 -123.5q0 -41 -17.5 -77.5t-38 -59t-38 -56.5t-17.5 -71q0 -57 42 -83.5t103 -26.5q64 0 180 15t163 17v-2q-1 -2 -3.5 -17.5t-5 -34t-3.5 -21.5q-24 -150 -24 -245q0 -80 35 -117
+q44 -46 89 -46q22 0 50.5 15t53 33.5t64.5 33.5t83 15q82 0 127.5 -59t45.5 -143z" />
+    <glyph glyph-name="microphone" unicode="&#xf130;" horiz-adv-x="1152" 
+d="M1152 832v-128q0 -221 -147.5 -384.5t-364.5 -187.5v-132h256q26 0 45 -19t19 -45t-19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h256v132q-217 24 -364.5 187.5t-147.5 384.5v128q0 26 19 45t45 19t45 -19t19 -45v-128q0 -185 131.5 -316.5t316.5 -131.5
+t316.5 131.5t131.5 316.5v128q0 26 19 45t45 19t45 -19t19 -45zM896 1216v-512q0 -132 -94 -226t-226 -94t-226 94t-94 226v512q0 132 94 226t226 94t226 -94t94 -226z" />
+    <glyph glyph-name="microphone_off" unicode="&#xf131;" horiz-adv-x="1408" 
+d="M271 591l-101 -101q-42 103 -42 214v128q0 26 19 45t45 19t45 -19t19 -45v-128q0 -53 15 -113zM1385 1193l-361 -361v-128q0 -132 -94 -226t-226 -94q-55 0 -109 19l-96 -96q97 -51 205 -51q185 0 316.5 131.5t131.5 316.5v128q0 26 19 45t45 19t45 -19t19 -45v-128
+q0 -221 -147.5 -384.5t-364.5 -187.5v-132h256q26 0 45 -19t19 -45t-19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h256v132q-125 13 -235 81l-254 -254q-10 -10 -23 -10t-23 10l-82 82q-10 10 -10 23t10 23l1234 1234q10 10 23 10t23 -10l82 -82q10 -10 10 -23
+t-10 -23zM1005 1325l-621 -621v512q0 132 94 226t226 94q102 0 184.5 -59t116.5 -152z" />
+    <glyph glyph-name="shield" unicode="&#xf132;" horiz-adv-x="1280" 
+d="M1088 576v640h-448v-1137q119 63 213 137q235 184 235 360zM1280 1344v-768q0 -86 -33.5 -170.5t-83 -150t-118 -127.5t-126.5 -103t-121 -77.5t-89.5 -49.5t-42.5 -20q-12 -6 -26 -6t-26 6q-16 7 -42.5 20t-89.5 49.5t-121 77.5t-126.5 103t-118 127.5t-83 150
+t-33.5 170.5v768q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="calendar_empty" unicode="&#xf133;" horiz-adv-x="1664" 
+d="M128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280
+q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="fire_extinguisher" unicode="&#xf134;" horiz-adv-x="1408" 
+d="M512 1344q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 1376v-320q0 -16 -12 -25q-8 -7 -20 -7q-4 0 -7 1l-448 96q-11 2 -18 11t-7 20h-256v-102q111 -23 183.5 -111t72.5 -203v-800q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v800
+q0 106 62.5 190.5t161.5 114.5v111h-32q-59 0 -115 -23.5t-91.5 -53t-66 -66.5t-40.5 -53.5t-14 -24.5q-17 -35 -57 -35q-16 0 -29 7q-23 12 -31.5 37t3.5 49q5 10 14.5 26t37.5 53.5t60.5 70t85 67t108.5 52.5q-25 42 -25 86q0 66 47 113t113 47t113 -47t47 -113
+q0 -33 -14 -64h302q0 11 7 20t18 11l448 96q3 1 7 1q12 0 20 -7q12 -9 12 -25z" />
+    <glyph glyph-name="rocket" unicode="&#xf135;" horiz-adv-x="1664" 
+d="M1440 1088q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1664 1376q0 -249 -75.5 -430.5t-253.5 -360.5q-81 -80 -195 -176l-20 -379q-2 -16 -16 -26l-384 -224q-7 -4 -16 -4q-12 0 -23 9l-64 64q-13 14 -8 32l85 276l-281 281l-276 -85q-3 -1 -9 -1
+q-14 0 -23 9l-64 64q-17 19 -5 39l224 384q10 14 26 16l379 20q96 114 176 195q188 187 358 258t431 71q14 0 24 -9.5t10 -22.5z" />
+    <glyph glyph-name="maxcdn" unicode="&#xf136;" horiz-adv-x="1792" 
+d="M1745 763l-164 -763h-334l178 832q13 56 -15 88q-27 33 -83 33h-169l-204 -953h-334l204 953h-286l-204 -953h-334l204 953l-153 327h1276q101 0 189.5 -40.5t147.5 -113.5q60 -73 81 -168.5t0 -194.5z" />
+    <glyph glyph-name="chevron_sign_left" unicode="&#xf137;" 
+d="M909 141l102 102q19 19 19 45t-19 45l-307 307l307 307q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-454 -454q-19 -19 -19 -45t19 -45l454 -454q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_right" unicode="&#xf138;" 
+d="M717 141l454 454q19 19 19 45t-19 45l-454 454q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l307 -307l-307 -307q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_up" unicode="&#xf139;" 
+d="M1165 397l102 102q19 19 19 45t-19 45l-454 454q-19 19 -45 19t-45 -19l-454 -454q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19l307 307l307 -307q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_down" unicode="&#xf13a;" 
+d="M813 237l454 454q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-307 -307l-307 307q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l454 -454q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="html5" unicode="&#xf13b;" horiz-adv-x="1408" 
+d="M1130 939l16 175h-884l47 -534h612l-22 -228l-197 -53l-196 53l-13 140h-175l22 -278l362 -100h4v1l359 99l50 544h-644l-15 181h674zM0 1408h1408l-128 -1438l-578 -162l-574 162z" />
+    <glyph glyph-name="css3" unicode="&#xf13c;" horiz-adv-x="1792" 
+d="M275 1408h1505l-266 -1333l-804 -267l-698 267l71 356h297l-29 -147l422 -161l486 161l68 339h-1208l58 297h1209l38 191h-1208z" />
+    <glyph glyph-name="anchor" unicode="&#xf13d;" horiz-adv-x="1792" 
+d="M960 1280q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1792 352v-352q0 -22 -20 -30q-8 -2 -12 -2q-12 0 -23 9l-93 93q-119 -143 -318.5 -226.5t-429.5 -83.5t-429.5 83.5t-318.5 226.5l-93 -93q-9 -9 -23 -9q-4 0 -12 2q-20 8 -20 30v352
+q0 14 9 23t23 9h352q22 0 30 -20q8 -19 -7 -35l-100 -100q67 -91 189.5 -153.5t271.5 -82.5v647h-192q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h192v163q-58 34 -93 92.5t-35 128.5q0 106 75 181t181 75t181 -75t75 -181q0 -70 -35 -128.5t-93 -92.5v-163h192q26 0 45 -19
+t19 -45v-128q0 -26 -19 -45t-45 -19h-192v-647q149 20 271.5 82.5t189.5 153.5l-100 100q-15 16 -7 35q8 20 30 20h352q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="unlock_alt" unicode="&#xf13e;" horiz-adv-x="1152" 
+d="M1056 768q40 0 68 -28t28 -68v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h32v320q0 185 131.5 316.5t316.5 131.5t316.5 -131.5t131.5 -316.5q0 -26 -19 -45t-45 -19h-64q-26 0 -45 19t-19 45q0 106 -75 181t-181 75t-181 -75t-75 -181
+v-320h736z" />
+    <glyph glyph-name="bullseye" unicode="&#xf140;" 
+d="M1024 640q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM1152 640q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM1280 640q0 -212 -150 -362t-362 -150t-362 150
+t-150 362t150 362t362 150t362 -150t150 -362zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ellipsis_horizontal" unicode="&#xf141;" horiz-adv-x="1408" 
+d="M384 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM896 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM1408 800v-192q0 -40 -28 -68t-68 -28h-192
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="ellipsis_vertical" unicode="&#xf142;" horiz-adv-x="384" 
+d="M384 288v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM384 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM384 1312v-192q0 -40 -28 -68t-68 -28h-192
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="_303" unicode="&#xf143;" 
+d="M512 256q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM863 162q-13 233 -176.5 396.5t-396.5 176.5q-14 1 -24 -9t-10 -23v-128q0 -13 8.5 -22t21.5 -10q154 -11 264 -121t121 -264q1 -13 10 -21.5t22 -8.5h128
+q13 0 23 10t9 24zM1247 161q-5 154 -56 297.5t-139.5 260t-205 205t-260 139.5t-297.5 56q-14 1 -23 -9q-10 -10 -10 -23v-128q0 -13 9 -22t22 -10q204 -7 378 -111.5t278.5 -278.5t111.5 -378q1 -13 10 -22t22 -9h128q13 0 23 10q11 9 9 23zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="play_sign" unicode="&#xf144;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM1152 585q32 18 32 55t-32 55l-544 320q-31 19 -64 1q-32 -19 -32 -56v-640q0 -37 32 -56
+q16 -8 32 -8q17 0 32 9z" />
+    <glyph glyph-name="ticket" unicode="&#xf145;" horiz-adv-x="1792" 
+d="M1024 1084l316 -316l-572 -572l-316 316zM813 105l618 618q19 19 19 45t-19 45l-362 362q-18 18 -45 18t-45 -18l-618 -618q-19 -19 -19 -45t19 -45l362 -362q18 -18 45 -18t45 18zM1702 742l-907 -908q-37 -37 -90.5 -37t-90.5 37l-126 126q56 56 56 136t-56 136
+t-136 56t-136 -56l-125 126q-37 37 -37 90.5t37 90.5l907 906q37 37 90.5 37t90.5 -37l125 -125q-56 -56 -56 -136t56 -136t136 -56t136 56l126 -125q37 -37 37 -90.5t-37 -90.5z" />
+    <glyph glyph-name="minus_sign_alt" unicode="&#xf146;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-896q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h896q26 0 45 19t19 45zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="check_minus" unicode="&#xf147;" horiz-adv-x="1408" 
+d="M1152 736v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h832q14 0 23 -9t9 -23zM1280 288v832q0 66 -47 113t-113 47h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113zM1408 1120v-832q0 -119 -84.5 -203.5
+t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="level_up" unicode="&#xf148;" horiz-adv-x="1024" 
+d="M1018 933q-18 -37 -58 -37h-192v-864q0 -14 -9 -23t-23 -9h-704q-21 0 -29 18q-8 20 4 35l160 192q9 11 25 11h320v640h-192q-40 0 -58 37q-17 37 9 68l320 384q18 22 49 22t49 -22l320 -384q27 -32 9 -68z" />
+    <glyph glyph-name="level_down" unicode="&#xf149;" horiz-adv-x="1024" 
+d="M32 1280h704q13 0 22.5 -9.5t9.5 -23.5v-863h192q40 0 58 -37t-9 -69l-320 -384q-18 -22 -49 -22t-49 22l-320 384q-26 31 -9 69q18 37 58 37h192v640h-320q-14 0 -25 11l-160 192q-13 14 -4 34q9 19 29 19z" />
+    <glyph glyph-name="check_sign" unicode="&#xf14a;" 
+d="M685 237l614 614q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-467 -467l-211 211q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l358 -358q19 -19 45 -19t45 19zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5
+t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="edit_sign" unicode="&#xf14b;" 
+d="M404 428l152 -152l-52 -52h-56v96h-96v56zM818 818q14 -13 -3 -30l-291 -291q-17 -17 -30 -3q-14 13 3 30l291 291q17 17 30 3zM544 128l544 544l-288 288l-544 -544v-288h288zM1152 736l92 92q28 28 28 68t-28 68l-152 152q-28 28 -68 28t-68 -28l-92 -92zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_312" unicode="&#xf14c;" 
+d="M1280 608v480q0 26 -19 45t-45 19h-480q-42 0 -59 -39q-17 -41 14 -70l144 -144l-534 -534q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19l534 534l144 -144q18 -19 45 -19q12 0 25 5q39 17 39 59zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960
+q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="share_sign" unicode="&#xf14d;" 
+d="M1005 435l352 352q19 19 19 45t-19 45l-352 352q-30 31 -69 14q-40 -17 -40 -59v-160q-119 0 -216 -19.5t-162.5 -51t-114 -79t-76.5 -95.5t-44.5 -109t-21.5 -111.5t-5 -110.5q0 -181 167 -404q11 -12 25 -12q7 0 13 3q22 9 19 33q-44 354 62 473q46 52 130 75.5
+t224 23.5v-160q0 -42 40 -59q12 -5 24 -5q26 0 45 19zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="compass" unicode="&#xf14e;" 
+d="M640 448l256 128l-256 128v-256zM1024 1039v-542l-512 -256v542zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="collapse" unicode="&#xf150;" 
+d="M1145 861q18 -35 -5 -66l-320 -448q-19 -27 -52 -27t-52 27l-320 448q-23 31 -5 66q17 35 57 35h640q40 0 57 -35zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="collapse_top" unicode="&#xf151;" 
+d="M1145 419q-17 -35 -57 -35h-640q-40 0 -57 35q-18 35 5 66l320 448q19 27 52 27t52 -27l320 -448q23 -31 5 -66zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_317" unicode="&#xf152;" 
+d="M1088 640q0 -33 -27 -52l-448 -320q-31 -23 -66 -5q-35 17 -35 57v640q0 40 35 57q35 18 66 -5l448 -320q27 -19 27 -52zM1280 160v960q0 14 -9 23t-23 9h-960q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h960q14 0 23 9t9 23zM1536 1120v-960q0 -119 -84.5 -203.5
+t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="eur" unicode="&#xf153;" horiz-adv-x="1024" 
+d="M976 229l35 -159q3 -12 -3 -22.5t-17 -14.5l-5 -1q-4 -2 -10.5 -3.5t-16 -4.5t-21.5 -5.5t-25.5 -5t-30 -5t-33.5 -4.5t-36.5 -3t-38.5 -1q-234 0 -409 130.5t-238 351.5h-95q-13 0 -22.5 9.5t-9.5 22.5v113q0 13 9.5 22.5t22.5 9.5h66q-2 57 1 105h-67q-14 0 -23 9
+t-9 23v114q0 14 9 23t23 9h98q67 210 243.5 338t400.5 128q102 0 194 -23q11 -3 20 -15q6 -11 3 -24l-43 -159q-3 -13 -14 -19.5t-24 -2.5l-4 1q-4 1 -11.5 2.5l-17.5 3.5t-22.5 3.5t-26 3t-29 2.5t-29.5 1q-126 0 -226 -64t-150 -176h468q16 0 25 -12q10 -12 7 -26
+l-24 -114q-5 -26 -32 -26h-488q-3 -37 0 -105h459q15 0 25 -12q9 -12 6 -27l-24 -112q-2 -11 -11 -18.5t-20 -7.5h-387q48 -117 149.5 -185.5t228.5 -68.5q18 0 36 1.5t33.5 3.5t29.5 4.5t24.5 5t18.5 4.5l12 3l5 2q13 5 26 -2q12 -7 15 -21z" />
+    <glyph glyph-name="gbp" unicode="&#xf154;" horiz-adv-x="1024" 
+d="M1020 399v-367q0 -14 -9 -23t-23 -9h-956q-14 0 -23 9t-9 23v150q0 13 9.5 22.5t22.5 9.5h97v383h-95q-14 0 -23 9.5t-9 22.5v131q0 14 9 23t23 9h95v223q0 171 123.5 282t314.5 111q185 0 335 -125q9 -8 10 -20.5t-7 -22.5l-103 -127q-9 -11 -22 -12q-13 -2 -23 7
+q-5 5 -26 19t-69 32t-93 18q-85 0 -137 -47t-52 -123v-215h305q13 0 22.5 -9t9.5 -23v-131q0 -13 -9.5 -22.5t-22.5 -9.5h-305v-379h414v181q0 13 9 22.5t23 9.5h162q14 0 23 -9.5t9 -22.5z" />
+    <glyph glyph-name="usd" unicode="&#xf155;" horiz-adv-x="1024" 
+d="M978 351q0 -153 -99.5 -263.5t-258.5 -136.5v-175q0 -14 -9 -23t-23 -9h-135q-13 0 -22.5 9.5t-9.5 22.5v175q-66 9 -127.5 31t-101.5 44.5t-74 48t-46.5 37.5t-17.5 18q-17 21 -2 41l103 135q7 10 23 12q15 2 24 -9l2 -2q113 -99 243 -125q37 -8 74 -8q81 0 142.5 43
+t61.5 122q0 28 -15 53t-33.5 42t-58.5 37.5t-66 32t-80 32.5q-39 16 -61.5 25t-61.5 26.5t-62.5 31t-56.5 35.5t-53.5 42.5t-43.5 49t-35.5 58t-21 66.5t-8.5 78q0 138 98 242t255 134v180q0 13 9.5 22.5t22.5 9.5h135q14 0 23 -9t9 -23v-176q57 -6 110.5 -23t87 -33.5
+t63.5 -37.5t39 -29t15 -14q17 -18 5 -38l-81 -146q-8 -15 -23 -16q-14 -3 -27 7q-3 3 -14.5 12t-39 26.5t-58.5 32t-74.5 26t-85.5 11.5q-95 0 -155 -43t-60 -111q0 -26 8.5 -48t29.5 -41.5t39.5 -33t56 -31t60.5 -27t70 -27.5q53 -20 81 -31.5t76 -35t75.5 -42.5t62 -50
+t53 -63.5t31.5 -76.5t13 -94z" />
+    <glyph glyph-name="inr" unicode="&#xf156;" horiz-adv-x="898" 
+d="M898 1066v-102q0 -14 -9 -23t-23 -9h-168q-23 -144 -129 -234t-276 -110q167 -178 459 -536q14 -16 4 -34q-8 -18 -29 -18h-195q-16 0 -25 12q-306 367 -498 571q-9 9 -9 22v127q0 13 9.5 22.5t22.5 9.5h112q132 0 212.5 43t102.5 125h-427q-14 0 -23 9t-9 23v102
+q0 14 9 23t23 9h413q-57 113 -268 113h-145q-13 0 -22.5 9.5t-9.5 22.5v133q0 14 9 23t23 9h832q14 0 23 -9t9 -23v-102q0 -14 -9 -23t-23 -9h-233q47 -61 64 -144h171q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="jpy" unicode="&#xf157;" horiz-adv-x="1027" 
+d="M603 0h-172q-13 0 -22.5 9t-9.5 23v330h-288q-13 0 -22.5 9t-9.5 23v103q0 13 9.5 22.5t22.5 9.5h288v85h-288q-13 0 -22.5 9t-9.5 23v104q0 13 9.5 22.5t22.5 9.5h214l-321 578q-8 16 0 32q10 16 28 16h194q19 0 29 -18l215 -425q19 -38 56 -125q10 24 30.5 68t27.5 61
+l191 420q8 19 29 19h191q17 0 27 -16q9 -14 1 -31l-313 -579h215q13 0 22.5 -9.5t9.5 -22.5v-104q0 -14 -9.5 -23t-22.5 -9h-290v-85h290q13 0 22.5 -9.5t9.5 -22.5v-103q0 -14 -9.5 -23t-22.5 -9h-290v-330q0 -13 -9.5 -22.5t-22.5 -9.5z" />
+    <glyph glyph-name="rub" unicode="&#xf158;" horiz-adv-x="1280" 
+d="M1043 971q0 100 -65 162t-171 62h-320v-448h320q106 0 171 62t65 162zM1280 971q0 -193 -126.5 -315t-326.5 -122h-340v-118h505q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9h-505v-192q0 -14 -9.5 -23t-22.5 -9h-167q-14 0 -23 9t-9 23v192h-224q-14 0 -23 9t-9 23v128
+q0 14 9 23t23 9h224v118h-224q-14 0 -23 9t-9 23v149q0 13 9 22.5t23 9.5h224v629q0 14 9 23t23 9h539q200 0 326.5 -122t126.5 -315z" />
+    <glyph glyph-name="krw" unicode="&#xf159;" horiz-adv-x="1792" 
+d="M514 341l81 299h-159l75 -300q1 -1 1 -3t1 -3q0 1 0.5 3.5t0.5 3.5zM630 768l35 128h-292l32 -128h225zM822 768h139l-35 128h-70zM1271 340l78 300h-162l81 -299q0 -1 0.5 -3.5t1.5 -3.5q0 1 0.5 3t0.5 3zM1382 768l33 128h-297l34 -128h230zM1792 736v-64q0 -14 -9 -23
+t-23 -9h-213l-164 -616q-7 -24 -31 -24h-159q-24 0 -31 24l-166 616h-209l-167 -616q-7 -24 -31 -24h-159q-11 0 -19.5 7t-10.5 17l-160 616h-208q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h175l-33 128h-142q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h109l-89 344q-5 15 5 28
+q10 12 26 12h137q26 0 31 -24l90 -360h359l97 360q7 24 31 24h126q24 0 31 -24l98 -360h365l93 360q5 24 31 24h137q16 0 26 -12q10 -13 5 -28l-91 -344h111q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-145l-34 -128h179q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="btc" unicode="&#xf15a;" horiz-adv-x="1280" 
+d="M1167 896q18 -182 -131 -258q117 -28 175 -103t45 -214q-7 -71 -32.5 -125t-64.5 -89t-97 -58.5t-121.5 -34.5t-145.5 -15v-255h-154v251q-80 0 -122 1v-252h-154v255q-18 0 -54 0.5t-55 0.5h-200l31 183h111q50 0 58 51v402h16q-6 1 -16 1v287q-13 68 -89 68h-111v164
+l212 -1q64 0 97 1v252h154v-247q82 2 122 2v245h154v-252q79 -7 140 -22.5t113 -45t82.5 -78t36.5 -114.5zM952 351q0 36 -15 64t-37 46t-57.5 30.5t-65.5 18.5t-74 9t-69 3t-64.5 -1t-47.5 -1v-338q8 0 37 -0.5t48 -0.5t53 1.5t58.5 4t57 8.5t55.5 14t47.5 21t39.5 30
+t24.5 40t9.5 51zM881 827q0 33 -12.5 58.5t-30.5 42t-48 28t-55 16.5t-61.5 8t-58 2.5t-54 -1t-39.5 -0.5v-307q5 0 34.5 -0.5t46.5 0t50 2t55 5.5t51.5 11t48.5 18.5t37 27t27 38.5t9 51z" />
+    <glyph glyph-name="file" unicode="&#xf15b;" 
+d="M1024 1024v472q22 -14 36 -28l408 -408q14 -14 28 -36h-472zM896 992q0 -40 28 -68t68 -28h544v-1056q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h800v-544z" />
+    <glyph glyph-name="file_text" unicode="&#xf15c;" 
+d="M1468 1060q14 -14 28 -36h-472v472q22 -14 36 -28zM992 896h544v-1056q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h800v-544q0 -40 28 -68t68 -28zM1152 160v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704
+q14 0 23 9t9 23zM1152 416v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM1152 672v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23z" />
+    <glyph glyph-name="sort_by_alphabet" unicode="&#xf15d;" horiz-adv-x="1664" 
+d="M1191 1128h177l-72 218l-12 47q-2 16 -2 20h-4l-3 -20q0 -1 -3.5 -18t-7.5 -29zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1572 -23
+v-233h-584v90l369 529q12 18 21 27l11 9v3q-2 0 -6.5 -0.5t-7.5 -0.5q-12 -3 -30 -3h-232v-115h-120v229h567v-89l-369 -530q-6 -8 -21 -26l-11 -11v-2l14 2q9 2 30 2h248v119h121zM1661 874v-106h-288v106h75l-47 144h-243l-47 -144h75v-106h-287v106h70l230 662h162
+l230 -662h70z" />
+    <glyph glyph-name="_329" unicode="&#xf15e;" horiz-adv-x="1664" 
+d="M1191 104h177l-72 218l-12 47q-2 16 -2 20h-4l-3 -20q0 -1 -3.5 -18t-7.5 -29zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1661 -150
+v-106h-288v106h75l-47 144h-243l-47 -144h75v-106h-287v106h70l230 662h162l230 -662h70zM1572 1001v-233h-584v90l369 529q12 18 21 27l11 9v3q-2 0 -6.5 -0.5t-7.5 -0.5q-12 -3 -30 -3h-232v-115h-120v229h567v-89l-369 -530q-6 -8 -21 -26l-11 -10v-3l14 3q9 1 30 1h248
+v119h121z" />
+    <glyph glyph-name="sort_by_attributes" unicode="&#xf160;" horiz-adv-x="1792" 
+d="M736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1792 -32v-192q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h832
+q14 0 23 -9t9 -23zM1600 480v-192q0 -14 -9 -23t-23 -9h-640q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h640q14 0 23 -9t9 -23zM1408 992v-192q0 -14 -9 -23t-23 -9h-448q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h448q14 0 23 -9t9 -23zM1216 1504v-192q0 -14 -9 -23t-23 -9h-256
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h256q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="sort_by_attributes_alt" unicode="&#xf161;" horiz-adv-x="1792" 
+d="M1216 -32v-192q0 -14 -9 -23t-23 -9h-256q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h256q14 0 23 -9t9 -23zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192
+q14 0 23 -9t9 -23zM1408 480v-192q0 -14 -9 -23t-23 -9h-448q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h448q14 0 23 -9t9 -23zM1600 992v-192q0 -14 -9 -23t-23 -9h-640q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h640q14 0 23 -9t9 -23zM1792 1504v-192q0 -14 -9 -23t-23 -9h-832
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h832q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="sort_by_order" unicode="&#xf162;" 
+d="M1346 223q0 63 -44 116t-103 53q-52 0 -83 -37t-31 -94t36.5 -95t104.5 -38q50 0 85 27t35 68zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23
+zM1486 165q0 -62 -13 -121.5t-41 -114t-68 -95.5t-98.5 -65.5t-127.5 -24.5q-62 0 -108 16q-24 8 -42 15l39 113q15 -7 31 -11q37 -13 75 -13q84 0 134.5 58.5t66.5 145.5h-2q-21 -23 -61.5 -37t-84.5 -14q-106 0 -173 71.5t-67 172.5q0 105 72 178t181 73q123 0 205 -94.5
+t82 -252.5zM1456 882v-114h-469v114h167v432q0 7 0.5 19t0.5 17v16h-2l-7 -12q-8 -13 -26 -31l-62 -58l-82 86l192 185h123v-654h165z" />
+    <glyph glyph-name="sort_by_order_alt" unicode="&#xf163;" 
+d="M1346 1247q0 63 -44 116t-103 53q-52 0 -83 -37t-31 -94t36.5 -95t104.5 -38q50 0 85 27t35 68zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9
+t9 -23zM1456 -142v-114h-469v114h167v432q0 7 0.5 19t0.5 17v16h-2l-7 -12q-8 -13 -26 -31l-62 -58l-82 86l192 185h123v-654h165zM1486 1189q0 -62 -13 -121.5t-41 -114t-68 -95.5t-98.5 -65.5t-127.5 -24.5q-62 0 -108 16q-24 8 -42 15l39 113q15 -7 31 -11q37 -13 75 -13
+q84 0 134.5 58.5t66.5 145.5h-2q-21 -23 -61.5 -37t-84.5 -14q-106 0 -173 71.5t-67 172.5q0 105 72 178t181 73q123 0 205 -94.5t82 -252.5z" />
+    <glyph glyph-name="_334" unicode="&#xf164;" horiz-adv-x="1664" 
+d="M256 192q0 26 -19 45t-45 19q-27 0 -45.5 -19t-18.5 -45q0 -27 18.5 -45.5t45.5 -18.5q26 0 45 18.5t19 45.5zM416 704v-640q0 -26 -19 -45t-45 -19h-288q-26 0 -45 19t-19 45v640q0 26 19 45t45 19h288q26 0 45 -19t19 -45zM1600 704q0 -86 -55 -149q15 -44 15 -76
+q3 -76 -43 -137q17 -56 0 -117q-15 -57 -54 -94q9 -112 -49 -181q-64 -76 -197 -78h-36h-76h-17q-66 0 -144 15.5t-121.5 29t-120.5 39.5q-123 43 -158 44q-26 1 -45 19.5t-19 44.5v641q0 25 18 43.5t43 20.5q24 2 76 59t101 121q68 87 101 120q18 18 31 48t17.5 48.5
+t13.5 60.5q7 39 12.5 61t19.5 52t34 50q19 19 45 19q46 0 82.5 -10.5t60 -26t40 -40.5t24 -45t12 -50t5 -45t0.5 -39q0 -38 -9.5 -76t-19 -60t-27.5 -56q-3 -6 -10 -18t-11 -22t-8 -24h277q78 0 135 -57t57 -135z" />
+    <glyph glyph-name="_335" unicode="&#xf165;" horiz-adv-x="1664" 
+d="M256 960q0 -26 -19 -45t-45 -19q-27 0 -45.5 19t-18.5 45q0 27 18.5 45.5t45.5 18.5q26 0 45 -18.5t19 -45.5zM416 448v640q0 26 -19 45t-45 19h-288q-26 0 -45 -19t-19 -45v-640q0 -26 19 -45t45 -19h288q26 0 45 19t19 45zM1545 597q55 -61 55 -149q-1 -78 -57.5 -135
+t-134.5 -57h-277q4 -14 8 -24t11 -22t10 -18q18 -37 27 -57t19 -58.5t10 -76.5q0 -24 -0.5 -39t-5 -45t-12 -50t-24 -45t-40 -40.5t-60 -26t-82.5 -10.5q-26 0 -45 19q-20 20 -34 50t-19.5 52t-12.5 61q-9 42 -13.5 60.5t-17.5 48.5t-31 48q-33 33 -101 120q-49 64 -101 121
+t-76 59q-25 2 -43 20.5t-18 43.5v641q0 26 19 44.5t45 19.5q35 1 158 44q77 26 120.5 39.5t121.5 29t144 15.5h17h76h36q133 -2 197 -78q58 -69 49 -181q39 -37 54 -94q17 -61 0 -117q46 -61 43 -137q0 -32 -15 -76z" />
+    <glyph glyph-name="youtube_sign" unicode="&#xf166;" 
+d="M919 233v157q0 50 -29 50q-17 0 -33 -16v-224q16 -16 33 -16q29 0 29 49zM1103 355h66v34q0 51 -33 51t-33 -51v-34zM532 621v-70h-80v-423h-74v423h-78v70h232zM733 495v-367h-67v40q-39 -45 -76 -45q-33 0 -42 28q-6 17 -6 54v290h66v-270q0 -24 1 -26q1 -15 15 -15
+q20 0 42 31v280h67zM985 384v-146q0 -52 -7 -73q-12 -42 -53 -42q-35 0 -68 41v-36h-67v493h67v-161q32 40 68 40q41 0 53 -42q7 -21 7 -74zM1236 255v-9q0 -29 -2 -43q-3 -22 -15 -40q-27 -40 -80 -40q-52 0 -81 38q-21 27 -21 86v129q0 59 20 86q29 38 80 38t78 -38
+q21 -29 21 -86v-76h-133v-65q0 -51 34 -51q24 0 30 26q0 1 0.5 7t0.5 16.5v21.5h68zM785 1079v-156q0 -51 -32 -51t-32 51v156q0 52 32 52t32 -52zM1318 366q0 177 -19 260q-10 44 -43 73.5t-76 34.5q-136 15 -412 15q-275 0 -411 -15q-44 -5 -76.5 -34.5t-42.5 -73.5
+q-20 -87 -20 -260q0 -176 20 -260q10 -43 42.5 -73t75.5 -35q137 -15 412 -15t412 15q43 5 75.5 35t42.5 73q20 84 20 260zM563 1017l90 296h-75l-51 -195l-53 195h-78q7 -23 23 -69l24 -69q35 -103 46 -158v-201h74v201zM852 936v130q0 58 -21 87q-29 38 -78 38
+q-51 0 -78 -38q-21 -29 -21 -87v-130q0 -58 21 -87q27 -38 78 -38q49 0 78 38q21 27 21 87zM1033 816h67v370h-67v-283q-22 -31 -42 -31q-15 0 -16 16q-1 2 -1 26v272h-67v-293q0 -37 6 -55q11 -27 43 -27q36 0 77 45v-40zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5
+h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="youtube" unicode="&#xf167;" 
+d="M971 292v-211q0 -67 -39 -67q-23 0 -45 22v301q22 22 45 22q39 0 39 -67zM1309 291v-46h-90v46q0 68 45 68t45 -68zM343 509h107v94h-312v-94h105v-569h100v569zM631 -60h89v494h-89v-378q-30 -42 -57 -42q-18 0 -21 21q-1 3 -1 35v364h-89v-391q0 -49 8 -73
+q12 -37 58 -37q48 0 102 61v-54zM1060 88v197q0 73 -9 99q-17 56 -71 56q-50 0 -93 -54v217h-89v-663h89v48q45 -55 93 -55q54 0 71 55q9 27 9 100zM1398 98v13h-91q0 -51 -2 -61q-7 -36 -40 -36q-46 0 -46 69v87h179v103q0 79 -27 116q-39 51 -106 51q-68 0 -107 -51
+q-28 -37 -28 -116v-173q0 -79 29 -116q39 -51 108 -51q72 0 108 53q18 27 21 54q2 9 2 58zM790 1011v210q0 69 -43 69t-43 -69v-210q0 -70 43 -70t43 70zM1509 260q0 -234 -26 -350q-14 -59 -58 -99t-102 -46q-184 -21 -555 -21t-555 21q-58 6 -102.5 46t-57.5 99
+q-26 112 -26 350q0 234 26 350q14 59 58 99t103 47q183 20 554 20t555 -20q58 -7 102.5 -47t57.5 -99q26 -112 26 -350zM511 1536h102l-121 -399v-271h-100v271q-14 74 -61 212q-37 103 -65 187h106l71 -263zM881 1203v-175q0 -81 -28 -118q-38 -51 -106 -51q-67 0 -105 51
+q-28 38 -28 118v175q0 80 28 117q38 51 105 51q68 0 106 -51q28 -37 28 -117zM1216 1365v-499h-91v55q-53 -62 -103 -62q-46 0 -59 37q-8 24 -8 75v394h91v-367q0 -33 1 -35q3 -22 21 -22q27 0 57 43v381h91z" />
+    <glyph glyph-name="xing" unicode="&#xf168;" horiz-adv-x="1408" 
+d="M597 869q-10 -18 -257 -456q-27 -46 -65 -46h-239q-21 0 -31 17t0 36l253 448q1 0 0 1l-161 279q-12 22 -1 37q9 15 32 15h239q40 0 66 -45zM1403 1511q11 -16 0 -37l-528 -934v-1l336 -615q11 -20 1 -37q-10 -15 -32 -15h-239q-42 0 -66 45l-339 622q18 32 531 942
+q25 45 64 45h241q22 0 31 -15z" />
+    <glyph glyph-name="xing_sign" unicode="&#xf169;" 
+d="M685 771q0 1 -126 222q-21 34 -52 34h-184q-18 0 -26 -11q-7 -12 1 -29l125 -216v-1l-196 -346q-9 -14 0 -28q8 -13 24 -13h185q31 0 50 36zM1309 1268q-7 12 -24 12h-187q-30 0 -49 -35l-411 -729q1 -2 262 -481q20 -35 52 -35h184q18 0 25 12q8 13 -1 28l-260 476v1
+l409 723q8 16 0 28zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="youtube_play" unicode="&#xf16a;" horiz-adv-x="1792" 
+d="M711 408l484 250l-484 253v-503zM896 1270q168 0 324.5 -4.5t229.5 -9.5l73 -4q1 0 17 -1.5t23 -3t23.5 -4.5t28.5 -8t28 -13t31 -19.5t29 -26.5q6 -6 15.5 -18.5t29 -58.5t26.5 -101q8 -64 12.5 -136.5t5.5 -113.5v-40v-136q1 -145 -18 -290q-7 -55 -25 -99.5t-32 -61.5
+l-14 -17q-14 -15 -29 -26.5t-31 -19t-28 -12.5t-28.5 -8t-24 -4.5t-23 -3t-16.5 -1.5q-251 -19 -627 -19q-207 2 -359.5 6.5t-200.5 7.5l-49 4l-36 4q-36 5 -54.5 10t-51 21t-56.5 41q-6 6 -15.5 18.5t-29 58.5t-26.5 101q-8 64 -12.5 136.5t-5.5 113.5v40v136
+q-1 145 18 290q7 55 25 99.5t32 61.5l14 17q14 15 29 26.5t31 19.5t28 13t28.5 8t23.5 4.5t23 3t17 1.5q251 18 627 18z" />
+    <glyph glyph-name="dropbox" unicode="&#xf16b;" horiz-adv-x="1792" 
+d="M402 829l494 -305l-342 -285l-490 319zM1388 274v-108l-490 -293v-1l-1 1l-1 -1v1l-489 293v108l147 -96l342 284v2l1 -1l1 1v-2l343 -284zM554 1418l342 -285l-494 -304l-338 270zM1390 829l338 -271l-489 -319l-343 285zM1239 1418l489 -319l-338 -270l-494 304z" />
+    <glyph glyph-name="stackexchange" unicode="&#xf16c;" 
+d="M1289 -96h-1118v480h-160v-640h1438v640h-160v-480zM347 428l33 157l783 -165l-33 -156zM450 802l67 146l725 -339l-67 -145zM651 1158l102 123l614 -513l-102 -123zM1048 1536l477 -641l-128 -96l-477 641zM330 65v159h800v-159h-800z" />
+    <glyph glyph-name="instagram" unicode="&#xf16d;" 
+d="M1024 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1162 640q0 -164 -115 -279t-279 -115t-279 115t-115 279t115 279t279 115t279 -115t115 -279zM1270 1050q0 -38 -27 -65t-65 -27t-65 27t-27 65t27 65t65 27t65 -27t27 -65zM768 1270
+q-7 0 -76.5 0.5t-105.5 0t-96.5 -3t-103 -10t-71.5 -18.5q-50 -20 -88 -58t-58 -88q-11 -29 -18.5 -71.5t-10 -103t-3 -96.5t0 -105.5t0.5 -76.5t-0.5 -76.5t0 -105.5t3 -96.5t10 -103t18.5 -71.5q20 -50 58 -88t88 -58q29 -11 71.5 -18.5t103 -10t96.5 -3t105.5 0t76.5 0.5
+t76.5 -0.5t105.5 0t96.5 3t103 10t71.5 18.5q50 20 88 58t58 88q11 29 18.5 71.5t10 103t3 96.5t0 105.5t-0.5 76.5t0.5 76.5t0 105.5t-3 96.5t-10 103t-18.5 71.5q-20 50 -58 88t-88 58q-29 11 -71.5 18.5t-103 10t-96.5 3t-105.5 0t-76.5 -0.5zM1536 640q0 -229 -5 -317
+q-10 -208 -124 -322t-322 -124q-88 -5 -317 -5t-317 5q-208 10 -322 124t-124 322q-5 88 -5 317t5 317q10 208 124 322t322 124q88 5 317 5t317 -5q208 -10 322 -124t124 -322q5 -88 5 -317z" />
+    <glyph glyph-name="flickr" unicode="&#xf16e;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM698 640q0 88 -62 150t-150 62t-150 -62t-62 -150t62 -150t150 -62t150 62t62 150zM1262 640q0 88 -62 150
+t-150 62t-150 -62t-62 -150t62 -150t150 -62t150 62t62 150z" />
+    <glyph glyph-name="adn" unicode="&#xf170;" 
+d="M768 914l201 -306h-402zM1133 384h94l-459 691l-459 -691h94l104 160h522zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="f171" unicode="&#xf171;" horiz-adv-x="1408" 
+d="M815 677q8 -63 -50.5 -101t-111.5 -6q-39 17 -53.5 58t-0.5 82t52 58q36 18 72.5 12t64 -35.5t27.5 -67.5zM926 698q-14 107 -113 164t-197 13q-63 -28 -100.5 -88.5t-34.5 -129.5q4 -91 77.5 -155t165.5 -56q91 8 152 84t50 168zM1165 1240q-20 27 -56 44.5t-58 22
+t-71 12.5q-291 47 -566 -2q-43 -7 -66 -12t-55 -22t-50 -43q30 -28 76 -45.5t73.5 -22t87.5 -11.5q228 -29 448 -1q63 8 89.5 12t72.5 21.5t75 46.5zM1222 205q-8 -26 -15.5 -76.5t-14 -84t-28.5 -70t-58 -56.5q-86 -48 -189.5 -71.5t-202 -22t-201.5 18.5q-46 8 -81.5 18
+t-76.5 27t-73 43.5t-52 61.5q-25 96 -57 292l6 16l18 9q223 -148 506.5 -148t507.5 148q21 -6 24 -23t-5 -45t-8 -37zM1403 1166q-26 -167 -111 -655q-5 -30 -27 -56t-43.5 -40t-54.5 -31q-252 -126 -610 -88q-248 27 -394 139q-15 12 -25.5 26.5t-17 35t-9 34t-6 39.5
+t-5.5 35q-9 50 -26.5 150t-28 161.5t-23.5 147.5t-22 158q3 26 17.5 48.5t31.5 37.5t45 30t46 22.5t48 18.5q125 46 313 64q379 37 676 -50q155 -46 215 -122q16 -20 16.5 -51t-5.5 -54z" />
+    <glyph glyph-name="bitbucket_sign" unicode="&#xf172;" 
+d="M848 666q0 43 -41 66t-77 1q-43 -20 -42.5 -72.5t43.5 -70.5q39 -23 81 4t36 72zM928 682q8 -66 -36 -121t-110 -61t-119 40t-56 113q-2 49 25.5 93t72.5 64q70 31 141.5 -10t81.5 -118zM1100 1073q-20 -21 -53.5 -34t-53 -16t-63.5 -8q-155 -20 -324 0q-44 6 -63 9.5
+t-52.5 16t-54.5 32.5q13 19 36 31t40 15.5t47 8.5q198 35 408 1q33 -5 51 -8.5t43 -16t39 -31.5zM1142 327q0 7 5.5 26.5t3 32t-17.5 16.5q-161 -106 -365 -106t-366 106l-12 -6l-5 -12q26 -154 41 -210q47 -81 204 -108q249 -46 428 53q34 19 49 51.5t22.5 85.5t12.5 71z
+M1272 1020q9 53 -8 75q-43 55 -155 88q-216 63 -487 36q-132 -12 -226 -46q-38 -15 -59.5 -25t-47 -34t-29.5 -54q8 -68 19 -138t29 -171t24 -137q1 -5 5 -31t7 -36t12 -27t22 -28q105 -80 284 -100q259 -28 440 63q24 13 39.5 23t31 29t19.5 40q48 267 80 473zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="tumblr" unicode="&#xf173;" horiz-adv-x="1024" 
+d="M944 207l80 -237q-23 -35 -111 -66t-177 -32q-104 -2 -190.5 26t-142.5 74t-95 106t-55.5 120t-16.5 118v544h-168v215q72 26 129 69.5t91 90t58 102t34 99t15 88.5q1 5 4.5 8.5t7.5 3.5h244v-424h333v-252h-334v-518q0 -30 6.5 -56t22.5 -52.5t49.5 -41.5t81.5 -14
+q78 2 134 29z" />
+    <glyph glyph-name="tumblr_sign" unicode="&#xf174;" 
+d="M1136 75l-62 183q-44 -22 -103 -22q-36 -1 -62 10.5t-38.5 31.5t-17.5 40.5t-5 43.5v398h257v194h-256v326h-188q-8 0 -9 -10q-5 -44 -17.5 -87t-39 -95t-77 -95t-118.5 -68v-165h130v-418q0 -57 21.5 -115t65 -111t121 -85.5t176.5 -30.5q69 1 136.5 25t85.5 50z
+M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="long_arrow_down" unicode="&#xf175;" horiz-adv-x="768" 
+d="M765 237q8 -19 -5 -35l-350 -384q-10 -10 -23 -10q-14 0 -24 10l-355 384q-13 16 -5 35q9 19 29 19h224v1248q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1248h224q21 0 29 -19z" />
+    <glyph glyph-name="long_arrow_up" unicode="&#xf176;" horiz-adv-x="768" 
+d="M765 1043q-9 -19 -29 -19h-224v-1248q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v1248h-224q-21 0 -29 19t5 35l350 384q10 10 23 10q14 0 24 -10l355 -384q13 -16 5 -35z" />
+    <glyph glyph-name="long_arrow_left" unicode="&#xf177;" horiz-adv-x="1792" 
+d="M1792 736v-192q0 -14 -9 -23t-23 -9h-1248v-224q0 -21 -19 -29t-35 5l-384 350q-10 10 -10 23q0 14 10 24l384 354q16 14 35 6q19 -9 19 -29v-224h1248q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="long_arrow_right" unicode="&#xf178;" horiz-adv-x="1792" 
+d="M1728 643q0 -14 -10 -24l-384 -354q-16 -14 -35 -6q-19 9 -19 29v224h-1248q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h1248v224q0 21 19 29t35 -5l384 -350q10 -10 10 -23z" />
+    <glyph glyph-name="apple" unicode="&#xf179;" horiz-adv-x="1408" 
+d="M1393 321q-39 -125 -123 -250q-129 -196 -257 -196q-49 0 -140 32q-86 32 -151 32q-61 0 -142 -33q-81 -34 -132 -34q-152 0 -301 259q-147 261 -147 503q0 228 113 374q113 144 284 144q72 0 177 -30q104 -30 138 -30q45 0 143 34q102 34 173 34q119 0 213 -65
+q52 -36 104 -100q-79 -67 -114 -118q-65 -94 -65 -207q0 -124 69 -223t158 -126zM1017 1494q0 -61 -29 -136q-30 -75 -93 -138q-54 -54 -108 -72q-37 -11 -104 -17q3 149 78 257q74 107 250 148q1 -3 2.5 -11t2.5 -11q0 -4 0.5 -10t0.5 -10z" />
+    <glyph glyph-name="windows" unicode="&#xf17a;" horiz-adv-x="1664" 
+d="M682 530v-651l-682 94v557h682zM682 1273v-659h-682v565zM1664 530v-786l-907 125v661h907zM1664 1408v-794h-907v669z" />
+    <glyph glyph-name="android" unicode="&#xf17b;" horiz-adv-x="1408" 
+d="M493 1053q16 0 27.5 11.5t11.5 27.5t-11.5 27.5t-27.5 11.5t-27 -11.5t-11 -27.5t11 -27.5t27 -11.5zM915 1053q16 0 27 11.5t11 27.5t-11 27.5t-27 11.5t-27.5 -11.5t-11.5 -27.5t11.5 -27.5t27.5 -11.5zM103 869q42 0 72 -30t30 -72v-430q0 -43 -29.5 -73t-72.5 -30
+t-73 30t-30 73v430q0 42 30 72t73 30zM1163 850v-666q0 -46 -32 -78t-77 -32h-75v-227q0 -43 -30 -73t-73 -30t-73 30t-30 73v227h-138v-227q0 -43 -30 -73t-73 -30q-42 0 -72 30t-30 73l-1 227h-74q-46 0 -78 32t-32 78v666h918zM931 1255q107 -55 171 -153.5t64 -215.5
+h-925q0 117 64 215.5t172 153.5l-71 131q-7 13 5 20q13 6 20 -6l72 -132q95 42 201 42t201 -42l72 132q7 12 20 6q12 -7 5 -20zM1408 767v-430q0 -43 -30 -73t-73 -30q-42 0 -72 30t-30 73v430q0 43 30 72.5t72 29.5q43 0 73 -29.5t30 -72.5z" />
+    <glyph glyph-name="linux" unicode="&#xf17c;" 
+d="M663 1125q-11 -1 -15.5 -10.5t-8.5 -9.5q-5 -1 -5 5q0 12 19 15h10zM750 1111q-4 -1 -11.5 6.5t-17.5 4.5q24 11 32 -2q3 -6 -3 -9zM399 684q-4 1 -6 -3t-4.5 -12.5t-5.5 -13.5t-10 -13q-10 -11 -1 -12q4 -1 12.5 7t12.5 18q1 3 2 7t2 6t1.5 4.5t0.5 4v3t-1 2.5t-3 2z
+M1254 325q0 18 -55 42q4 15 7.5 27.5t5 26t3 21.5t0.5 22.5t-1 19.5t-3.5 22t-4 20.5t-5 25t-5.5 26.5q-10 48 -47 103t-72 75q24 -20 57 -83q87 -162 54 -278q-11 -40 -50 -42q-31 -4 -38.5 18.5t-8 83.5t-11.5 107q-9 39 -19.5 69t-19.5 45.5t-15.5 24.5t-13 15t-7.5 7
+q-14 62 -31 103t-29.5 56t-23.5 33t-15 40q-4 21 6 53.5t4.5 49.5t-44.5 25q-15 3 -44.5 18t-35.5 16q-8 1 -11 26t8 51t36 27q37 3 51 -30t4 -58q-11 -19 -2 -26.5t30 -0.5q13 4 13 36v37q-5 30 -13.5 50t-21 30.5t-23.5 15t-27 7.5q-107 -8 -89 -134q0 -15 -1 -15
+q-9 9 -29.5 10.5t-33 -0.5t-15.5 5q1 57 -16 90t-45 34q-27 1 -41.5 -27.5t-16.5 -59.5q-1 -15 3.5 -37t13 -37.5t15.5 -13.5q10 3 16 14q4 9 -7 8q-7 0 -15.5 14.5t-9.5 33.5q-1 22 9 37t34 14q17 0 27 -21t9.5 -39t-1.5 -22q-22 -15 -31 -29q-8 -12 -27.5 -23.5
+t-20.5 -12.5q-13 -14 -15.5 -27t7.5 -18q14 -8 25 -19.5t16 -19t18.5 -13t35.5 -6.5q47 -2 102 15q2 1 23 7t34.5 10.5t29.5 13t21 17.5q9 14 20 8q5 -3 6.5 -8.5t-3 -12t-16.5 -9.5q-20 -6 -56.5 -21.5t-45.5 -19.5q-44 -19 -70 -23q-25 -5 -79 2q-10 2 -9 -2t17 -19
+q25 -23 67 -22q17 1 36 7t36 14t33.5 17.5t30 17t24.5 12t17.5 2.5t8.5 -11q0 -2 -1 -4.5t-4 -5t-6 -4.5t-8.5 -5t-9 -4.5t-10 -5t-9.5 -4.5q-28 -14 -67.5 -44t-66.5 -43t-49 -1q-21 11 -63 73q-22 31 -25 22q-1 -3 -1 -10q0 -25 -15 -56.5t-29.5 -55.5t-21 -58t11.5 -63
+q-23 -6 -62.5 -90t-47.5 -141q-2 -18 -1.5 -69t-5.5 -59q-8 -24 -29 -3q-32 31 -36 94q-2 28 4 56q4 19 -1 18q-2 -1 -4 -5q-36 -65 10 -166q5 -12 25 -28t24 -20q20 -23 104 -90.5t93 -76.5q16 -15 17.5 -38t-14 -43t-45.5 -23q8 -15 29 -44.5t28 -54t7 -70.5q46 24 7 92
+q-4 8 -10.5 16t-9.5 12t-2 6q3 5 13 9.5t20 -2.5q46 -52 166 -36q133 15 177 87q23 38 34 30q12 -6 10 -52q-1 -25 -23 -92q-9 -23 -6 -37.5t24 -15.5q3 19 14.5 77t13.5 90q2 21 -6.5 73.5t-7.5 97t23 70.5q15 18 51 18q1 37 34.5 53t72.5 10.5t60 -22.5zM626 1152
+q3 17 -2.5 30t-11.5 15q-9 2 -9 -7q2 -5 5 -6q10 0 7 -15q-3 -20 8 -20q3 0 3 3zM1045 955q-2 8 -6.5 11.5t-13 5t-14.5 5.5q-5 3 -9.5 8t-7 8t-5.5 6.5t-4 4t-4 -1.5q-14 -16 7 -43.5t39 -31.5q9 -1 14.5 8t3.5 20zM867 1168q0 11 -5 19.5t-11 12.5t-9 3q-6 0 -8 -2t0 -4
+t5 -3q14 -4 18 -31q0 -3 8 2q2 2 2 3zM921 1401q0 2 -2.5 5t-9 7t-9.5 6q-15 15 -24 15q-9 -1 -11.5 -7.5t-1 -13t-0.5 -12.5q-1 -4 -6 -10.5t-6 -9t3 -8.5q4 -3 8 0t11 9t15 9q1 1 9 1t15 2t9 7zM1486 60q20 -12 31 -24.5t12 -24t-2.5 -22.5t-15.5 -22t-23.5 -19.5
+t-30 -18.5t-31.5 -16.5t-32 -15.5t-27 -13q-38 -19 -85.5 -56t-75.5 -64q-17 -16 -68 -19.5t-89 14.5q-18 9 -29.5 23.5t-16.5 25.5t-22 19.5t-47 9.5q-44 1 -130 1q-19 0 -57 -1.5t-58 -2.5q-44 -1 -79.5 -15t-53.5 -30t-43.5 -28.5t-53.5 -11.5q-29 1 -111 31t-146 43
+q-19 4 -51 9.5t-50 9t-39.5 9.5t-33.5 14.5t-17 19.5q-10 23 7 66.5t18 54.5q1 16 -4 40t-10 42.5t-4.5 36.5t10.5 27q14 12 57 14t60 12q30 18 42 35t12 51q21 -73 -32 -106q-32 -20 -83 -15q-34 3 -43 -10q-13 -15 5 -57q2 -6 8 -18t8.5 -18t4.5 -17t1 -22q0 -15 -17 -49
+t-14 -48q3 -17 37 -26q20 -6 84.5 -18.5t99.5 -20.5q24 -6 74 -22t82.5 -23t55.5 -4q43 6 64.5 28t23 48t-7.5 58.5t-19 52t-20 36.5q-121 190 -169 242q-68 74 -113 40q-11 -9 -15 15q-3 16 -2 38q1 29 10 52t24 47t22 42q8 21 26.5 72t29.5 78t30 61t39 54
+q110 143 124 195q-12 112 -16 310q-2 90 24 151.5t106 104.5q39 21 104 21q53 1 106 -13.5t89 -41.5q57 -42 91.5 -121.5t29.5 -147.5q-5 -95 30 -214q34 -113 133 -218q55 -59 99.5 -163t59.5 -191q8 -49 5 -84.5t-12 -55.5t-20 -22q-10 -2 -23.5 -19t-27 -35.5
+t-40.5 -33.5t-61 -14q-18 1 -31.5 5t-22.5 13.5t-13.5 15.5t-11.5 20.5t-9 19.5q-22 37 -41 30t-28 -49t7 -97q20 -70 1 -195q-10 -65 18 -100.5t73 -33t85 35.5q59 49 89.5 66.5t103.5 42.5q53 18 77 36.5t18.5 34.5t-25 28.5t-51.5 23.5q-33 11 -49.5 48t-15 72.5
+t15.5 47.5q1 -31 8 -56.5t14.5 -40.5t20.5 -28.5t21 -19t21.5 -13t16.5 -9.5z" />
+    <glyph glyph-name="dribble" unicode="&#xf17d;" 
+d="M1024 36q-42 241 -140 498h-2l-2 -1q-16 -6 -43 -16.5t-101 -49t-137 -82t-131 -114.5t-103 -148l-15 11q184 -150 418 -150q132 0 256 52zM839 643q-21 49 -53 111q-311 -93 -673 -93q-1 -7 -1 -21q0 -124 44 -236.5t124 -201.5q50 89 123.5 166.5t142.5 124.5t130.5 81
+t99.5 48l37 13q4 1 13 3.5t13 4.5zM732 855q-120 213 -244 378q-138 -65 -234 -186t-128 -272q302 0 606 80zM1416 536q-210 60 -409 29q87 -239 128 -469q111 75 185 189.5t96 250.5zM611 1277q-1 0 -2 -1q1 1 2 1zM1201 1132q-185 164 -433 164q-76 0 -155 -19
+q131 -170 246 -382q69 26 130 60.5t96.5 61.5t65.5 57t37.5 40.5zM1424 647q-3 232 -149 410l-1 -1q-9 -12 -19 -24.5t-43.5 -44.5t-71 -60.5t-100 -65t-131.5 -64.5q25 -53 44 -95q2 -5 6.5 -17t7.5 -17q36 5 74.5 7t73.5 2t69 -1.5t64 -4t56.5 -5.5t48 -6.5t36.5 -6
+t25 -4.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="skype" unicode="&#xf17e;" 
+d="M1173 473q0 50 -19.5 91.5t-48.5 68.5t-73 49t-82.5 34t-87.5 23l-104 24q-30 7 -44 10.5t-35 11.5t-30 16t-16.5 21t-7.5 30q0 77 144 77q43 0 77 -12t54 -28.5t38 -33.5t40 -29t48 -12q47 0 75.5 32t28.5 77q0 55 -56 99.5t-142 67.5t-182 23q-68 0 -132 -15.5
+t-119.5 -47t-89 -87t-33.5 -128.5q0 -61 19 -106.5t56 -75.5t80 -48.5t103 -32.5l146 -36q90 -22 112 -36q32 -20 32 -60q0 -39 -40 -64.5t-105 -25.5q-51 0 -91.5 16t-65 38.5t-45.5 45t-46 38.5t-54 16q-50 0 -75.5 -30t-25.5 -75q0 -92 122 -157.5t291 -65.5
+q73 0 140 18.5t122.5 53.5t88.5 93.5t33 131.5zM1536 256q0 -159 -112.5 -271.5t-271.5 -112.5q-130 0 -234 80q-77 -16 -150 -16q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5q0 73 16 150q-80 104 -80 234q0 159 112.5 271.5t271.5 112.5q130 0 234 -80
+q77 16 150 16q143 0 273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -73 -16 -150q80 -104 80 -234z" />
+    <glyph glyph-name="foursquare" unicode="&#xf180;" horiz-adv-x="1280" 
+d="M1000 1102l37 194q5 23 -9 40t-35 17h-712q-23 0 -38.5 -17t-15.5 -37v-1101q0 -7 6 -1l291 352q23 26 38 33.5t48 7.5h239q22 0 37 14.5t18 29.5q24 130 37 191q4 21 -11.5 40t-36.5 19h-294q-29 0 -48 19t-19 48v42q0 29 19 47.5t48 18.5h346q18 0 35 13.5t20 29.5z
+M1227 1324q-15 -73 -53.5 -266.5t-69.5 -350t-35 -173.5q-6 -22 -9 -32.5t-14 -32.5t-24.5 -33t-38.5 -21t-58 -10h-271q-13 0 -22 -10q-8 -9 -426 -494q-22 -25 -58.5 -28.5t-48.5 5.5q-55 22 -55 98v1410q0 55 38 102.5t120 47.5h888q95 0 127 -53t10 -159zM1227 1324
+l-158 -790q4 17 35 173.5t69.5 350t53.5 266.5z" />
+    <glyph glyph-name="trello" unicode="&#xf181;" 
+d="M704 192v1024q0 14 -9 23t-23 9h-480q-14 0 -23 -9t-9 -23v-1024q0 -14 9 -23t23 -9h480q14 0 23 9t9 23zM1376 576v640q0 14 -9 23t-23 9h-480q-14 0 -23 -9t-9 -23v-640q0 -14 9 -23t23 -9h480q14 0 23 9t9 23zM1536 1344v-1408q0 -26 -19 -45t-45 -19h-1408
+q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="female" unicode="&#xf182;" horiz-adv-x="1280" 
+d="M1280 480q0 -40 -28 -68t-68 -28q-51 0 -80 43l-227 341h-45v-132l247 -411q9 -15 9 -33q0 -26 -19 -45t-45 -19h-192v-272q0 -46 -33 -79t-79 -33h-160q-46 0 -79 33t-33 79v272h-192q-26 0 -45 19t-19 45q0 18 9 33l247 411v132h-45l-227 -341q-29 -43 -80 -43
+q-40 0 -68 28t-28 68q0 29 16 53l256 384q73 107 176 107h384q103 0 176 -107l256 -384q16 -24 16 -53zM864 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="male" unicode="&#xf183;" horiz-adv-x="1024" 
+d="M1024 832v-416q0 -40 -28 -68t-68 -28t-68 28t-28 68v352h-64v-912q0 -46 -33 -79t-79 -33t-79 33t-33 79v464h-64v-464q0 -46 -33 -79t-79 -33t-79 33t-33 79v912h-64v-352q0 -40 -28 -68t-68 -28t-68 28t-28 68v416q0 80 56 136t136 56h640q80 0 136 -56t56 -136z
+M736 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="gittip" unicode="&#xf184;" 
+d="M773 234l350 473q16 22 24.5 59t-6 85t-61.5 79q-40 26 -83 25.5t-73.5 -17.5t-54.5 -45q-36 -40 -96 -40q-59 0 -95 40q-24 28 -54.5 45t-73.5 17.5t-84 -25.5q-46 -31 -60.5 -79t-6 -85t24.5 -59zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="sun" unicode="&#xf185;" horiz-adv-x="1792" 
+d="M1472 640q0 117 -45.5 223.5t-123 184t-184 123t-223.5 45.5t-223.5 -45.5t-184 -123t-123 -184t-45.5 -223.5t45.5 -223.5t123 -184t184 -123t223.5 -45.5t223.5 45.5t184 123t123 184t45.5 223.5zM1748 363q-4 -15 -20 -20l-292 -96v-306q0 -16 -13 -26q-15 -10 -29 -4
+l-292 94l-180 -248q-10 -13 -26 -13t-26 13l-180 248l-292 -94q-14 -6 -29 4q-13 10 -13 26v306l-292 96q-16 5 -20 20q-5 17 4 29l180 248l-180 248q-9 13 -4 29q4 15 20 20l292 96v306q0 16 13 26q15 10 29 4l292 -94l180 248q9 12 26 12t26 -12l180 -248l292 94
+q14 6 29 -4q13 -10 13 -26v-306l292 -96q16 -5 20 -20q5 -16 -4 -29l-180 -248l180 -248q9 -12 4 -29z" />
+    <glyph glyph-name="_366" unicode="&#xf186;" 
+d="M1262 233q-54 -9 -110 -9q-182 0 -337 90t-245 245t-90 337q0 192 104 357q-201 -60 -328.5 -229t-127.5 -384q0 -130 51 -248.5t136.5 -204t204 -136.5t248.5 -51q144 0 273.5 61.5t220.5 171.5zM1465 318q-94 -203 -283.5 -324.5t-413.5 -121.5q-156 0 -298 61
+t-245 164t-164 245t-61 298q0 153 57.5 292.5t156 241.5t235.5 164.5t290 68.5q44 2 61 -39q18 -41 -15 -72q-86 -78 -131.5 -181.5t-45.5 -218.5q0 -148 73 -273t198 -198t273 -73q118 0 228 51q41 18 72 -13q14 -14 17.5 -34t-4.5 -38z" />
+    <glyph glyph-name="archive" unicode="&#xf187;" horiz-adv-x="1792" 
+d="M1088 704q0 26 -19 45t-45 19h-256q-26 0 -45 -19t-19 -45t19 -45t45 -19h256q26 0 45 19t19 45zM1664 896v-960q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v960q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1728 1344v-256q0 -26 -19 -45t-45 -19h-1536
+q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1536q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="bug" unicode="&#xf188;" horiz-adv-x="1664" 
+d="M1632 576q0 -26 -19 -45t-45 -19h-224q0 -171 -67 -290l208 -209q19 -19 19 -45t-19 -45q-18 -19 -45 -19t-45 19l-198 197q-5 -5 -15 -13t-42 -28.5t-65 -36.5t-82 -29t-97 -13v896h-128v-896q-51 0 -101.5 13.5t-87 33t-66 39t-43.5 32.5l-15 14l-183 -207
+q-20 -21 -48 -21q-24 0 -43 16q-19 18 -20.5 44.5t15.5 46.5l202 227q-58 114 -58 274h-224q-26 0 -45 19t-19 45t19 45t45 19h224v294l-173 173q-19 19 -19 45t19 45t45 19t45 -19l173 -173h844l173 173q19 19 45 19t45 -19t19 -45t-19 -45l-173 -173v-294h224q26 0 45 -19
+t19 -45zM1152 1152h-640q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5z" />
+    <glyph glyph-name="vk" unicode="&#xf189;" horiz-adv-x="1920" 
+d="M1917 1016q23 -64 -150 -294q-24 -32 -65 -85q-40 -51 -55 -72t-30.5 -49.5t-12 -42t13 -34.5t32.5 -43t57 -53q4 -2 5 -4q141 -131 191 -221q3 -5 6.5 -12.5t7 -26.5t-0.5 -34t-25 -27.5t-59 -12.5l-256 -4q-24 -5 -56 5t-52 22l-20 12q-30 21 -70 64t-68.5 77.5t-61 58
+t-56.5 15.5q-3 -1 -8 -3.5t-17 -14.5t-21.5 -29.5t-17 -52t-6.5 -77.5q0 -15 -3.5 -27.5t-7.5 -18.5l-4 -5q-18 -19 -53 -22h-115q-71 -4 -146 16.5t-131.5 53t-103 66t-70.5 57.5l-25 24q-10 10 -27.5 30t-71.5 91t-106 151t-122.5 211t-130.5 272q-6 16 -6 27t3 16l4 6
+q15 19 57 19l274 2q12 -2 23 -6.5t16 -8.5l5 -3q16 -11 24 -32q20 -50 46 -103.5t41 -81.5l16 -29q29 -60 56 -104t48.5 -68.5t41.5 -38.5t34 -14t27 5q2 1 5 5t12 22t13.5 47t9.5 81t0 125q-2 40 -9 73t-14 46l-6 12q-25 34 -85 43q-13 2 5 24q16 19 38 30q53 26 239 24
+q82 -1 135 -13q20 -5 33.5 -13.5t20.5 -24t10.5 -32t3.5 -45.5t-1 -55t-2.5 -70.5t-1.5 -82.5q0 -11 -1 -42t-0.5 -48t3.5 -40.5t11.5 -39t22.5 -24.5q8 -2 17 -4t26 11t38 34.5t52 67t68 107.5q60 104 107 225q4 10 10 17.5t11 10.5l4 3l5 2.5t13 3t20 0.5l288 2
+q39 5 64 -2.5t31 -16.5z" />
+    <glyph glyph-name="weibo" unicode="&#xf18a;" horiz-adv-x="1792" 
+d="M675 252q21 34 11 69t-45 50q-34 14 -73 1t-60 -46q-22 -34 -13 -68.5t43 -50.5t74.5 -2.5t62.5 47.5zM769 373q8 13 3.5 26.5t-17.5 18.5q-14 5 -28.5 -0.5t-21.5 -18.5q-17 -31 13 -45q14 -5 29 0.5t22 18.5zM943 266q-45 -102 -158 -150t-224 -12
+q-107 34 -147.5 126.5t6.5 187.5q47 93 151.5 139t210.5 19q111 -29 158.5 -119.5t2.5 -190.5zM1255 426q-9 96 -89 170t-208.5 109t-274.5 21q-223 -23 -369.5 -141.5t-132.5 -264.5q9 -96 89 -170t208.5 -109t274.5 -21q223 23 369.5 141.5t132.5 264.5zM1563 422
+q0 -68 -37 -139.5t-109 -137t-168.5 -117.5t-226 -83t-270.5 -31t-275 33.5t-240.5 93t-171.5 151t-65 199.5q0 115 69.5 245t197.5 258q169 169 341.5 236t246.5 -7q65 -64 20 -209q-4 -14 -1 -20t10 -7t14.5 0.5t13.5 3.5l6 2q139 59 246 59t153 -61q45 -63 0 -178
+q-2 -13 -4.5 -20t4.5 -12.5t12 -7.5t17 -6q57 -18 103 -47t80 -81.5t34 -116.5zM1489 1046q42 -47 54.5 -108.5t-6.5 -117.5q-8 -23 -29.5 -34t-44.5 -4q-23 8 -34 29.5t-4 44.5q20 63 -24 111t-107 35q-24 -5 -45 8t-25 37q-5 24 8 44.5t37 25.5q60 13 119 -5.5t101 -65.5z
+M1670 1209q87 -96 112.5 -222.5t-13.5 -241.5q-9 -27 -34 -40t-52 -4t-40 34t-5 52q28 82 10 172t-80 158q-62 69 -148 95.5t-173 8.5q-28 -6 -52 9.5t-30 43.5t9.5 51.5t43.5 29.5q123 26 244 -11.5t208 -134.5z" />
+    <glyph glyph-name="renren" unicode="&#xf18b;" 
+d="M1133 -34q-171 -94 -368 -94q-196 0 -367 94q138 87 235.5 211t131.5 268q35 -144 132.5 -268t235.5 -211zM638 1394v-485q0 -252 -126.5 -459.5t-330.5 -306.5q-181 215 -181 495q0 187 83.5 349.5t229.5 269.5t325 137zM1536 638q0 -280 -181 -495
+q-204 99 -330.5 306.5t-126.5 459.5v485q179 -30 325 -137t229.5 -269.5t83.5 -349.5z" />
+    <glyph glyph-name="_372" unicode="&#xf18c;" horiz-adv-x="1408" 
+d="M1402 433q-32 -80 -76 -138t-91 -88.5t-99 -46.5t-101.5 -14.5t-96.5 8.5t-86.5 22t-69.5 27.5t-46 22.5l-17 10q-113 -228 -289.5 -359.5t-384.5 -132.5q-19 0 -32 13t-13 32t13 31.5t32 12.5q173 1 322.5 107.5t251.5 294.5q-36 -14 -72 -23t-83 -13t-91 2.5t-93 28.5
+t-92 59t-84.5 100t-74.5 146q114 47 214 57t167.5 -7.5t124.5 -56.5t88.5 -77t56.5 -82q53 131 79 291q-7 -1 -18 -2.5t-46.5 -2.5t-69.5 0.5t-81.5 10t-88.5 23t-84 42.5t-75 65t-54.5 94.5t-28.5 127.5q70 28 133.5 36.5t112.5 -1t92 -30t73.5 -50t56 -61t42 -63t27.5 -56
+t16 -39.5l4 -16q12 122 12 195q-8 6 -21.5 16t-49 44.5t-63.5 71.5t-54 93t-33 112.5t12 127t70 138.5q73 -25 127.5 -61.5t84.5 -76.5t48 -85t20.5 -89t-0.5 -85.5t-13 -76.5t-19 -62t-17 -42l-7 -15q1 -4 1 -50t-1 -72q3 7 10 18.5t30.5 43t50.5 58t71 55.5t91.5 44.5
+t112 14.5t132.5 -24q-2 -78 -21.5 -141.5t-50 -104.5t-69.5 -71.5t-81.5 -45.5t-84.5 -24t-80 -9.5t-67.5 1t-46.5 4.5l-17 3q-23 -147 -73 -283q6 7 18 18.5t49.5 41t77.5 52.5t99.5 42t117.5 20t129 -23.5t137 -77.5z" />
+    <glyph glyph-name="stack_exchange" unicode="&#xf18d;" horiz-adv-x="1280" 
+d="M1259 283v-66q0 -85 -57.5 -144.5t-138.5 -59.5h-57l-260 -269v269h-529q-81 0 -138.5 59.5t-57.5 144.5v66h1238zM1259 609v-255h-1238v255h1238zM1259 937v-255h-1238v255h1238zM1259 1077v-67h-1238v67q0 84 57.5 143.5t138.5 59.5h846q81 0 138.5 -59.5t57.5 -143.5z
+" />
+    <glyph glyph-name="_374" unicode="&#xf18e;" 
+d="M1152 640q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v192h-352q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h352v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198
+t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="arrow_circle_alt_left" unicode="&#xf190;" 
+d="M1152 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-352v-192q0 -14 -9 -23t-23 -9q-12 0 -24 10l-319 319q-9 9 -9 23t9 23l320 320q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5v-192h352q13 0 22.5 -9.5t9.5 -22.5zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198
+t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_376" unicode="&#xf191;" 
+d="M1024 960v-640q0 -26 -19 -45t-45 -19q-20 0 -37 12l-448 320q-27 19 -27 52t27 52l448 320q17 12 37 12q26 0 45 -19t19 -45zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5z
+M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="dot_circle_alt" unicode="&#xf192;" 
+d="M1024 640q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5
+t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_378" unicode="&#xf193;" horiz-adv-x="1664" 
+d="M1023 349l102 -204q-58 -179 -210 -290t-339 -111q-156 0 -288.5 77.5t-210 210t-77.5 288.5q0 181 104.5 330t274.5 211l17 -131q-122 -54 -195 -165.5t-73 -244.5q0 -185 131.5 -316.5t316.5 -131.5q126 0 232.5 65t165 175.5t49.5 236.5zM1571 249l58 -114l-256 -128
+q-13 -7 -29 -7q-40 0 -57 35l-239 477h-472q-24 0 -42.5 16.5t-21.5 40.5l-96 779q-2 17 6 42q14 51 57 82.5t97 31.5q66 0 113 -47t47 -113q0 -69 -52 -117.5t-120 -41.5l37 -289h423v-128h-407l16 -128h455q40 0 57 -35l228 -455z" />
+    <glyph glyph-name="vimeo_square" unicode="&#xf194;" 
+d="M1292 898q10 216 -161 222q-231 8 -312 -261q44 19 82 19q85 0 74 -96q-4 -57 -74 -167t-105 -110q-43 0 -82 169q-13 54 -45 255q-30 189 -160 177q-59 -7 -164 -100l-81 -72l-81 -72l52 -67q76 52 87 52q57 0 107 -179q15 -55 45 -164.5t45 -164.5q68 -179 164 -179
+q157 0 383 294q220 283 226 444zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_380" unicode="&#xf195;" horiz-adv-x="1152" 
+d="M1152 704q0 -191 -94.5 -353t-256.5 -256.5t-353 -94.5h-160q-14 0 -23 9t-9 23v611l-215 -66q-3 -1 -9 -1q-10 0 -19 6q-13 10 -13 26v128q0 23 23 31l233 71v93l-215 -66q-3 -1 -9 -1q-10 0 -19 6q-13 10 -13 26v128q0 23 23 31l233 71v250q0 14 9 23t23 9h160
+q14 0 23 -9t9 -23v-181l375 116q15 5 28 -5t13 -26v-128q0 -23 -23 -31l-393 -121v-93l375 116q15 5 28 -5t13 -26v-128q0 -23 -23 -31l-393 -121v-487q188 13 318 151t130 328q0 14 9 23t23 9h160q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="plus_square_o" unicode="&#xf196;" horiz-adv-x="1408" 
+d="M1152 736v-64q0 -14 -9 -23t-23 -9h-352v-352q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v352h-352q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h352v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-352h352q14 0 23 -9t9 -23zM1280 288v832q0 66 -47 113t-113 47h-832
+q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113zM1408 1120v-832q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_382" unicode="&#xf197;" horiz-adv-x="2176" 
+d="M620 416q-110 -64 -268 -64h-128v64h-64q-13 0 -22.5 23.5t-9.5 56.5q0 24 7 49q-58 2 -96.5 10.5t-38.5 20.5t38.5 20.5t96.5 10.5q-7 25 -7 49q0 33 9.5 56.5t22.5 23.5h64v64h128q158 0 268 -64h1113q42 -7 106.5 -18t80.5 -14q89 -15 150 -40.5t83.5 -47.5t22.5 -40
+t-22.5 -40t-83.5 -47.5t-150 -40.5q-16 -3 -80.5 -14t-106.5 -18h-1113zM1739 668q53 -36 53 -92t-53 -92l81 -30q68 48 68 122t-68 122zM625 400h1015q-217 -38 -456 -80q-57 0 -113 -24t-83 -48l-28 -24l-288 -288q-26 -26 -70.5 -45t-89.5 -19h-96l-93 464h29
+q157 0 273 64zM352 816h-29l93 464h96q46 0 90 -19t70 -45l288 -288q4 -4 11 -10.5t30.5 -23t48.5 -29t61.5 -23t72.5 -10.5l456 -80h-1015q-116 64 -273 64z" />
+    <glyph glyph-name="_383" unicode="&#xf198;" horiz-adv-x="1664" 
+d="M1519 760q62 0 103.5 -40.5t41.5 -101.5q0 -97 -93 -130l-172 -59l56 -167q7 -21 7 -47q0 -59 -42 -102t-101 -43q-47 0 -85.5 27t-53.5 72l-55 165l-310 -106l55 -164q8 -24 8 -47q0 -59 -42 -102t-102 -43q-47 0 -85 27t-53 72l-55 163l-153 -53q-29 -9 -50 -9
+q-61 0 -101.5 40t-40.5 101q0 47 27.5 85t71.5 53l156 53l-105 313l-156 -54q-26 -8 -48 -8q-60 0 -101 40.5t-41 100.5q0 47 27.5 85t71.5 53l157 53l-53 159q-8 24 -8 47q0 60 42 102.5t102 42.5q47 0 85 -27t53 -72l54 -160l310 105l-54 160q-8 24 -8 47q0 59 42.5 102
+t101.5 43q47 0 85.5 -27.5t53.5 -71.5l53 -161l162 55q21 6 43 6q60 0 102.5 -39.5t42.5 -98.5q0 -45 -30 -81.5t-74 -51.5l-157 -54l105 -316l164 56q24 8 46 8zM725 498l310 105l-105 315l-310 -107z" />
+    <glyph glyph-name="_384" unicode="&#xf199;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM1280 352v436q-31 -35 -64 -55q-34 -22 -132.5 -85t-151.5 -99q-98 -69 -164 -69v0v0q-66 0 -164 69
+q-47 32 -142 92.5t-142 92.5q-12 8 -33 27t-31 27v-436q0 -40 28 -68t68 -28h832q40 0 68 28t28 68zM1280 925q0 41 -27.5 70t-68.5 29h-832q-40 0 -68 -28t-28 -68q0 -37 30.5 -76.5t67.5 -64.5q47 -32 137.5 -89t129.5 -83q3 -2 17 -11.5t21 -14t21 -13t23.5 -13
+t21.5 -9.5t22.5 -7.5t20.5 -2.5t20.5 2.5t22.5 7.5t21.5 9.5t23.5 13t21 13t21 14t17 11.5l267 174q35 23 66.5 62.5t31.5 73.5z" />
+    <glyph glyph-name="_385" unicode="&#xf19a;" horiz-adv-x="1792" 
+d="M127 640q0 163 67 313l367 -1005q-196 95 -315 281t-119 411zM1415 679q0 -19 -2.5 -38.5t-10 -49.5t-11.5 -44t-17.5 -59t-17.5 -58l-76 -256l-278 826q46 3 88 8q19 2 26 18.5t-2.5 31t-28.5 13.5l-205 -10q-75 1 -202 10q-12 1 -20.5 -5t-11.5 -15t-1.5 -18.5t9 -16.5
+t19.5 -8l80 -8l120 -328l-168 -504l-280 832q46 3 88 8q19 2 26 18.5t-2.5 31t-28.5 13.5l-205 -10q-7 0 -23 0.5t-26 0.5q105 160 274.5 253.5t367.5 93.5q147 0 280.5 -53t238.5 -149h-10q-55 0 -92 -40.5t-37 -95.5q0 -12 2 -24t4 -21.5t8 -23t9 -21t12 -22.5t12.5 -21
+t14.5 -24t14 -23q63 -107 63 -212zM909 573l237 -647q1 -6 5 -11q-126 -44 -255 -44q-112 0 -217 32zM1570 1009q95 -174 95 -369q0 -209 -104 -385.5t-279 -278.5l235 678q59 169 59 276q0 42 -6 79zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286
+t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM896 -215q173 0 331.5 68t273 182.5t182.5 273t68 331.5t-68 331.5t-182.5 273t-273 182.5t-331.5 68t-331.5 -68t-273 -182.5t-182.5 -273t-68 -331.5t68 -331.5t182.5 -273
+t273 -182.5t331.5 -68z" />
+    <glyph glyph-name="_386" unicode="&#xf19b;" horiz-adv-x="1792" 
+d="M1086 1536v-1536l-272 -128q-228 20 -414 102t-293 208.5t-107 272.5q0 140 100.5 263.5t275 205.5t391.5 108v-172q-217 -38 -356.5 -150t-139.5 -255q0 -152 154.5 -267t388.5 -145v1360zM1755 954l37 -390l-525 114l147 83q-119 70 -280 99v172q277 -33 481 -157z" />
+    <glyph glyph-name="_387" unicode="&#xf19c;" horiz-adv-x="2048" 
+d="M960 1536l960 -384v-128h-128q0 -26 -20.5 -45t-48.5 -19h-1526q-28 0 -48.5 19t-20.5 45h-128v128zM256 896h256v-768h128v768h256v-768h128v768h256v-768h128v768h256v-768h59q28 0 48.5 -19t20.5 -45v-64h-1664v64q0 26 20.5 45t48.5 19h59v768zM1851 -64
+q28 0 48.5 -19t20.5 -45v-128h-1920v128q0 26 20.5 45t48.5 19h1782z" />
+    <glyph glyph-name="_388" unicode="&#xf19d;" horiz-adv-x="2304" 
+d="M1774 700l18 -316q4 -69 -82 -128t-235 -93.5t-323 -34.5t-323 34.5t-235 93.5t-82 128l18 316l574 -181q22 -7 48 -7t48 7zM2304 1024q0 -23 -22 -31l-1120 -352q-4 -1 -10 -1t-10 1l-652 206q-43 -34 -71 -111.5t-34 -178.5q63 -36 63 -109q0 -69 -58 -107l58 -433
+q2 -14 -8 -25q-9 -11 -24 -11h-192q-15 0 -24 11q-10 11 -8 25l58 433q-58 38 -58 107q0 73 65 111q11 207 98 330l-333 104q-22 8 -22 31t22 31l1120 352q4 1 10 1t10 -1l1120 -352q22 -8 22 -31z" />
+    <glyph glyph-name="_389" unicode="&#xf19e;" 
+d="M859 579l13 -707q-62 11 -105 11q-41 0 -105 -11l13 707q-40 69 -168.5 295.5t-216.5 374.5t-181 287q58 -15 108 -15q44 0 111 15q63 -111 133.5 -229.5t167 -276.5t138.5 -227q37 61 109.5 177.5t117.5 190t105 176t107 189.5q54 -14 107 -14q56 0 114 14v0
+q-28 -39 -60 -88.5t-49.5 -78.5t-56.5 -96t-49 -84q-146 -248 -353 -610z" />
+    <glyph glyph-name="uniF1A0" unicode="&#xf1a0;" 
+d="M768 750h725q12 -67 12 -128q0 -217 -91 -387.5t-259.5 -266.5t-386.5 -96q-157 0 -299 60.5t-245 163.5t-163.5 245t-60.5 299t60.5 299t163.5 245t245 163.5t299 60.5q300 0 515 -201l-209 -201q-123 119 -306 119q-129 0 -238.5 -65t-173.5 -176.5t-64 -243.5
+t64 -243.5t173.5 -176.5t238.5 -65q87 0 160 24t120 60t82 82t51.5 87t22.5 78h-436v264z" />
+    <glyph glyph-name="f1a1" unicode="&#xf1a1;" horiz-adv-x="1792" 
+d="M1095 369q16 -16 0 -31q-62 -62 -199 -62t-199 62q-16 15 0 31q6 6 15 6t15 -6q48 -49 169 -49q120 0 169 49q6 6 15 6t15 -6zM788 550q0 -37 -26 -63t-63 -26t-63.5 26t-26.5 63q0 38 26.5 64t63.5 26t63 -26.5t26 -63.5zM1183 550q0 -37 -26.5 -63t-63.5 -26t-63 26
+t-26 63t26 63.5t63 26.5t63.5 -26t26.5 -64zM1434 670q0 49 -35 84t-85 35t-86 -36q-130 90 -311 96l63 283l200 -45q0 -37 26 -63t63 -26t63.5 26.5t26.5 63.5t-26.5 63.5t-63.5 26.5q-54 0 -80 -50l-221 49q-19 5 -25 -16l-69 -312q-180 -7 -309 -97q-35 37 -87 37
+q-50 0 -85 -35t-35 -84q0 -35 18.5 -64t49.5 -44q-6 -27 -6 -56q0 -142 140 -243t337 -101q198 0 338 101t140 243q0 32 -7 57q30 15 48 43.5t18 63.5zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191
+t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_392" unicode="&#xf1a2;" 
+d="M939 407q13 -13 0 -26q-53 -53 -171 -53t-171 53q-13 13 0 26q5 6 13 6t13 -6q42 -42 145 -42t145 42q5 6 13 6t13 -6zM676 563q0 -31 -23 -54t-54 -23t-54 23t-23 54q0 32 22.5 54.5t54.5 22.5t54.5 -22.5t22.5 -54.5zM1014 563q0 -31 -23 -54t-54 -23t-54 23t-23 54
+q0 32 22.5 54.5t54.5 22.5t54.5 -22.5t22.5 -54.5zM1229 666q0 42 -30 72t-73 30q-42 0 -73 -31q-113 78 -267 82l54 243l171 -39q1 -32 23.5 -54t53.5 -22q32 0 54.5 22.5t22.5 54.5t-22.5 54.5t-54.5 22.5q-48 0 -69 -43l-189 42q-17 5 -21 -13l-60 -268q-154 -6 -265 -83
+q-30 32 -74 32q-43 0 -73 -30t-30 -72q0 -30 16 -55t42 -38q-5 -25 -5 -48q0 -122 120 -208.5t289 -86.5q170 0 290 86.5t120 208.5q0 25 -6 49q25 13 40.5 37.5t15.5 54.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_393" unicode="&#xf1a3;" 
+d="M866 697l90 27v62q0 79 -58 135t-138 56t-138 -55.5t-58 -134.5v-283q0 -20 -14 -33.5t-33 -13.5t-32.5 13.5t-13.5 33.5v120h-151v-122q0 -82 57.5 -139t139.5 -57q81 0 138.5 56.5t57.5 136.5v280q0 19 13.5 33t33.5 14q19 0 32.5 -14t13.5 -33v-54zM1199 502v122h-150
+v-126q0 -20 -13.5 -33.5t-33.5 -13.5q-19 0 -32.5 14t-13.5 33v123l-90 -26l-60 28v-123q0 -80 58 -137t139 -57t138.5 57t57.5 139zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103
+t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="f1a4" unicode="&#xf1a4;" horiz-adv-x="1920" 
+d="M1062 824v118q0 42 -30 72t-72 30t-72 -30t-30 -72v-612q0 -175 -126 -299t-303 -124q-178 0 -303.5 125.5t-125.5 303.5v266h328v-262q0 -43 30 -72.5t72 -29.5t72 29.5t30 72.5v620q0 171 126.5 292t301.5 121q176 0 302 -122t126 -294v-136l-195 -58zM1592 602h328
+v-266q0 -178 -125.5 -303.5t-303.5 -125.5q-177 0 -303 124.5t-126 300.5v268l131 -61l195 58v-270q0 -42 30 -71.5t72 -29.5t72 29.5t30 71.5v275z" />
+    <glyph glyph-name="_395" unicode="&#xf1a5;" 
+d="M1472 160v480h-704v704h-480q-93 0 -158.5 -65.5t-65.5 -158.5v-480h704v-704h480q93 0 158.5 65.5t65.5 158.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="_396" unicode="&#xf1a6;" horiz-adv-x="2048" 
+d="M328 1254h204v-983h-532v697h328v286zM328 435v369h-123v-369h123zM614 968v-697h205v697h-205zM614 1254v-204h205v204h-205zM901 968h533v-942h-533v163h328v82h-328v697zM1229 435v369h-123v-369h123zM1516 968h532v-942h-532v163h327v82h-327v697zM1843 435v369h-123
+v-369h123z" />
+    <glyph glyph-name="_397" unicode="&#xf1a7;" 
+d="M1046 516q0 -64 -38 -109t-91 -45q-43 0 -70 15v277q28 17 70 17q53 0 91 -45.5t38 -109.5zM703 944q0 -64 -38 -109.5t-91 -45.5q-43 0 -70 15v277q28 17 70 17q53 0 91 -45t38 -109zM1265 513q0 134 -88 229t-213 95q-20 0 -39 -3q-23 -78 -78 -136q-87 -95 -211 -101
+v-636l211 41v206q51 -19 117 -19q125 0 213 95t88 229zM922 940q0 134 -88.5 229t-213.5 95q-74 0 -141 -36h-186v-840l211 41v206q55 -19 116 -19q125 0 213.5 95t88.5 229zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_398" unicode="&#xf1a8;" horiz-adv-x="2038" 
+d="M1222 607q75 3 143.5 -20.5t118 -58.5t101 -94.5t84 -108t75.5 -120.5q33 -56 78.5 -109t75.5 -80.5t99 -88.5q-48 -30 -108.5 -57.5t-138.5 -59t-114 -47.5q-44 37 -74 115t-43.5 164.5t-33 180.5t-42.5 168.5t-72.5 123t-122.5 48.5l-10 -2l-6 -4q4 -5 13 -14
+q6 -5 28 -23.5t25.5 -22t19 -18t18 -20.5t11.5 -21t10.5 -27.5t4.5 -31t4 -40.5l1 -33q1 -26 -2.5 -57.5t-7.5 -52t-12.5 -58.5t-11.5 -53q-35 1 -101 -9.5t-98 -10.5q-39 0 -72 10q-2 16 -2 47q0 74 3 96q2 13 31.5 41.5t57 59t26.5 51.5q-24 2 -43 -24
+q-36 -53 -111.5 -99.5t-136.5 -46.5q-25 0 -75.5 63t-106.5 139.5t-84 96.5q-6 4 -27 30q-482 -112 -513 -112q-16 0 -28 11t-12 27q0 15 8.5 26.5t22.5 14.5l486 106q-8 14 -8 25t5.5 17.5t16 11.5t20 7t23 4.5t18.5 4.5q4 1 15.5 7.5t17.5 6.5q15 0 28 -16t20 -33
+q163 37 172 37q17 0 29.5 -11t12.5 -28q0 -15 -8.5 -26t-23.5 -14l-182 -40l-1 -16q-1 -26 81.5 -117.5t104.5 -91.5q47 0 119 80t72 129q0 36 -23.5 53t-51 18.5t-51 11.5t-23.5 34q0 16 10 34l-68 19q43 44 43 117q0 26 -5 58q82 16 144 16q44 0 71.5 -1.5t48.5 -8.5
+t31 -13.5t20.5 -24.5t15.5 -33.5t17 -47.5t24 -60l50 25q-3 -40 -23 -60t-42.5 -21t-40 -6.5t-16.5 -20.5zM1282 842q-5 5 -13.5 15.5t-12 14.5t-10.5 11.5t-10 10.5l-8 8t-8.5 7.5t-8 5t-8.5 4.5q-7 3 -14.5 5t-20.5 2.5t-22 0.5h-32.5h-37.5q-126 0 -217 -43
+q16 30 36 46.5t54 29.5t65.5 36t46 36.5t50 55t43.5 50.5q12 -9 28 -31.5t32 -36.5t38 -13l12 1v-76l22 -1q247 95 371 190q28 21 50 39t42.5 37.5t33 31t29.5 34t24 31t24.5 37t23 38t27 47.5t29.5 53l7 9q-2 -53 -43 -139q-79 -165 -205 -264t-306 -142q-14 -3 -42 -7.5
+t-50 -9.5t-39 -14q3 -19 24.5 -46t21.5 -34q0 -11 -26 -30zM1061 -79q39 26 131.5 47.5t146.5 21.5q9 0 22.5 -15.5t28 -42.5t26 -50t24 -51t14.5 -33q-121 -45 -244 -45q-61 0 -125 11zM822 568l48 12l109 -177l-73 -48zM1323 51q3 -15 3 -16q0 -7 -17.5 -14.5t-46 -13
+t-54 -9.5t-53.5 -7.5t-32 -4.5l-7 43q21 2 60.5 8.5t72 10t60.5 3.5h14zM866 679l-96 -20l-6 17q10 1 32.5 7t34.5 6q19 0 35 -10zM1061 45h31l10 -83l-41 -12v95zM1950 1535v1v-1zM1950 1535l-1 -5l-2 -2l1 3zM1950 1535l1 1z" />
+    <glyph glyph-name="_399" unicode="&#xf1a9;" 
+d="M1167 -50q-5 19 -24 5q-30 -22 -87 -39t-131 -17q-129 0 -193 49q-5 4 -13 4q-11 0 -26 -12q-7 -6 -7.5 -16t7.5 -20q34 -32 87.5 -46t102.5 -12.5t99 4.5q41 4 84.5 20.5t65 30t28.5 20.5q12 12 7 29zM1128 65q-19 47 -39 61q-23 15 -76 15q-47 0 -71 -10
+q-29 -12 -78 -56q-26 -24 -12 -44q9 -8 17.5 -4.5t31.5 23.5q3 2 10.5 8.5t10.5 8.5t10 7t11.5 7t12.5 5t15 4.5t16.5 2.5t20.5 1q27 0 44.5 -7.5t23 -14.5t13.5 -22q10 -17 12.5 -20t12.5 1q23 12 14 34zM1483 346q0 22 -5 44.5t-16.5 45t-34 36.5t-52.5 14
+q-33 0 -97 -41.5t-129 -83.5t-101 -42q-27 -1 -63.5 19t-76 49t-83.5 58t-100 49t-111 19q-115 -1 -197 -78.5t-84 -178.5q-2 -112 74 -164q29 -20 62.5 -28.5t103.5 -8.5q57 0 132 32.5t134 71t120 70.5t93 31q26 -1 65 -31.5t71.5 -67t68 -67.5t55.5 -32q35 -3 58.5 14
+t55.5 63q28 41 42.5 101t14.5 106zM1536 506q0 -164 -62 -304.5t-166 -236t-242.5 -149.5t-290.5 -54t-293 57.5t-247.5 157t-170.5 241.5t-64 302q0 89 19.5 172.5t49 145.5t70.5 118.5t78.5 94t78.5 69.5t64.5 46.5t42.5 24.5q14 8 51 26.5t54.5 28.5t48 30t60.5 44
+q36 28 58 72.5t30 125.5q129 -155 186 -193q44 -29 130 -68t129 -66q21 -13 39 -25t60.5 -46.5t76 -70.5t75 -95t69 -122t47 -148.5t19.5 -177.5z" />
+    <glyph glyph-name="_400" unicode="&#xf1aa;" 
+d="M1070 463l-160 -160l-151 -152l-30 -30q-65 -64 -151.5 -87t-171.5 -2q-16 -70 -72 -115t-129 -45q-85 0 -145 60.5t-60 145.5q0 72 44.5 128t113.5 72q-22 86 1 173t88 152l12 12l151 -152l-11 -11q-37 -37 -37 -89t37 -90q37 -37 89 -37t89 37l30 30l151 152l161 160z
+M729 1145l12 -12l-152 -152l-12 12q-37 37 -89 37t-89 -37t-37 -89.5t37 -89.5l29 -29l152 -152l160 -160l-151 -152l-161 160l-151 152l-30 30q-68 67 -90 159.5t5 179.5q-70 15 -115 71t-45 129q0 85 60 145.5t145 60.5q76 0 133.5 -49t69.5 -123q84 20 169.5 -3.5
+t149.5 -87.5zM1536 78q0 -85 -60 -145.5t-145 -60.5q-74 0 -131 47t-71 118q-86 -28 -179.5 -6t-161.5 90l-11 12l151 152l12 -12q37 -37 89 -37t89 37t37 89t-37 89l-30 30l-152 152l-160 160l152 152l160 -160l152 -152l29 -30q64 -64 87.5 -150.5t2.5 -171.5
+q76 -11 126.5 -68.5t50.5 -134.5zM1534 1202q0 -77 -51 -135t-127 -69q26 -85 3 -176.5t-90 -158.5l-12 -12l-151 152l12 12q37 37 37 89t-37 89t-89 37t-89 -37l-30 -30l-152 -152l-160 -160l-152 152l161 160l152 152l29 30q67 67 159 89.5t178 -3.5q11 75 68.5 126
+t135.5 51q85 0 145 -60.5t60 -145.5z" />
+    <glyph glyph-name="f1ab" unicode="&#xf1ab;" 
+d="M654 458q-1 -3 -12.5 0.5t-31.5 11.5l-20 9q-44 20 -87 49q-7 5 -41 31.5t-38 28.5q-67 -103 -134 -181q-81 -95 -105 -110q-4 -2 -19.5 -4t-18.5 0q6 4 82 92q21 24 85.5 115t78.5 118q17 30 51 98.5t36 77.5q-8 1 -110 -33q-8 -2 -27.5 -7.5t-34.5 -9.5t-17 -5
+q-2 -2 -2 -10.5t-1 -9.5q-5 -10 -31 -15q-23 -7 -47 0q-18 4 -28 21q-4 6 -5 23q6 2 24.5 5t29.5 6q58 16 105 32q100 35 102 35q10 2 43 19.5t44 21.5q9 3 21.5 8t14.5 5.5t6 -0.5q2 -12 -1 -33q0 -2 -12.5 -27t-26.5 -53.5t-17 -33.5q-25 -50 -77 -131l64 -28
+q12 -6 74.5 -32t67.5 -28q4 -1 10.5 -25.5t4.5 -30.5zM449 944q3 -15 -4 -28q-12 -23 -50 -38q-30 -12 -60 -12q-26 3 -49 26q-14 15 -18 41l1 3q3 -3 19.5 -5t26.5 0t58 16q36 12 55 14q17 0 21 -17zM1147 815l63 -227l-139 42zM39 15l694 232v1032l-694 -233v-1031z
+M1280 332l102 -31l-181 657l-100 31l-216 -536l102 -31l45 110l211 -65zM777 1294l573 -184v380zM1088 -29l158 -13l-54 -160l-40 66q-130 -83 -276 -108q-58 -12 -91 -12h-84q-79 0 -199.5 39t-183.5 85q-8 7 -8 16q0 8 5 13.5t13 5.5q4 0 18 -7.5t30.5 -16.5t20.5 -11
+q73 -37 159.5 -61.5t157.5 -24.5q95 0 167 14.5t157 50.5q15 7 30.5 15.5t34 19t28.5 16.5zM1536 1050v-1079l-774 246q-14 -6 -375 -127.5t-368 -121.5q-13 0 -18 13q0 1 -1 3v1078q3 9 4 10q5 6 20 11q107 36 149 50v384l558 -198q2 0 160.5 55t316 108.5t161.5 53.5
+q20 0 20 -21v-418z" />
+    <glyph glyph-name="_402" unicode="&#xf1ac;" horiz-adv-x="1792" 
+d="M288 1152q66 0 113 -47t47 -113v-1088q0 -66 -47 -113t-113 -47h-128q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h128zM1664 989q58 -34 93 -93t35 -128v-768q0 -106 -75 -181t-181 -75h-864q-66 0 -113 47t-47 113v1536q0 40 28 68t68 28h672q40 0 88 -20t76 -48
+l152 -152q28 -28 48 -76t20 -88v-163zM928 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM928 256v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM928 512v128q0 14 -9 23
+t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1184 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1184 256v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128
+q14 0 23 9t9 23zM1184 512v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 256v128q0 14 -9 23t-23 9h-128
+q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 512v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1536 896v256h-160q-40 0 -68 28t-28 68v160h-640v-512h896z" />
+    <glyph glyph-name="_403" unicode="&#xf1ad;" 
+d="M1344 1536q26 0 45 -19t19 -45v-1664q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h1280zM512 1248v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 992v-64q0 -14 9 -23t23 -9h64q14 0 23 9
+t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 736v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 480v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM384 160v64
+q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64
+q14 0 23 9t9 23zM384 928v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 -96v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9
+t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM896 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 928v64
+q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 160v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64
+q14 0 23 9t9 23zM1152 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 928v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9
+t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23z" />
+    <glyph glyph-name="_404" unicode="&#xf1ae;" horiz-adv-x="1280" 
+d="M1188 988l-292 -292v-824q0 -46 -33 -79t-79 -33t-79 33t-33 79v384h-64v-384q0 -46 -33 -79t-79 -33t-79 33t-33 79v824l-292 292q-28 28 -28 68t28 68q29 28 68.5 28t67.5 -28l228 -228h368l228 228q28 28 68 28t68 -28q28 -29 28 -68.5t-28 -67.5zM864 1152
+q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="uniF1B1" unicode="&#xf1b0;" horiz-adv-x="1664" 
+d="M780 1064q0 -60 -19 -113.5t-63 -92.5t-105 -39q-76 0 -138 57.5t-92 135.5t-30 151q0 60 19 113.5t63 92.5t105 39q77 0 138.5 -57.5t91.5 -135t30 -151.5zM438 581q0 -80 -42 -139t-119 -59q-76 0 -141.5 55.5t-100.5 133.5t-35 152q0 80 42 139.5t119 59.5
+q76 0 141.5 -55.5t100.5 -134t35 -152.5zM832 608q118 0 255 -97.5t229 -237t92 -254.5q0 -46 -17 -76.5t-48.5 -45t-64.5 -20t-76 -5.5q-68 0 -187.5 45t-182.5 45q-66 0 -192.5 -44.5t-200.5 -44.5q-183 0 -183 146q0 86 56 191.5t139.5 192.5t187.5 146t193 59zM1071 819
+q-61 0 -105 39t-63 92.5t-19 113.5q0 74 30 151.5t91.5 135t138.5 57.5q61 0 105 -39t63 -92.5t19 -113.5q0 -73 -30 -151t-92 -135.5t-138 -57.5zM1503 923q77 0 119 -59.5t42 -139.5q0 -74 -35 -152t-100.5 -133.5t-141.5 -55.5q-77 0 -119 59t-42 139q0 74 35 152.5
+t100.5 134t141.5 55.5z" />
+    <glyph glyph-name="_406" unicode="&#xf1b1;" horiz-adv-x="768" 
+d="M704 1008q0 -145 -57 -243.5t-152 -135.5l45 -821q2 -26 -16 -45t-44 -19h-192q-26 0 -44 19t-16 45l45 821q-95 37 -152 135.5t-57 243.5q0 128 42.5 249.5t117.5 200t160 78.5t160 -78.5t117.5 -200t42.5 -249.5z" />
+    <glyph glyph-name="_407" unicode="&#xf1b2;" horiz-adv-x="1792" 
+d="M896 -93l640 349v636l-640 -233v-752zM832 772l698 254l-698 254l-698 -254zM1664 1024v-768q0 -35 -18 -65t-49 -47l-704 -384q-28 -16 -61 -16t-61 16l-704 384q-31 17 -49 47t-18 65v768q0 40 23 73t61 47l704 256q22 8 44 8t44 -8l704 -256q38 -14 61 -47t23 -73z
+" />
+    <glyph glyph-name="_408" unicode="&#xf1b3;" horiz-adv-x="2304" 
+d="M640 -96l384 192v314l-384 -164v-342zM576 358l404 173l-404 173l-404 -173zM1664 -96l384 192v314l-384 -164v-342zM1600 358l404 173l-404 173l-404 -173zM1152 651l384 165v266l-384 -164v-267zM1088 1030l441 189l-441 189l-441 -189zM2176 512v-416q0 -36 -19 -67
+t-52 -47l-448 -224q-25 -14 -57 -14t-57 14l-448 224q-4 2 -7 4q-2 -2 -7 -4l-448 -224q-25 -14 -57 -14t-57 14l-448 224q-33 16 -52 47t-19 67v416q0 38 21.5 70t56.5 48l434 186v400q0 38 21.5 70t56.5 48l448 192q23 10 50 10t50 -10l448 -192q35 -16 56.5 -48t21.5 -70
+v-400l434 -186q36 -16 57 -48t21 -70z" />
+    <glyph glyph-name="_409" unicode="&#xf1b4;" horiz-adv-x="2048" 
+d="M1848 1197h-511v-124h511v124zM1596 771q-90 0 -146 -52.5t-62 -142.5h408q-18 195 -200 195zM1612 186q63 0 122 32t76 87h221q-100 -307 -427 -307q-214 0 -340.5 132t-126.5 347q0 208 130.5 345.5t336.5 137.5q138 0 240.5 -68t153 -179t50.5 -248q0 -17 -2 -47h-658
+q0 -111 57.5 -171.5t166.5 -60.5zM277 236h296q205 0 205 167q0 180 -199 180h-302v-347zM277 773h281q78 0 123.5 36.5t45.5 113.5q0 144 -190 144h-260v-294zM0 1282h594q87 0 155 -14t126.5 -47.5t90 -96.5t31.5 -154q0 -181 -172 -263q114 -32 172 -115t58 -204
+q0 -75 -24.5 -136.5t-66 -103.5t-98.5 -71t-121 -42t-134 -13h-611v1260z" />
+    <glyph glyph-name="_410" unicode="&#xf1b5;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM499 1041h-371v-787h382q117 0 197 57.5t80 170.5q0 158 -143 200q107 52 107 164q0 57 -19.5 96.5
+t-56.5 60.5t-79 29.5t-97 8.5zM477 723h-176v184h163q119 0 119 -90q0 -94 -106 -94zM486 388h-185v217h189q124 0 124 -113q0 -104 -128 -104zM1136 356q-68 0 -104 38t-36 107h411q1 10 1 30q0 132 -74.5 220.5t-203.5 88.5q-128 0 -210 -86t-82 -216q0 -135 79 -217
+t213 -82q205 0 267 191h-138q-11 -34 -47.5 -54t-75.5 -20zM1126 722q113 0 124 -122h-254q4 56 39 89t91 33zM964 988h319v-77h-319v77z" />
+    <glyph glyph-name="_411" unicode="&#xf1b6;" horiz-adv-x="1792" 
+d="M1582 954q0 -101 -71.5 -172.5t-172.5 -71.5t-172.5 71.5t-71.5 172.5t71.5 172.5t172.5 71.5t172.5 -71.5t71.5 -172.5zM812 212q0 104 -73 177t-177 73q-27 0 -54 -6l104 -42q77 -31 109.5 -106.5t1.5 -151.5q-31 -77 -107 -109t-152 -1q-21 8 -62 24.5t-61 24.5
+q32 -60 91 -96.5t130 -36.5q104 0 177 73t73 177zM1642 953q0 126 -89.5 215.5t-215.5 89.5q-127 0 -216.5 -89.5t-89.5 -215.5q0 -127 89.5 -216t216.5 -89q126 0 215.5 89t89.5 216zM1792 953q0 -189 -133.5 -322t-321.5 -133l-437 -319q-12 -129 -109 -218t-229 -89
+q-121 0 -214 76t-118 192l-230 92v429l389 -157q79 48 173 48q13 0 35 -2l284 407q2 187 135.5 319t320.5 132q188 0 321.5 -133.5t133.5 -321.5z" />
+    <glyph glyph-name="_412" unicode="&#xf1b7;" 
+d="M1242 889q0 80 -57 136.5t-137 56.5t-136.5 -57t-56.5 -136q0 -80 56.5 -136.5t136.5 -56.5t137 56.5t57 136.5zM632 301q0 -83 -58 -140.5t-140 -57.5q-56 0 -103 29t-72 77q52 -20 98 -40q60 -24 120 1.5t85 86.5q24 60 -1.5 120t-86.5 84l-82 33q22 5 42 5
+q82 0 140 -57.5t58 -140.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v153l172 -69q20 -92 93.5 -152t168.5 -60q104 0 181 70t87 173l345 252q150 0 255.5 105.5t105.5 254.5q0 150 -105.5 255.5t-255.5 105.5
+q-148 0 -253 -104.5t-107 -252.5l-225 -322q-9 1 -28 1q-75 0 -137 -37l-297 119v468q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5zM1289 887q0 -100 -71 -170.5t-171 -70.5t-170.5 70.5t-70.5 170.5t70.5 171t170.5 71q101 0 171.5 -70.5t70.5 -171.5z
+" />
+    <glyph glyph-name="_413" unicode="&#xf1b8;" horiz-adv-x="1792" 
+d="M836 367l-15 -368l-2 -22l-420 29q-36 3 -67 31.5t-47 65.5q-11 27 -14.5 55t4 65t12 55t21.5 64t19 53q78 -12 509 -28zM449 953l180 -379l-147 92q-63 -72 -111.5 -144.5t-72.5 -125t-39.5 -94.5t-18.5 -63l-4 -21l-190 357q-17 26 -18 56t6 47l8 18q35 63 114 188
+l-140 86zM1680 436l-188 -359q-12 -29 -36.5 -46.5t-43.5 -20.5l-18 -4q-71 -7 -219 -12l8 -164l-230 367l211 362l7 -173q170 -16 283 -5t170 33zM895 1360q-47 -63 -265 -435l-317 187l-19 12l225 356q20 31 60 45t80 10q24 -2 48.5 -12t42 -21t41.5 -33t36 -34.5
+t36 -39.5t32 -35zM1550 1053l212 -363q18 -37 12.5 -76t-27.5 -74q-13 -20 -33 -37t-38 -28t-48.5 -22t-47 -16t-51.5 -14t-46 -12q-34 72 -265 436l313 195zM1407 1279l142 83l-220 -373l-419 20l151 86q-34 89 -75 166t-75.5 123.5t-64.5 80t-47 46.5l-17 13l405 -1
+q31 3 58 -10.5t39 -28.5l11 -15q39 -61 112 -190z" />
+    <glyph glyph-name="_414" unicode="&#xf1b9;" horiz-adv-x="2048" 
+d="M480 448q0 66 -47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47t113 47t47 113zM516 768h1016l-89 357q-2 8 -14 17.5t-21 9.5h-768q-9 0 -21 -9.5t-14 -17.5zM1888 448q0 66 -47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47t113 47t47 113zM2048 544v-384
+q0 -14 -9 -23t-23 -9h-96v-128q0 -80 -56 -136t-136 -56t-136 56t-56 136v128h-1024v-128q0 -80 -56 -136t-136 -56t-136 56t-56 136v128h-96q-14 0 -23 9t-9 23v384q0 93 65.5 158.5t158.5 65.5h28l105 419q23 94 104 157.5t179 63.5h768q98 0 179 -63.5t104 -157.5
+l105 -419h28q93 0 158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="_415" unicode="&#xf1ba;" horiz-adv-x="2048" 
+d="M1824 640q93 0 158.5 -65.5t65.5 -158.5v-384q0 -14 -9 -23t-23 -9h-96v-64q0 -80 -56 -136t-136 -56t-136 56t-56 136v64h-1024v-64q0 -80 -56 -136t-136 -56t-136 56t-56 136v64h-96q-14 0 -23 9t-9 23v384q0 93 65.5 158.5t158.5 65.5h28l105 419q23 94 104 157.5
+t179 63.5h128v224q0 14 9 23t23 9h448q14 0 23 -9t9 -23v-224h128q98 0 179 -63.5t104 -157.5l105 -419h28zM320 160q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47zM516 640h1016l-89 357q-2 8 -14 17.5t-21 9.5h-768q-9 0 -21 -9.5t-14 -17.5z
+M1728 160q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47z" />
+    <glyph glyph-name="_416" unicode="&#xf1bb;" 
+d="M1504 64q0 -26 -19 -45t-45 -19h-462q1 -17 6 -87.5t5 -108.5q0 -25 -18 -42.5t-43 -17.5h-320q-25 0 -43 17.5t-18 42.5q0 38 5 108.5t6 87.5h-462q-26 0 -45 19t-19 45t19 45l402 403h-229q-26 0 -45 19t-19 45t19 45l402 403h-197q-26 0 -45 19t-19 45t19 45l384 384
+q19 19 45 19t45 -19l384 -384q19 -19 19 -45t-19 -45t-45 -19h-197l402 -403q19 -19 19 -45t-19 -45t-45 -19h-229l402 -403q19 -19 19 -45z" />
+    <glyph glyph-name="_417" unicode="&#xf1bc;" 
+d="M1127 326q0 32 -30 51q-193 115 -447 115q-133 0 -287 -34q-42 -9 -42 -52q0 -20 13.5 -34.5t35.5 -14.5q5 0 37 8q132 27 243 27q226 0 397 -103q19 -11 33 -11q19 0 33 13.5t14 34.5zM1223 541q0 40 -35 61q-237 141 -548 141q-153 0 -303 -42q-48 -13 -48 -64
+q0 -25 17.5 -42.5t42.5 -17.5q7 0 37 8q122 33 251 33q279 0 488 -124q24 -13 38 -13q25 0 42.5 17.5t17.5 42.5zM1331 789q0 47 -40 70q-126 73 -293 110.5t-343 37.5q-204 0 -364 -47q-23 -7 -38.5 -25.5t-15.5 -48.5q0 -31 20.5 -52t51.5 -21q11 0 40 8q133 37 307 37
+q159 0 309.5 -34t253.5 -95q21 -12 40 -12q29 0 50.5 20.5t21.5 51.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_418" unicode="&#xf1bd;" horiz-adv-x="1024" 
+d="M1024 1233l-303 -582l24 -31h279v-415h-507l-44 -30l-142 -273l-30 -30h-301v303l303 583l-24 30h-279v415h507l44 30l142 273l30 30h301v-303z" />
+    <glyph glyph-name="_419" unicode="&#xf1be;" horiz-adv-x="2304" 
+d="M784 164l16 241l-16 523q-1 10 -7.5 17t-16.5 7q-9 0 -16 -7t-7 -17l-14 -523l14 -241q1 -10 7.5 -16.5t15.5 -6.5q22 0 24 23zM1080 193l11 211l-12 586q0 16 -13 24q-8 5 -16 5t-16 -5q-13 -8 -13 -24l-1 -6l-10 -579q0 -1 11 -236v-1q0 -10 6 -17q9 -11 23 -11
+q11 0 20 9q9 7 9 20zM35 533l20 -128l-20 -126q-2 -9 -9 -9t-9 9l-17 126l17 128q2 9 9 9t9 -9zM121 612l26 -207l-26 -203q-2 -9 -10 -9q-9 0 -9 10l-23 202l23 207q0 9 9 9q8 0 10 -9zM401 159zM213 650l25 -245l-25 -237q0 -11 -11 -11q-10 0 -12 11l-21 237l21 245
+q2 12 12 12q11 0 11 -12zM307 657l23 -252l-23 -244q-2 -13 -14 -13q-13 0 -13 13l-21 244l21 252q0 13 13 13q12 0 14 -13zM401 639l21 -234l-21 -246q-2 -16 -16 -16q-6 0 -10.5 4.5t-4.5 11.5l-20 246l20 234q0 6 4.5 10.5t10.5 4.5q14 0 16 -15zM784 164zM495 785
+l21 -380l-21 -246q0 -7 -5 -12.5t-12 -5.5q-16 0 -18 18l-18 246l18 380q2 18 18 18q7 0 12 -5.5t5 -12.5zM589 871l19 -468l-19 -244q0 -8 -5.5 -13.5t-13.5 -5.5q-18 0 -20 19l-16 244l16 468q2 19 20 19q8 0 13.5 -5.5t5.5 -13.5zM687 911l18 -506l-18 -242
+q-2 -21 -22 -21q-19 0 -21 21l-16 242l16 506q0 9 6.5 15.5t14.5 6.5q9 0 15 -6.5t7 -15.5zM1079 169v0v0v0zM881 915l15 -510l-15 -239q0 -10 -7.5 -17.5t-17.5 -7.5t-17 7t-8 18l-14 239l14 510q0 11 7.5 18t17.5 7t17.5 -7t7.5 -18zM980 896l14 -492l-14 -236
+q0 -11 -8 -19t-19 -8t-19 8t-9 19l-12 236l12 492q1 12 9 20t19 8t18.5 -8t8.5 -20zM1192 404l-14 -231v0q0 -13 -9 -22t-22 -9t-22 9t-10 22l-6 114l-6 117l12 636v3q2 15 12 24q9 7 20 7q8 0 15 -5q14 -8 16 -26zM2304 423q0 -117 -83 -199.5t-200 -82.5h-786
+q-13 2 -22 11t-9 22v899q0 23 28 33q85 34 181 34q195 0 338 -131.5t160 -323.5q53 22 110 22q117 0 200 -83t83 -201z" />
+    <glyph glyph-name="uniF1C0" unicode="&#xf1c0;" 
+d="M768 768q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127t443 -43zM768 0q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127
+t443 -43zM768 384q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127t443 -43zM768 1536q208 0 385 -34.5t280 -93.5t103 -128v-128q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5
+t-103 128v128q0 69 103 128t280 93.5t385 34.5z" />
+    <glyph glyph-name="uniF1C1" unicode="&#xf1c1;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M894 465q33 -26 84 -56q59 7 117 7q147 0 177 -49q16 -22 2 -52q0 -1 -1 -2l-2 -2v-1q-6 -38 -71 -38q-48 0 -115 20t-130 53q-221 -24 -392 -83q-153 -262 -242 -262q-15 0 -28 7l-24 12q-1 1 -6 5q-10 10 -6 36q9 40 56 91.5t132 96.5q14 9 23 -6q2 -2 2 -4q52 85 107 197
+q68 136 104 262q-24 82 -30.5 159.5t6.5 127.5q11 40 42 40h21h1q23 0 35 -15q18 -21 9 -68q-2 -6 -4 -8q1 -3 1 -8v-30q-2 -123 -14 -192q55 -164 146 -238zM318 54q52 24 137 158q-51 -40 -87.5 -84t-49.5 -74zM716 974q-15 -42 -2 -132q1 7 7 44q0 3 7 43q1 4 4 8
+q-1 1 -1 2q-1 2 -1 3q-1 22 -13 36q0 -1 -1 -2v-2zM592 313q135 54 284 81q-2 1 -13 9.5t-16 13.5q-76 67 -127 176q-27 -86 -83 -197q-30 -56 -45 -83zM1238 329q-24 24 -140 24q76 -28 124 -28q14 0 18 1q0 1 -2 3z" />
+    <glyph glyph-name="_422" unicode="&#xf1c2;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M233 768v-107h70l164 -661h159l128 485q7 20 10 46q2 16 2 24h4l3 -24q1 -3 3.5 -20t5.5 -26l128 -485h159l164 661h70v107h-300v-107h90l-99 -438q-5 -20 -7 -46l-2 -21h-4q0 3 -0.5 6.5t-1.5 8t-1 6.5q-1 5 -4 21t-5 25l-144 545h-114l-144 -545q-2 -9 -4.5 -24.5
+t-3.5 -21.5l-4 -21h-4l-2 21q-2 26 -7 46l-99 438h90v107h-300z" />
+    <glyph glyph-name="_423" unicode="&#xf1c3;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M429 106v-106h281v106h-75l103 161q5 7 10 16.5t7.5 13.5t3.5 4h2q1 -4 5 -10q2 -4 4.5 -7.5t6 -8t6.5 -8.5l107 -161h-76v-106h291v106h-68l-192 273l195 282h67v107h-279v-107h74l-103 -159q-4 -7 -10 -16.5t-9 -13.5l-2 -3h-2q-1 4 -5 10q-6 11 -17 23l-106 159h76v107
+h-290v-107h68l189 -272l-194 -283h-68z" />
+    <glyph glyph-name="_424" unicode="&#xf1c4;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M416 106v-106h327v106h-93v167h137q76 0 118 15q67 23 106.5 87t39.5 146q0 81 -37 141t-100 87q-48 19 -130 19h-368v-107h92v-555h-92zM769 386h-119v268h120q52 0 83 -18q56 -33 56 -115q0 -89 -62 -120q-31 -15 -78 -15z" />
+    <glyph glyph-name="_425" unicode="&#xf1c5;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M1280 320v-320h-1024v192l192 192l128 -128l384 384zM448 512q-80 0 -136 56t-56 136t56 136t136 56t136 -56t56 -136t-56 -136t-136 -56z" />
+    <glyph glyph-name="_426" unicode="&#xf1c6;" 
+d="M640 1152v128h-128v-128h128zM768 1024v128h-128v-128h128zM640 896v128h-128v-128h128zM768 768v128h-128v-128h128zM1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400
+v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-128v-128h-128v128h-512v-1536h1280zM781 593l107 -349q8 -27 8 -52q0 -83 -72.5 -137.5t-183.5 -54.5t-183.5 54.5t-72.5 137.5q0 25 8 52q21 63 120 396v128h128v-128h79
+q22 0 39 -13t23 -34zM640 128q53 0 90.5 19t37.5 45t-37.5 45t-90.5 19t-90.5 -19t-37.5 -45t37.5 -45t90.5 -19z" />
+    <glyph glyph-name="_427" unicode="&#xf1c7;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M620 686q20 -8 20 -30v-544q0 -22 -20 -30q-8 -2 -12 -2q-12 0 -23 9l-166 167h-131q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h131l166 167q16 15 35 7zM1037 -3q31 0 50 24q129 159 129 363t-129 363q-16 21 -43 24t-47 -14q-21 -17 -23.5 -43.5t14.5 -47.5
+q100 -123 100 -282t-100 -282q-17 -21 -14.5 -47.5t23.5 -42.5q18 -15 40 -15zM826 145q27 0 47 20q87 93 87 219t-87 219q-18 19 -45 20t-46 -17t-20 -44.5t18 -46.5q52 -57 52 -131t-52 -131q-19 -20 -18 -46.5t20 -44.5q20 -17 44 -17z" />
+    <glyph glyph-name="_428" unicode="&#xf1c8;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M768 768q52 0 90 -38t38 -90v-384q0 -52 -38 -90t-90 -38h-384q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h384zM1260 766q20 -8 20 -30v-576q0 -22 -20 -30q-8 -2 -12 -2q-14 0 -23 9l-265 266v90l265 266q9 9 23 9q4 0 12 -2z" />
+    <glyph glyph-name="_429" unicode="&#xf1c9;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M480 768q8 11 21 12.5t24 -6.5l51 -38q11 -8 12.5 -21t-6.5 -24l-182 -243l182 -243q8 -11 6.5 -24t-12.5 -21l-51 -38q-11 -8 -24 -6.5t-21 12.5l-226 301q-14 19 0 38zM1282 467q14 -19 0 -38l-226 -301q-8 -11 -21 -12.5t-24 6.5l-51 38q-11 8 -12.5 21t6.5 24l182 243
+l-182 243q-8 11 -6.5 24t12.5 21l51 38q11 8 24 6.5t21 -12.5zM662 6q-13 2 -20.5 13t-5.5 24l138 831q2 13 13 20.5t24 5.5l63 -10q13 -2 20.5 -13t5.5 -24l-138 -831q-2 -13 -13 -20.5t-24 -5.5z" />
+    <glyph glyph-name="_430" unicode="&#xf1ca;" 
+d="M1497 709v-198q-101 -23 -198 -23q-65 -136 -165.5 -271t-181.5 -215.5t-128 -106.5q-80 -45 -162 3q-28 17 -60.5 43.5t-85 83.5t-102.5 128.5t-107.5 184t-105.5 244t-91.5 314.5t-70.5 390h283q26 -218 70 -398.5t104.5 -317t121.5 -235.5t140 -195q169 169 287 406
+q-142 72 -223 220t-81 333q0 192 104 314.5t284 122.5q178 0 273 -105.5t95 -297.5q0 -159 -58 -286q-7 -1 -19.5 -3t-46 -2t-63 6t-62 25.5t-50.5 51.5q31 103 31 184q0 87 -29 132t-79 45q-53 0 -85 -49.5t-32 -140.5q0 -186 105 -293.5t267 -107.5q62 0 121 14z" />
+    <glyph glyph-name="_431" unicode="&#xf1cb;" horiz-adv-x="1792" 
+d="M216 367l603 -402v359l-334 223zM154 511l193 129l-193 129v-258zM973 -35l603 402l-269 180l-334 -223v-359zM896 458l272 182l-272 182l-272 -182zM485 733l334 223v359l-603 -402zM1445 640l193 -129v258zM1307 733l269 180l-603 402v-359zM1792 913v-546
+q0 -41 -34 -64l-819 -546q-21 -13 -43 -13t-43 13l-819 546q-34 23 -34 64v546q0 41 34 64l819 546q21 13 43 13t43 -13l819 -546q34 -23 34 -64z" />
+    <glyph glyph-name="_432" unicode="&#xf1cc;" horiz-adv-x="2048" 
+d="M1800 764q111 -46 179.5 -145.5t68.5 -221.5q0 -164 -118 -280.5t-285 -116.5q-4 0 -11.5 0.5t-10.5 0.5h-1209h-1h-2h-5q-170 10 -288 125.5t-118 280.5q0 110 55 203t147 147q-12 39 -12 82q0 115 82 196t199 81q95 0 172 -58q75 154 222.5 248t326.5 94
+q166 0 306 -80.5t221.5 -218.5t81.5 -301q0 -6 -0.5 -18t-0.5 -18zM468 498q0 -122 84 -193t208 -71q137 0 240 99q-16 20 -47.5 56.5t-43.5 50.5q-67 -65 -144 -65q-55 0 -93.5 33.5t-38.5 87.5q0 53 38.5 87t91.5 34q44 0 84.5 -21t73 -55t65 -75t69 -82t77 -75t97 -55
+t121.5 -21q121 0 204.5 71.5t83.5 190.5q0 121 -84 192t-207 71q-143 0 -241 -97l93 -108q66 64 142 64q52 0 92 -33t40 -84q0 -57 -37 -91.5t-94 -34.5q-43 0 -82.5 21t-72 55t-65.5 75t-69.5 82t-77.5 75t-96.5 55t-118.5 21q-122 0 -207 -70.5t-85 -189.5z" />
+    <glyph glyph-name="_433" unicode="&#xf1cd;" horiz-adv-x="1792" 
+d="M896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM896 1408q-190 0 -361 -90l194 -194q82 28 167 28t167 -28l194 194q-171 90 -361 90zM218 279l194 194
+q-28 82 -28 167t28 167l-194 194q-90 -171 -90 -361t90 -361zM896 -128q190 0 361 90l-194 194q-82 -28 -167 -28t-167 28l-194 -194q171 -90 361 -90zM896 256q159 0 271.5 112.5t112.5 271.5t-112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5
+t271.5 -112.5zM1380 473l194 -194q90 171 90 361t-90 361l-194 -194q28 -82 28 -167t-28 -167z" />
+    <glyph glyph-name="_434" unicode="&#xf1ce;" horiz-adv-x="1792" 
+d="M1760 640q0 -176 -68.5 -336t-184 -275.5t-275.5 -184t-336 -68.5t-336 68.5t-275.5 184t-184 275.5t-68.5 336q0 213 97 398.5t265 305.5t374 151v-228q-221 -45 -366.5 -221t-145.5 -406q0 -130 51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5
+t136.5 204t51 248.5q0 230 -145.5 406t-366.5 221v228q206 -31 374 -151t265 -305.5t97 -398.5z" />
+    <glyph glyph-name="uniF1D0" unicode="&#xf1d0;" horiz-adv-x="1792" 
+d="M19 662q8 217 116 406t305 318h5q0 -1 -1 -3q-8 -8 -28 -33.5t-52 -76.5t-60 -110.5t-44.5 -135.5t-14 -150.5t39 -157.5t108.5 -154q50 -50 102 -69.5t90.5 -11.5t69.5 23.5t47 32.5l16 16q39 51 53 116.5t6.5 122.5t-21 107t-26.5 80l-14 29q-10 25 -30.5 49.5t-43 41
+t-43.5 29.5t-35 19l-13 6l104 115q39 -17 78 -52t59 -61l19 -27q1 48 -18.5 103.5t-40.5 87.5l-20 31l161 183l160 -181q-33 -46 -52.5 -102.5t-22.5 -90.5l-4 -33q22 37 61.5 72.5t67.5 52.5l28 17l103 -115q-44 -14 -85 -50t-60 -65l-19 -29q-31 -56 -48 -133.5t-7 -170
+t57 -156.5q33 -45 77.5 -60.5t85 -5.5t76 26.5t57.5 33.5l21 16q60 53 96.5 115t48.5 121.5t10 121.5t-18 118t-37 107.5t-45.5 93t-45 72t-34.5 47.5l-13 17q-14 13 -7 13l10 -3q40 -29 62.5 -46t62 -50t64 -58t58.5 -65t55.5 -77t45.5 -88t38 -103t23.5 -117t10.5 -136
+q3 -259 -108 -465t-312 -321t-456 -115q-185 0 -351 74t-283.5 198t-184 293t-60.5 353z" />
+    <glyph glyph-name="uniF1D1" unicode="&#xf1d1;" horiz-adv-x="1792" 
+d="M874 -102v-66q-208 6 -385 109.5t-283 275.5l58 34q29 -49 73 -99l65 57q148 -168 368 -212l-17 -86q65 -12 121 -13zM276 428l-83 -28q22 -60 49 -112l-57 -33q-98 180 -98 385t98 385l57 -33q-30 -56 -49 -112l82 -28q-35 -100 -35 -212q0 -109 36 -212zM1528 251
+l58 -34q-106 -172 -283 -275.5t-385 -109.5v66q56 1 121 13l-17 86q220 44 368 212l65 -57q44 50 73 99zM1377 805l-233 -80q14 -42 14 -85t-14 -85l232 -80q-31 -92 -98 -169l-185 162q-57 -67 -147 -85l48 -241q-52 -10 -98 -10t-98 10l48 241q-90 18 -147 85l-185 -162
+q-67 77 -98 169l232 80q-14 42 -14 85t14 85l-233 80q33 93 99 169l185 -162q59 68 147 86l-48 240q44 10 98 10t98 -10l-48 -240q88 -18 147 -86l185 162q66 -76 99 -169zM874 1448v-66q-65 -2 -121 -13l17 -86q-220 -42 -368 -211l-65 56q-38 -42 -73 -98l-57 33
+q106 172 282 275.5t385 109.5zM1705 640q0 -205 -98 -385l-57 33q27 52 49 112l-83 28q36 103 36 212q0 112 -35 212l82 28q-19 56 -49 112l57 33q98 -180 98 -385zM1585 1063l-57 -33q-35 56 -73 98l-65 -56q-148 169 -368 211l17 86q-56 11 -121 13v66q209 -6 385 -109.5
+t282 -275.5zM1748 640q0 173 -67.5 331t-181.5 272t-272 181.5t-331 67.5t-331 -67.5t-272 -181.5t-181.5 -272t-67.5 -331t67.5 -331t181.5 -272t272 -181.5t331 -67.5t331 67.5t272 181.5t181.5 272t67.5 331zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71
+t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF1D2" unicode="&#xf1d2;" 
+d="M582 228q0 -66 -93 -66q-107 0 -107 63q0 64 98 64q102 0 102 -61zM546 694q0 -85 -74 -85q-77 0 -77 84q0 90 77 90q36 0 55 -25.5t19 -63.5zM712 769v125q-78 -29 -135 -29q-50 29 -110 29q-86 0 -145 -57t-59 -143q0 -50 29.5 -102t73.5 -67v-3q-38 -17 -38 -85
+q0 -53 41 -77v-3q-113 -37 -113 -139q0 -45 20 -78.5t54 -51t72 -25.5t81 -8q224 0 224 188q0 67 -48 99t-126 46q-27 5 -51.5 20.5t-24.5 39.5q0 44 49 52q77 15 122 70t45 134q0 24 -10 52q37 9 49 13zM771 350h137q-2 27 -2 82v387q0 46 2 69h-137q3 -23 3 -71v-392
+q0 -50 -3 -75zM1280 366v121q-30 -21 -68 -21q-53 0 -53 82v225h52q9 0 26.5 -1t26.5 -1v117h-105q0 82 3 102h-140q4 -24 4 -55v-47h-60v-117q36 3 37 3q3 0 11 -0.5t12 -0.5v-2h-2v-217q0 -37 2.5 -64t11.5 -56.5t24.5 -48.5t43.5 -31t66 -12q64 0 108 24zM924 1072
+q0 36 -24 63.5t-60 27.5t-60.5 -27t-24.5 -64q0 -36 25 -62.5t60 -26.5t59.5 27t24.5 62zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_438" unicode="&#xf1d3;" horiz-adv-x="1792" 
+d="M595 22q0 100 -165 100q-158 0 -158 -104q0 -101 172 -101q151 0 151 105zM536 777q0 61 -30 102t-89 41q-124 0 -124 -145q0 -135 124 -135q119 0 119 137zM805 1101v-202q-36 -12 -79 -22q16 -43 16 -84q0 -127 -73 -216.5t-197 -112.5q-40 -8 -59.5 -27t-19.5 -58
+q0 -31 22.5 -51.5t58 -32t78.5 -22t86 -25.5t78.5 -37.5t58 -64t22.5 -98.5q0 -304 -363 -304q-69 0 -130 12.5t-116 41t-87.5 82t-32.5 127.5q0 165 182 225v4q-67 41 -67 126q0 109 63 137v4q-72 24 -119.5 108.5t-47.5 165.5q0 139 95 231.5t235 92.5q96 0 178 -47
+q98 0 218 47zM1123 220h-222q4 45 4 134v609q0 94 -4 128h222q-4 -33 -4 -124v-613q0 -89 4 -134zM1724 442v-196q-71 -39 -174 -39q-62 0 -107 20t-70 50t-39.5 78t-18.5 92t-4 103v351h2v4q-7 0 -19 1t-18 1q-21 0 -59 -6v190h96v76q0 54 -6 89h227q-6 -41 -6 -165h171
+v-190q-15 0 -43.5 2t-42.5 2h-85v-365q0 -131 87 -131q61 0 109 33zM1148 1389q0 -58 -39 -101.5t-96 -43.5q-58 0 -98 43.5t-40 101.5q0 59 39.5 103t98.5 44q58 0 96.5 -44.5t38.5 -102.5z" />
+    <glyph glyph-name="_439" unicode="&#xf1d4;" 
+d="M809 532l266 499h-112l-157 -312q-24 -48 -44 -92l-42 92l-155 312h-120l263 -493v-324h101v318zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF1D5" unicode="&#xf1d5;" horiz-adv-x="1280" 
+d="M842 964q0 -80 -57 -136.5t-136 -56.5q-60 0 -111 35q-62 -67 -115 -146q-247 -371 -202 -859q1 -22 -12.5 -38.5t-34.5 -18.5h-5q-20 0 -35 13.5t-17 33.5q-14 126 -3.5 247.5t29.5 217t54 186t69 155.5t74 125q61 90 132 165q-16 35 -16 77q0 80 56.5 136.5t136.5 56.5
+t136.5 -56.5t56.5 -136.5zM1223 953q0 -158 -78 -292t-212.5 -212t-292.5 -78q-64 0 -131 14q-21 5 -32.5 23.5t-6.5 39.5q5 20 23 31.5t39 7.5q51 -13 108 -13q97 0 186 38t153 102t102 153t38 186t-38 186t-102 153t-153 102t-186 38t-186 -38t-153 -102t-102 -153
+t-38 -186q0 -114 52 -218q10 -20 3.5 -40t-25.5 -30t-39.5 -3t-30.5 26q-64 123 -64 265q0 119 46.5 227t124.5 186t186 124t226 46q158 0 292.5 -78t212.5 -212.5t78 -292.5z" />
+    <glyph glyph-name="uniF1D6" unicode="&#xf1d6;" horiz-adv-x="1792" 
+d="M270 730q-8 19 -8 52q0 20 11 49t24 45q-1 22 7.5 53t22.5 43q0 139 92.5 288.5t217.5 209.5q139 66 324 66q133 0 266 -55q49 -21 90 -48t71 -56t55 -68t42 -74t32.5 -84.5t25.5 -89.5t22 -98l1 -5q55 -83 55 -150q0 -14 -9 -40t-9 -38q0 -1 1.5 -3.5t3.5 -5t2 -3.5
+q77 -114 120.5 -214.5t43.5 -208.5q0 -43 -19.5 -100t-55.5 -57q-9 0 -19.5 7.5t-19 17.5t-19 26t-16 26.5t-13.5 26t-9 17.5q-1 1 -3 1l-5 -4q-59 -154 -132 -223q20 -20 61.5 -38.5t69 -41.5t35.5 -65q-2 -4 -4 -16t-7 -18q-64 -97 -302 -97q-53 0 -110.5 9t-98 20
+t-104.5 30q-15 5 -23 7q-14 4 -46 4.5t-40 1.5q-41 -45 -127.5 -65t-168.5 -20q-35 0 -69 1.5t-93 9t-101 20.5t-74.5 40t-32.5 64q0 40 10 59.5t41 48.5q11 2 40.5 13t49.5 12q4 0 14 2q2 2 2 4l-2 3q-48 11 -108 105.5t-73 156.5l-5 3q-4 0 -12 -20q-18 -41 -54.5 -74.5
+t-77.5 -37.5h-1q-4 0 -6 4.5t-5 5.5q-23 54 -23 100q0 275 252 466z" />
+    <glyph glyph-name="uniF1D7" unicode="&#xf1d7;" horiz-adv-x="2048" 
+d="M580 1075q0 41 -25 66t-66 25q-43 0 -76 -25.5t-33 -65.5q0 -39 33 -64.5t76 -25.5q41 0 66 24.5t25 65.5zM1323 568q0 28 -25.5 50t-65.5 22q-27 0 -49.5 -22.5t-22.5 -49.5q0 -28 22.5 -50.5t49.5 -22.5q40 0 65.5 22t25.5 51zM1087 1075q0 41 -24.5 66t-65.5 25
+q-43 0 -76 -25.5t-33 -65.5q0 -39 33 -64.5t76 -25.5q41 0 65.5 24.5t24.5 65.5zM1722 568q0 28 -26 50t-65 22q-27 0 -49.5 -22.5t-22.5 -49.5q0 -28 22.5 -50.5t49.5 -22.5q39 0 65 22t26 51zM1456 965q-31 4 -70 4q-169 0 -311 -77t-223.5 -208.5t-81.5 -287.5
+q0 -78 23 -152q-35 -3 -68 -3q-26 0 -50 1.5t-55 6.5t-44.5 7t-54.5 10.5t-50 10.5l-253 -127l72 218q-290 203 -290 490q0 169 97.5 311t264 223.5t363.5 81.5q176 0 332.5 -66t262 -182.5t136.5 -260.5zM2048 404q0 -117 -68.5 -223.5t-185.5 -193.5l55 -181l-199 109
+q-150 -37 -218 -37q-169 0 -311 70.5t-223.5 191.5t-81.5 264t81.5 264t223.5 191.5t311 70.5q161 0 303 -70.5t227.5 -192t85.5 -263.5z" />
+    <glyph glyph-name="_443" unicode="&#xf1d8;" horiz-adv-x="1792" 
+d="M1764 1525q33 -24 27 -64l-256 -1536q-5 -29 -32 -45q-14 -8 -31 -8q-11 0 -24 5l-453 185l-242 -295q-18 -23 -49 -23q-13 0 -22 4q-19 7 -30.5 23.5t-11.5 36.5v349l864 1059l-1069 -925l-395 162q-37 14 -40 55q-2 40 32 59l1664 960q15 9 32 9q20 0 36 -11z" />
+    <glyph glyph-name="_444" unicode="&#xf1d9;" horiz-adv-x="1792" 
+d="M1764 1525q33 -24 27 -64l-256 -1536q-5 -29 -32 -45q-14 -8 -31 -8q-11 0 -24 5l-527 215l-298 -327q-18 -21 -47 -21q-14 0 -23 4q-19 7 -30 23.5t-11 36.5v452l-472 193q-37 14 -40 55q-3 39 32 59l1664 960q35 21 68 -2zM1422 26l221 1323l-1434 -827l336 -137
+l863 639l-478 -797z" />
+    <glyph glyph-name="_445" unicode="&#xf1da;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61q-172 0 -327 72.5t-264 204.5q-7 10 -6.5 22.5t8.5 20.5l137 138q10 9 25 9q16 -2 23 -12q73 -95 179 -147t225 -52q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5
+t-163.5 109.5t-198.5 40.5q-98 0 -188 -35.5t-160 -101.5l137 -138q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l130 -129q107 101 244.5 156.5t284.5 55.5q156 0 298 -61t245 -164t164 -245t61 -298zM896 928v-448q0 -14 -9 -23
+t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_446" unicode="&#xf1db;" 
+d="M768 1280q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_447" unicode="&#xf1dc;" horiz-adv-x="1792" 
+d="M1682 -128q-44 0 -132.5 3.5t-133.5 3.5q-44 0 -132 -3.5t-132 -3.5q-24 0 -37 20.5t-13 45.5q0 31 17 46t39 17t51 7t45 15q33 21 33 140l-1 391q0 21 -1 31q-13 4 -50 4h-675q-38 0 -51 -4q-1 -10 -1 -31l-1 -371q0 -142 37 -164q16 -10 48 -13t57 -3.5t45 -15
+t20 -45.5q0 -26 -12.5 -48t-36.5 -22q-47 0 -139.5 3.5t-138.5 3.5q-43 0 -128 -3.5t-127 -3.5q-23 0 -35.5 21t-12.5 45q0 30 15.5 45t36 17.5t47.5 7.5t42 15q33 23 33 143l-1 57v813q0 3 0.5 26t0 36.5t-1.5 38.5t-3.5 42t-6.5 36.5t-11 31.5t-16 18q-15 10 -45 12t-53 2
+t-41 14t-18 45q0 26 12 48t36 22q46 0 138.5 -3.5t138.5 -3.5q42 0 126.5 3.5t126.5 3.5q25 0 37.5 -22t12.5 -48q0 -30 -17 -43.5t-38.5 -14.5t-49.5 -4t-43 -13q-35 -21 -35 -160l1 -320q0 -21 1 -32q13 -3 39 -3h699q25 0 38 3q1 11 1 32l1 320q0 139 -35 160
+q-18 11 -58.5 12.5t-66 13t-25.5 49.5q0 26 12.5 48t37.5 22q44 0 132 -3.5t132 -3.5q43 0 129 3.5t129 3.5q25 0 37.5 -22t12.5 -48q0 -30 -17.5 -44t-40 -14.5t-51.5 -3t-44 -12.5q-35 -23 -35 -161l1 -943q0 -119 34 -140q16 -10 46 -13.5t53.5 -4.5t41.5 -15.5t18 -44.5
+q0 -26 -12 -48t-36 -22z" />
+    <glyph glyph-name="_448" unicode="&#xf1dd;" horiz-adv-x="1280" 
+d="M1278 1347v-73q0 -29 -18.5 -61t-42.5 -32q-50 0 -54 -1q-26 -6 -32 -31q-3 -11 -3 -64v-1152q0 -25 -18 -43t-43 -18h-108q-25 0 -43 18t-18 43v1218h-143v-1218q0 -25 -17.5 -43t-43.5 -18h-108q-26 0 -43.5 18t-17.5 43v496q-147 12 -245 59q-126 58 -192 179
+q-64 117 -64 259q0 166 88 286q88 118 209 159q111 37 417 37h479q25 0 43 -18t18 -43z" />
+    <glyph glyph-name="_449" unicode="&#xf1de;" 
+d="M352 128v-128h-352v128h352zM704 256q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM864 640v-128h-864v128h864zM224 1152v-128h-224v128h224zM1536 128v-128h-736v128h736zM576 1280q26 0 45 -19t19 -45v-256
+q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM1216 768q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM1536 640v-128h-224v128h224zM1536 1152v-128h-864v128h864z" />
+    <glyph glyph-name="uniF1E0" unicode="&#xf1e0;" 
+d="M1216 512q133 0 226.5 -93.5t93.5 -226.5t-93.5 -226.5t-226.5 -93.5t-226.5 93.5t-93.5 226.5q0 12 2 34l-360 180q-92 -86 -218 -86q-133 0 -226.5 93.5t-93.5 226.5t93.5 226.5t226.5 93.5q126 0 218 -86l360 180q-2 22 -2 34q0 133 93.5 226.5t226.5 93.5
+t226.5 -93.5t93.5 -226.5t-93.5 -226.5t-226.5 -93.5q-126 0 -218 86l-360 -180q2 -22 2 -34t-2 -34l360 -180q92 86 218 86z" />
+    <glyph glyph-name="_451" unicode="&#xf1e1;" 
+d="M1280 341q0 88 -62.5 151t-150.5 63q-84 0 -145 -58l-241 120q2 16 2 23t-2 23l241 120q61 -58 145 -58q88 0 150.5 63t62.5 151t-62.5 150.5t-150.5 62.5t-151 -62.5t-63 -150.5q0 -7 2 -23l-241 -120q-62 57 -145 57q-88 0 -150.5 -62.5t-62.5 -150.5t62.5 -150.5
+t150.5 -62.5q83 0 145 57l241 -120q-2 -16 -2 -23q0 -88 63 -150.5t151 -62.5t150.5 62.5t62.5 150.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_452" unicode="&#xf1e2;" horiz-adv-x="1792" 
+d="M571 947q-10 25 -34 35t-49 0q-108 -44 -191 -127t-127 -191q-10 -25 0 -49t35 -34q13 -5 24 -5q42 0 60 40q34 84 98.5 148.5t148.5 98.5q25 11 35 35t0 49zM1513 1303l46 -46l-244 -243l68 -68q19 -19 19 -45.5t-19 -45.5l-64 -64q89 -161 89 -343q0 -143 -55.5 -273.5
+t-150 -225t-225 -150t-273.5 -55.5t-273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5q182 0 343 -89l64 64q19 19 45.5 19t45.5 -19l68 -68zM1521 1359q-10 -10 -22 -10q-13 0 -23 10l-91 90q-9 10 -9 23t9 23q10 9 23 9t23 -9l90 -91
+q10 -9 10 -22.5t-10 -22.5zM1751 1129q-11 -9 -23 -9t-23 9l-90 91q-10 9 -10 22.5t10 22.5q9 10 22.5 10t22.5 -10l91 -90q9 -10 9 -23t-9 -23zM1792 1312q0 -14 -9 -23t-23 -9h-96q-14 0 -23 9t-9 23t9 23t23 9h96q14 0 23 -9t9 -23zM1600 1504v-96q0 -14 -9 -23t-23 -9
+t-23 9t-9 23v96q0 14 9 23t23 9t23 -9t9 -23zM1751 1449l-91 -90q-10 -10 -22 -10q-13 0 -23 10q-10 9 -10 22.5t10 22.5l90 91q10 9 23 9t23 -9q9 -10 9 -23t-9 -23z" />
+    <glyph glyph-name="_453" unicode="&#xf1e3;" horiz-adv-x="1792" 
+d="M609 720l287 208l287 -208l-109 -336h-355zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM1515 186q149 203 149 454v3l-102 -89l-240 224l63 323
+l134 -12q-150 206 -389 282l53 -124l-287 -159l-287 159l53 124q-239 -76 -389 -282l135 12l62 -323l-240 -224l-102 89v-3q0 -251 149 -454l30 132l326 -40l139 -298l-116 -69q117 -39 240 -39t240 39l-116 69l139 298l326 40z" />
+    <glyph glyph-name="_454" unicode="&#xf1e4;" horiz-adv-x="1792" 
+d="M448 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM256 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM832 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23
+v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM640 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM66 768q-28 0 -47 19t-19 46v129h514v-129q0 -27 -19 -46t-46 -19h-383zM1216 224v-192q0 -14 -9 -23t-23 -9h-192
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1024 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1600 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23
+zM1408 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 1016v-13h-514v10q0 104 -382 102q-382 -1 -382 -102v-10h-514v13q0 17 8.5 43t34 64t65.5 75.5t110.5 76t160 67.5t224 47.5t293.5 18.5t293 -18.5t224 -47.5
+t160.5 -67.5t110.5 -76t65.5 -75.5t34 -64t8.5 -43zM1792 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 962v-129q0 -27 -19 -46t-46 -19h-384q-27 0 -46 19t-19 46v129h514z" />
+    <glyph glyph-name="_455" unicode="&#xf1e5;" horiz-adv-x="1792" 
+d="M704 1216v-768q0 -26 -19 -45t-45 -19v-576q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v512l249 873q7 23 31 23h424zM1024 1216v-704h-256v704h256zM1792 320v-512q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v576q-26 0 -45 19t-19 45v768h424q24 0 31 -23z
+M736 1504v-224h-352v224q0 14 9 23t23 9h288q14 0 23 -9t9 -23zM1408 1504v-224h-352v224q0 14 9 23t23 9h288q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_456" unicode="&#xf1e6;" horiz-adv-x="1792" 
+d="M1755 1083q37 -38 37 -90.5t-37 -90.5l-401 -400l150 -150l-160 -160q-163 -163 -389.5 -186.5t-411.5 100.5l-362 -362h-181v181l362 362q-124 185 -100.5 411.5t186.5 389.5l160 160l150 -150l400 401q38 37 91 37t90 -37t37 -90.5t-37 -90.5l-400 -401l234 -234
+l401 400q38 37 91 37t90 -37z" />
+    <glyph glyph-name="_457" unicode="&#xf1e7;" horiz-adv-x="1792" 
+d="M873 796q0 -83 -63.5 -142.5t-152.5 -59.5t-152.5 59.5t-63.5 142.5q0 84 63.5 143t152.5 59t152.5 -59t63.5 -143zM1375 796q0 -83 -63 -142.5t-153 -59.5q-89 0 -152.5 59.5t-63.5 142.5q0 84 63.5 143t152.5 59q90 0 153 -59t63 -143zM1600 616v667q0 87 -32 123.5
+t-111 36.5h-1112q-83 0 -112.5 -34t-29.5 -126v-673q43 -23 88.5 -40t81 -28t81 -18.5t71 -11t70 -4t58.5 -0.5t56.5 2t44.5 2q68 1 95 -27q6 -6 10 -9q26 -25 61 -51q7 91 118 87q5 0 36.5 -1.5t43 -2t45.5 -1t53 1t54.5 4.5t61 8.5t62 13.5t67 19.5t67.5 27t72 34.5z
+M1763 621q-121 -149 -372 -252q84 -285 -23 -465q-66 -113 -183 -148q-104 -32 -182 15q-86 51 -82 164l-1 326v1q-8 2 -24.5 6t-23.5 5l-1 -338q4 -114 -83 -164q-79 -47 -183 -15q-117 36 -182 150q-105 180 -22 463q-251 103 -372 252q-25 37 -4 63t60 -1q4 -2 11.5 -7
+t10.5 -8v694q0 72 47 123t114 51h1257q67 0 114 -51t47 -123v-694l21 15q39 27 60 1t-4 -63z" />
+    <glyph glyph-name="_458" unicode="&#xf1e8;" horiz-adv-x="1792" 
+d="M896 1102v-434h-145v434h145zM1294 1102v-434h-145v434h145zM1294 342l253 254v795h-1194v-1049h326v-217l217 217h398zM1692 1536v-1013l-434 -434h-326l-217 -217h-217v217h-398v1158l109 289h1483z" />
+    <glyph glyph-name="_459" unicode="&#xf1e9;" 
+d="M773 217v-127q-1 -292 -6 -305q-12 -32 -51 -40q-54 -9 -181.5 38t-162.5 89q-13 15 -17 36q-1 12 4 26q4 10 34 47t181 216q1 0 60 70q15 19 39.5 24.5t49.5 -3.5q24 -10 37.5 -29t12.5 -42zM624 468q-3 -55 -52 -70l-120 -39q-275 -88 -292 -88q-35 2 -54 36
+q-12 25 -17 75q-8 76 1 166.5t30 124.5t56 32q13 0 202 -77q71 -29 115 -47l84 -34q23 -9 35.5 -30.5t11.5 -48.5zM1450 171q-7 -54 -91.5 -161t-135.5 -127q-37 -14 -63 7q-14 10 -184 287l-47 77q-14 21 -11.5 46t19.5 46q35 43 83 26q1 -1 119 -40q203 -66 242 -79.5
+t47 -20.5q28 -22 22 -61zM778 803q5 -102 -54 -122q-58 -17 -114 71l-378 598q-8 35 19 62q41 43 207.5 89.5t224.5 31.5q40 -10 49 -45q3 -18 22 -305.5t24 -379.5zM1440 695q3 -39 -26 -59q-15 -10 -329 -86q-67 -15 -91 -23l1 2q-23 -6 -46 4t-37 32q-30 47 0 87
+q1 1 75 102q125 171 150 204t34 39q28 19 65 2q48 -23 123 -133.5t81 -167.5v-3z" />
+    <glyph glyph-name="_460" unicode="&#xf1ea;" horiz-adv-x="2048" 
+d="M1024 1024h-384v-384h384v384zM1152 384v-128h-640v128h640zM1152 1152v-640h-640v640h640zM1792 384v-128h-512v128h512zM1792 640v-128h-512v128h512zM1792 896v-128h-512v128h512zM1792 1152v-128h-512v128h512zM256 192v960h-128v-960q0 -26 19 -45t45 -19t45 19
+t19 45zM1920 192v1088h-1536v-1088q0 -33 -11 -64h1483q26 0 45 19t19 45zM2048 1408v-1216q0 -80 -56 -136t-136 -56h-1664q-80 0 -136 56t-56 136v1088h256v128h1792z" />
+    <glyph glyph-name="_461" unicode="&#xf1eb;" horiz-adv-x="2048" 
+d="M1024 13q-20 0 -93 73.5t-73 93.5q0 32 62.5 54t103.5 22t103.5 -22t62.5 -54q0 -20 -73 -93.5t-93 -73.5zM1294 284q-2 0 -40 25t-101.5 50t-128.5 25t-128.5 -25t-101 -50t-40.5 -25q-18 0 -93.5 75t-75.5 93q0 13 10 23q78 77 196 121t233 44t233 -44t196 -121
+q10 -10 10 -23q0 -18 -75.5 -93t-93.5 -75zM1567 556q-11 0 -23 8q-136 105 -252 154.5t-268 49.5q-85 0 -170.5 -22t-149 -53t-113.5 -62t-79 -53t-31 -22q-17 0 -92 75t-75 93q0 12 10 22q132 132 320 205t380 73t380 -73t320 -205q10 -10 10 -22q0 -18 -75 -93t-92 -75z
+M1838 827q-11 0 -22 9q-179 157 -371.5 236.5t-420.5 79.5t-420.5 -79.5t-371.5 -236.5q-11 -9 -22 -9q-17 0 -92.5 75t-75.5 93q0 13 10 23q187 186 445 288t527 102t527 -102t445 -288q10 -10 10 -23q0 -18 -75.5 -93t-92.5 -75z" />
+    <glyph glyph-name="_462" unicode="&#xf1ec;" horiz-adv-x="1792" 
+d="M384 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM384 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5
+t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1152 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5
+t37.5 90.5zM384 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1152 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 768q0 53 -37.5 90.5t-90.5 37.5
+t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1536 0v384q0 52 -38 90t-90 38t-90 -38t-38 -90v-384q0 -52 38 -90t90 -38t90 38t38 90zM1152 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5z
+M1536 1088v256q0 26 -19 45t-45 19h-1280q-26 0 -45 -19t-19 -45v-256q0 -26 19 -45t45 -19h1280q26 0 45 19t19 45zM1536 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 1408v-1536q0 -52 -38 -90t-90 -38
+h-1408q-52 0 -90 38t-38 90v1536q0 52 38 90t90 38h1408q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_463" unicode="&#xf1ed;" 
+d="M1519 890q18 -84 -4 -204q-87 -444 -565 -444h-44q-25 0 -44 -16.5t-24 -42.5l-4 -19l-55 -346l-2 -15q-5 -26 -24.5 -42.5t-44.5 -16.5h-251q-21 0 -33 15t-9 36q9 56 26.5 168t26.5 168t27 167.5t27 167.5q5 37 43 37h131q133 -2 236 21q175 39 287 144q102 95 155 246
+q24 70 35 133q1 6 2.5 7.5t3.5 1t6 -3.5q79 -59 98 -162zM1347 1172q0 -107 -46 -236q-80 -233 -302 -315q-113 -40 -252 -42q0 -1 -90 -1l-90 1q-100 0 -118 -96q-2 -8 -85 -530q-1 -10 -12 -10h-295q-22 0 -36.5 16.5t-11.5 38.5l232 1471q5 29 27.5 48t51.5 19h598
+q34 0 97.5 -13t111.5 -32q107 -41 163.5 -123t56.5 -196z" />
+    <glyph glyph-name="_464" unicode="&#xf1ee;" horiz-adv-x="1792" 
+d="M441 864q33 0 52 -26q266 -364 362 -774h-446q-127 441 -367 749q-12 16 -3 33.5t29 17.5h373zM1000 507q-49 -199 -125 -393q-79 310 -256 594q40 221 44 449q211 -340 337 -650zM1099 1216q235 -324 384.5 -698.5t184.5 -773.5h-451q-41 665 -553 1472h435zM1792 640
+q0 -424 -101 -812q-67 560 -359 1083q-25 301 -106 584q-4 16 5.5 28.5t25.5 12.5h359q21 0 38.5 -13t22.5 -33q115 -409 115 -850z" />
+    <glyph glyph-name="uniF1F0" unicode="&#xf1f0;" horiz-adv-x="2304" 
+d="M1975 546h-138q14 37 66 179l3 9q4 10 10 26t9 26l12 -55zM531 611l-58 295q-11 54 -75 54h-268l-2 -13q311 -79 403 -336zM710 960l-162 -438l-17 89q-26 70 -85 129.5t-131 88.5l135 -510h175l261 641h-176zM849 318h166l104 642h-166zM1617 944q-69 27 -149 27
+q-123 0 -201 -59t-79 -153q-1 -102 145 -174q48 -23 67 -41t19 -39q0 -30 -30 -46t-69 -16q-86 0 -156 33l-22 11l-23 -144q74 -34 185 -34q130 -1 208.5 59t80.5 160q0 106 -140 174q-49 25 -71 42t-22 38q0 22 24.5 38.5t70.5 16.5q70 1 124 -24l15 -8zM2042 960h-128
+q-65 0 -87 -54l-246 -588h174l35 96h212q5 -22 20 -96h154zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_466" unicode="&#xf1f1;" horiz-adv-x="2304" 
+d="M1119 1195q-128 85 -281 85q-103 0 -197.5 -40.5t-162.5 -108.5t-108.5 -162t-40.5 -197q0 -104 40.5 -198t108.5 -162t162 -108.5t198 -40.5q153 0 281 85q-131 107 -178 265.5t0.5 316.5t177.5 265zM1152 1171q-126 -99 -172 -249.5t-0.5 -300.5t172.5 -249
+q127 99 172.5 249t-0.5 300.5t-172 249.5zM1185 1195q130 -107 177.5 -265.5t0.5 -317t-178 -264.5q128 -85 281 -85q104 0 198 40.5t162 108.5t108.5 162t40.5 198q0 103 -40.5 197t-108.5 162t-162.5 108.5t-197.5 40.5q-153 0 -281 -85zM1926 473h7v3h-17v-3h7v-17h3v17z
+M1955 456h4v20h-5l-6 -13l-6 13h-5v-20h3v15l6 -13h4l5 13v-15zM1947 16v-2h-2h-3v3h3h2v-1zM1947 7h3l-4 5h2l1 1q1 1 1 3t-1 3l-1 1h-3h-6v-13h3v5h1zM685 75q0 19 11 31t30 12q18 0 29 -12.5t11 -30.5q0 -19 -11 -31t-29 -12q-19 0 -30 12t-11 31zM1158 119q30 0 35 -32
+h-70q5 32 35 32zM1514 75q0 19 11 31t29 12t29.5 -12.5t11.5 -30.5q0 -19 -11 -31t-30 -12q-18 0 -29 12t-11 31zM1786 75q0 18 11.5 30.5t29.5 12.5t29.5 -12.5t11.5 -30.5q0 -19 -11.5 -31t-29.5 -12t-29.5 12.5t-11.5 30.5zM1944 3q-2 0 -4 1q-1 0 -3 2t-2 3q-1 2 -1 4
+q0 3 1 4q0 2 2 4l1 1q2 0 2 1q2 1 4 1q3 0 4 -1l4 -2l2 -4v-1q1 -2 1 -3l-1 -1v-3t-1 -1l-1 -2q-2 -2 -4 -2q-1 -1 -4 -1zM599 7h30v85q0 24 -14.5 38.5t-39.5 15.5q-32 0 -47 -24q-14 24 -45 24q-24 0 -39 -20v16h-30v-135h30v75q0 36 33 36q30 0 30 -36v-75h29v75
+q0 36 33 36q30 0 30 -36v-75zM765 7h29v68v67h-29v-16q-17 20 -43 20q-29 0 -48 -20t-19 -51t19 -51t48 -20q28 0 43 20v-17zM943 48q0 34 -47 40l-14 2q-23 4 -23 14q0 15 25 15q23 0 43 -11l12 24q-22 14 -55 14q-26 0 -41 -12t-15 -32q0 -33 47 -39l13 -2q24 -4 24 -14
+q0 -17 -31 -17q-25 0 -45 14l-13 -23q25 -17 58 -17q29 0 45.5 12t16.5 32zM1073 14l-8 25q-13 -7 -26 -7q-19 0 -19 22v61h48v27h-48v41h-30v-41h-28v-27h28v-61q0 -50 47 -50q21 0 36 10zM1159 146q-29 0 -48 -20t-19 -51q0 -32 19.5 -51.5t49.5 -19.5q33 0 55 19l-14 22
+q-18 -15 -39 -15q-34 0 -41 33h101v12q0 32 -18 51.5t-46 19.5zM1318 146q-23 0 -35 -20v16h-30v-135h30v76q0 35 29 35q10 0 18 -4l9 28q-9 4 -21 4zM1348 75q0 -31 19.5 -51t52.5 -20q29 0 48 16l-14 24q-18 -13 -35 -12q-18 0 -29.5 12t-11.5 31t11.5 31t29.5 12
+q19 0 35 -12l14 24q-20 16 -48 16q-33 0 -52.5 -20t-19.5 -51zM1593 7h30v68v67h-30v-16q-15 20 -42 20q-29 0 -48.5 -20t-19.5 -51t19.5 -51t48.5 -20q28 0 42 20v-17zM1726 146q-23 0 -35 -20v16h-29v-135h29v76q0 35 29 35q10 0 18 -4l9 28q-8 4 -21 4zM1866 7h29v68v122
+h-29v-71q-15 20 -43 20t-47.5 -20.5t-19.5 -50.5t19.5 -50.5t47.5 -20.5q29 0 43 20v-17zM1944 27l-2 -1h-3q-2 -1 -4 -3q-3 -1 -3 -4q-1 -2 -1 -6q0 -3 1 -5q0 -2 3 -4q2 -2 4 -3t5 -1q4 0 6 1q0 1 2 2l2 1q1 1 3 4q1 2 1 5q0 4 -1 6q-1 1 -3 4q0 1 -2 2l-2 1q-1 0 -3 0.5
+t-3 0.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_467" unicode="&#xf1f2;" horiz-adv-x="2304" 
+d="M313 759q0 -51 -36 -84q-29 -26 -89 -26h-17v220h17q61 0 89 -27q36 -31 36 -83zM2089 824q0 -52 -64 -52h-19v101h20q63 0 63 -49zM380 759q0 74 -50 120.5t-129 46.5h-95v-333h95q74 0 119 38q60 51 60 128zM410 593h65v333h-65v-333zM730 694q0 40 -20.5 62t-75.5 42
+q-29 10 -39.5 19t-10.5 23q0 16 13.5 26.5t34.5 10.5q29 0 53 -27l34 44q-41 37 -98 37q-44 0 -74 -27.5t-30 -67.5q0 -35 18 -55.5t64 -36.5q37 -13 45 -19q19 -12 19 -34q0 -20 -14 -33.5t-36 -13.5q-48 0 -71 44l-42 -40q44 -64 115 -64q51 0 83 30.5t32 79.5zM1008 604
+v77q-37 -37 -78 -37q-49 0 -80.5 32.5t-31.5 82.5q0 48 31.5 81.5t77.5 33.5q43 0 81 -38v77q-40 20 -80 20q-74 0 -125.5 -50.5t-51.5 -123.5t51 -123.5t125 -50.5q42 0 81 19zM2240 0v527q-65 -40 -144.5 -84t-237.5 -117t-329.5 -137.5t-417.5 -134.5t-504 -118h1569
+q26 0 45 19t19 45zM1389 757q0 75 -53 128t-128 53t-128 -53t-53 -128t53 -128t128 -53t128 53t53 128zM1541 584l144 342h-71l-90 -224l-89 224h-71l142 -342h35zM1714 593h184v56h-119v90h115v56h-115v74h119v57h-184v-333zM2105 593h80l-105 140q76 16 76 94q0 47 -31 73
+t-87 26h-97v-333h65v133h9zM2304 1274v-1268q0 -56 -38.5 -95t-93.5 -39h-2040q-55 0 -93.5 39t-38.5 95v1268q0 56 38.5 95t93.5 39h2040q55 0 93.5 -39t38.5 -95z" />
+    <glyph glyph-name="f1f3" unicode="&#xf1f3;" horiz-adv-x="2304" 
+d="M119 854h89l-45 108zM740 328l74 79l-70 79h-163v-49h142v-55h-142v-54h159zM898 406l99 -110v217zM1186 453q0 33 -40 33h-84v-69h83q41 0 41 36zM1475 457q0 29 -42 29h-82v-61h81q43 0 43 32zM1197 923q0 29 -42 29h-82v-60h81q43 0 43 31zM1656 854h89l-44 108z
+M699 1009v-271h-66v212l-94 -212h-57l-94 212v-212h-132l-25 60h-135l-25 -60h-70l116 271h96l110 -257v257h106l85 -184l77 184h108zM1255 453q0 -20 -5.5 -35t-14 -25t-22.5 -16.5t-26 -10t-31.5 -4.5t-31.5 -1t-32.5 0.5t-29.5 0.5v-91h-126l-80 90l-83 -90h-256v271h260
+l80 -89l82 89h207q109 0 109 -89zM964 794v-56h-217v271h217v-57h-152v-49h148v-55h-148v-54h152zM2304 235v-229q0 -55 -38.5 -94.5t-93.5 -39.5h-2040q-55 0 -93.5 39.5t-38.5 94.5v678h111l25 61h55l25 -61h218v46l19 -46h113l20 47v-47h541v99l10 1q10 0 10 -14v-86h279
+v23q23 -12 55 -18t52.5 -6.5t63 0.5t51.5 1l25 61h56l25 -61h227v58l34 -58h182v378h-180v-44l-25 44h-185v-44l-23 44h-249q-69 0 -109 -22v22h-172v-22q-24 22 -73 22h-628l-43 -97l-43 97h-198v-44l-22 44h-169l-78 -179v391q0 55 38.5 94.5t93.5 39.5h2040
+q55 0 93.5 -39.5t38.5 -94.5v-678h-120q-51 0 -81 -22v22h-177q-55 0 -78 -22v22h-316v-22q-31 22 -87 22h-209v-22q-23 22 -91 22h-234l-54 -58l-50 58h-349v-378h343l55 59l52 -59h211v89h21q59 0 90 13v-102h174v99h8q8 0 10 -2t2 -10v-87h529q57 0 88 24v-24h168
+q60 0 95 17zM1546 469q0 -23 -12 -43t-34 -29q25 -9 34 -26t9 -46v-54h-65v45q0 33 -12 43.5t-46 10.5h-69v-99h-65v271h154q48 0 77 -15t29 -58zM1269 936q0 -24 -12.5 -44t-33.5 -29q26 -9 34.5 -25.5t8.5 -46.5v-53h-65q0 9 0.5 26.5t0 25t-3 18.5t-8.5 16t-17.5 8.5
+t-29.5 3.5h-70v-98h-64v271l153 -1q49 0 78 -14.5t29 -57.5zM1798 327v-56h-216v271h216v-56h-151v-49h148v-55h-148v-54zM1372 1009v-271h-66v271h66zM2065 357q0 -86 -102 -86h-126v58h126q34 0 34 25q0 16 -17 21t-41.5 5t-49.5 3.5t-42 22.5t-17 55q0 39 26 60t66 21
+h130v-57h-119q-36 0 -36 -25q0 -16 17.5 -20.5t42 -4t49 -2.5t42 -21.5t17.5 -54.5zM2304 407v-101q-24 -35 -88 -35h-125v58h125q33 0 33 25q0 13 -12.5 19t-31 5.5t-40 2t-40 8t-31 24t-12.5 48.5q0 39 26.5 60t66.5 21h129v-57h-118q-36 0 -36 -25q0 -20 29 -22t68.5 -5
+t56.5 -26zM2139 1008v-270h-92l-122 203v-203h-132l-26 60h-134l-25 -60h-75q-129 0 -129 133q0 138 133 138h63v-59q-7 0 -28 1t-28.5 0.5t-23 -2t-21.5 -6.5t-14.5 -13.5t-11.5 -23t-3 -33.5q0 -38 13.5 -58t49.5 -20h29l92 213h97l109 -256v256h99l114 -188v188h66z" />
+    <glyph glyph-name="_469" unicode="&#xf1f4;" horiz-adv-x="2304" 
+d="M745 630q0 -37 -25.5 -61.5t-62.5 -24.5q-29 0 -46.5 16t-17.5 44q0 37 25 62.5t62 25.5q28 0 46.5 -16.5t18.5 -45.5zM1530 779q0 -42 -22 -57t-66 -15l-32 -1l17 107q2 11 13 11h18q22 0 35 -2t25 -12.5t12 -30.5zM1881 630q0 -36 -25.5 -61t-61.5 -25q-29 0 -47 16
+t-18 44q0 37 25 62.5t62 25.5q28 0 46.5 -16.5t18.5 -45.5zM513 801q0 59 -38.5 85.5t-100.5 26.5h-160q-19 0 -21 -19l-65 -408q-1 -6 3 -11t10 -5h76q20 0 22 19l18 110q1 8 7 13t15 6.5t17 1.5t19 -1t14 -1q86 0 135 48.5t49 134.5zM822 489l41 261q1 6 -3 11t-10 5h-76
+q-14 0 -17 -33q-27 40 -95 40q-72 0 -122.5 -54t-50.5 -127q0 -59 34.5 -94t92.5 -35q28 0 58 12t48 32q-4 -12 -4 -21q0 -16 13 -16h69q19 0 22 19zM1269 752q0 5 -4 9.5t-9 4.5h-77q-11 0 -18 -10l-106 -156l-44 150q-5 16 -22 16h-75q-5 0 -9 -4.5t-4 -9.5q0 -2 19.5 -59
+t42 -123t23.5 -70q-82 -112 -82 -120q0 -13 13 -13h77q11 0 18 10l255 368q2 2 2 7zM1649 801q0 59 -38.5 85.5t-100.5 26.5h-159q-20 0 -22 -19l-65 -408q-1 -6 3 -11t10 -5h82q12 0 16 13l18 116q1 8 7 13t15 6.5t17 1.5t19 -1t14 -1q86 0 135 48.5t49 134.5zM1958 489
+l41 261q1 6 -3 11t-10 5h-76q-14 0 -17 -33q-26 40 -95 40q-72 0 -122.5 -54t-50.5 -127q0 -59 34.5 -94t92.5 -35q29 0 59 12t47 32q0 -1 -2 -9t-2 -12q0 -16 13 -16h69q19 0 22 19zM2176 898v1q0 14 -13 14h-74q-11 0 -13 -11l-65 -416l-1 -2q0 -5 4 -9.5t10 -4.5h66
+q19 0 21 19zM392 764q-5 -35 -26 -46t-60 -11l-33 -1l17 107q2 11 13 11h19q40 0 58 -11.5t12 -48.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_470" unicode="&#xf1f5;" horiz-adv-x="2304" 
+d="M1597 633q0 -69 -21 -106q-19 -35 -52 -35q-23 0 -41 9v224q29 30 57 30q57 0 57 -122zM2035 669h-110q6 98 56 98q51 0 54 -98zM476 534q0 59 -33 91.5t-101 57.5q-36 13 -52 24t-16 25q0 26 38 26q58 0 124 -33l18 112q-67 32 -149 32q-77 0 -123 -38q-48 -39 -48 -109
+q0 -58 32.5 -90.5t99.5 -56.5q39 -14 54.5 -25.5t15.5 -27.5q0 -31 -48 -31q-29 0 -70 12.5t-72 30.5l-18 -113q72 -41 168 -41q81 0 129 37q51 41 51 117zM771 749l19 111h-96v135l-129 -21l-18 -114l-46 -8l-17 -103h62v-219q0 -84 44 -120q38 -30 111 -30q32 0 79 11v118
+q-32 -7 -44 -7q-42 0 -42 50v197h77zM1087 724v139q-15 3 -28 3q-32 0 -55.5 -16t-33.5 -46l-10 56h-131v-471h150v306q26 31 82 31q16 0 26 -2zM1124 389h150v471h-150v-471zM1746 638q0 122 -45 179q-40 52 -111 52q-64 0 -117 -56l-8 47h-132v-645l150 25v151
+q36 -11 68 -11q83 0 134 56q61 65 61 202zM1278 986q0 33 -23 56t-56 23t-56 -23t-23 -56t23 -56.5t56 -23.5t56 23.5t23 56.5zM2176 629q0 113 -48 176q-50 64 -144 64q-96 0 -151.5 -66t-55.5 -180q0 -128 63 -188q55 -55 161 -55q101 0 160 40l-16 103q-57 -31 -128 -31
+q-43 0 -63 19q-23 19 -28 66h248q2 14 2 52zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_471" unicode="&#xf1f6;" horiz-adv-x="2048" 
+d="M1558 684q61 -356 298 -556q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-180.5 74.5t-75.5 180.5zM1024 -176q16 0 16 16t-16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5zM2026 1424q8 -10 7.5 -23.5t-10.5 -22.5
+l-1872 -1622q-10 -8 -23.5 -7t-21.5 11l-84 96q-8 10 -7.5 23.5t10.5 21.5l186 161q-19 32 -19 66q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q124 -18 219 -82.5t148 -157.5
+l418 363q10 8 23.5 7t21.5 -11z" />
+    <glyph glyph-name="_472" unicode="&#xf1f7;" horiz-adv-x="2048" 
+d="M1040 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM503 315l877 760q-42 88 -132.5 146.5t-223.5 58.5q-93 0 -169.5 -31.5t-121.5 -80.5t-69 -103t-24 -105q0 -384 -137 -645zM1856 128
+q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-180.5 74.5t-75.5 180.5l149 129h757q-166 187 -227 459l111 97q61 -356 298 -556zM1942 1520l84 -96q8 -10 7.5 -23.5t-10.5 -22.5l-1872 -1622q-10 -8 -23.5 -7t-21.5 11l-84 96q-8 10 -7.5 23.5t10.5 21.5l186 161
+q-19 32 -19 66q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q124 -18 219 -82.5t148 -157.5l418 363q10 8 23.5 7t21.5 -11z" />
+    <glyph glyph-name="_473" unicode="&#xf1f8;" horiz-adv-x="1408" 
+d="M512 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM768 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1024 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704
+q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM480 1152h448l-48 117q-7 9 -17 11h-317q-10 -2 -17 -11zM1408 1120v-64q0 -14 -9 -23t-23 -9h-96v-948q0 -83 -47 -143.5t-113 -60.5h-832q-66 0 -113 58.5t-47 141.5v952h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h309l70 167
+q15 37 54 63t79 26h320q40 0 79 -26t54 -63l70 -167h309q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_474" unicode="&#xf1f9;" 
+d="M1150 462v-109q0 -50 -36.5 -89t-94 -60.5t-118 -32.5t-117.5 -11q-205 0 -342.5 139t-137.5 346q0 203 136 339t339 136q34 0 75.5 -4.5t93 -18t92.5 -34t69 -56.5t28 -81v-109q0 -16 -16 -16h-118q-16 0 -16 16v70q0 43 -65.5 67.5t-137.5 24.5q-140 0 -228.5 -91.5
+t-88.5 -237.5q0 -151 91.5 -249.5t233.5 -98.5q68 0 138 24t70 66v70q0 7 4.5 11.5t10.5 4.5h119q6 0 11 -4.5t5 -11.5zM768 1280q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5
+t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_475" unicode="&#xf1fa;" 
+d="M972 761q0 108 -53.5 169t-147.5 61q-63 0 -124 -30.5t-110 -84.5t-79.5 -137t-30.5 -180q0 -112 53.5 -173t150.5 -61q96 0 176 66.5t122.5 166t42.5 203.5zM1536 640q0 -111 -37 -197t-98.5 -135t-131.5 -74.5t-145 -27.5q-6 0 -15.5 -0.5t-16.5 -0.5q-95 0 -142 53
+q-28 33 -33 83q-52 -66 -131.5 -110t-173.5 -44q-161 0 -249.5 95.5t-88.5 269.5q0 157 66 290t179 210.5t246 77.5q87 0 155 -35.5t106 -99.5l2 19l11 56q1 6 5.5 12t9.5 6h118q5 0 13 -11q5 -5 3 -16l-120 -614q-5 -24 -5 -48q0 -39 12.5 -52t44.5 -13q28 1 57 5.5t73 24
+t77 50t57 89.5t24 137q0 292 -174 466t-466 174q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51q228 0 405 144q11 9 24 8t21 -12l41 -49q8 -12 7 -24q-2 -13 -12 -22q-102 -83 -227.5 -128t-258.5 -45q-156 0 -298 61
+t-245 164t-164 245t-61 298t61 298t164 245t245 164t298 61q344 0 556 -212t212 -556z" />
+    <glyph glyph-name="_476" unicode="&#xf1fb;" horiz-adv-x="1792" 
+d="M1698 1442q94 -94 94 -226.5t-94 -225.5l-225 -223l104 -104q10 -10 10 -23t-10 -23l-210 -210q-10 -10 -23 -10t-23 10l-105 105l-603 -603q-37 -37 -90 -37h-203l-256 -128l-64 64l128 256v203q0 53 37 90l603 603l-105 105q-10 10 -10 23t10 23l210 210q10 10 23 10
+t23 -10l104 -104l223 225q93 94 225.5 94t226.5 -94zM512 64l576 576l-192 192l-576 -576v-192h192z" />
+    <glyph glyph-name="f1fc" unicode="&#xf1fc;" horiz-adv-x="1792" 
+d="M1615 1536q70 0 122.5 -46.5t52.5 -116.5q0 -63 -45 -151q-332 -629 -465 -752q-97 -91 -218 -91q-126 0 -216.5 92.5t-90.5 219.5q0 128 92 212l638 579q59 54 130 54zM706 502q39 -76 106.5 -130t150.5 -76l1 -71q4 -213 -129.5 -347t-348.5 -134q-123 0 -218 46.5
+t-152.5 127.5t-86.5 183t-29 220q7 -5 41 -30t62 -44.5t59 -36.5t46 -17q41 0 55 37q25 66 57.5 112.5t69.5 76t88 47.5t103 25.5t125 10.5z" />
+    <glyph glyph-name="_478" unicode="&#xf1fd;" horiz-adv-x="1792" 
+d="M1792 128v-384h-1792v384q45 0 85 14t59 27.5t47 37.5q30 27 51.5 38t56.5 11q24 0 44 -7t31 -15t33 -27q29 -25 47 -38t58 -27t86 -14q45 0 85 14.5t58 27t48 37.5q21 19 32.5 27t31 15t43.5 7q35 0 56.5 -11t51.5 -38q28 -24 47 -37.5t59 -27.5t85 -14t85 14t59 27.5
+t47 37.5q30 27 51.5 38t56.5 11q34 0 55.5 -11t51.5 -38q28 -24 47 -37.5t59 -27.5t85 -14zM1792 448v-192q-24 0 -44 7t-31 15t-33 27q-29 25 -47 38t-58 27t-85 14q-46 0 -86 -14t-58 -27t-47 -38q-22 -19 -33 -27t-31 -15t-44 -7q-35 0 -56.5 11t-51.5 38q-29 25 -47 38
+t-58 27t-86 14q-45 0 -85 -14.5t-58 -27t-48 -37.5q-21 -19 -32.5 -27t-31 -15t-43.5 -7q-35 0 -56.5 11t-51.5 38q-28 24 -47 37.5t-59 27.5t-85 14q-46 0 -86 -14t-58 -27t-47 -38q-30 -27 -51.5 -38t-56.5 -11v192q0 80 56 136t136 56h64v448h256v-448h256v448h256v-448
+h256v448h256v-448h64q80 0 136 -56t56 -136zM512 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150zM1024 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5
+q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150zM1536 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150z" />
+    <glyph glyph-name="_479" unicode="&#xf1fe;" horiz-adv-x="2048" 
+d="M2048 0v-128h-2048v1536h128v-1408h1920zM1664 1024l256 -896h-1664v576l448 576l576 -576z" />
+    <glyph glyph-name="_480" unicode="&#xf200;" horiz-adv-x="1792" 
+d="M768 646l546 -546q-106 -108 -247.5 -168t-298.5 -60q-209 0 -385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103v-762zM955 640h773q0 -157 -60 -298.5t-168 -247.5zM1664 768h-768v768q209 0 385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_481" unicode="&#xf201;" horiz-adv-x="2048" 
+d="M2048 0v-128h-2048v1536h128v-1408h1920zM1920 1248v-435q0 -21 -19.5 -29.5t-35.5 7.5l-121 121l-633 -633q-10 -10 -23 -10t-23 10l-233 233l-416 -416l-192 192l585 585q10 10 23 10t23 -10l233 -233l464 464l-121 121q-16 16 -7.5 35.5t29.5 19.5h435q14 0 23 -9
+t9 -23z" />
+    <glyph glyph-name="_482" unicode="&#xf202;" horiz-adv-x="1792" 
+d="M1292 832q0 -6 10 -41q10 -29 25 -49.5t41 -34t44 -20t55 -16.5q325 -91 325 -332q0 -146 -105.5 -242.5t-254.5 -96.5q-59 0 -111.5 18.5t-91.5 45.5t-77 74.5t-63 87.5t-53.5 103.5t-43.5 103t-39.5 106.5t-35.5 95q-32 81 -61.5 133.5t-73.5 96.5t-104 64t-142 20
+q-96 0 -183 -55.5t-138 -144.5t-51 -185q0 -160 106.5 -279.5t263.5 -119.5q177 0 258 95q56 63 83 116l84 -152q-15 -34 -44 -70l1 -1q-131 -152 -388 -152q-147 0 -269.5 79t-190.5 207.5t-68 274.5q0 105 43.5 206t116 176.5t172 121.5t204.5 46q87 0 159 -19t123.5 -50
+t95 -80t72.5 -99t58.5 -117t50.5 -124.5t50 -130.5t55 -127q96 -200 233 -200q81 0 138.5 48.5t57.5 128.5q0 42 -19 72t-50.5 46t-72.5 31.5t-84.5 27t-87.5 34t-81 52t-65 82t-39 122.5q-3 16 -3 33q0 110 87.5 192t198.5 78q78 -3 120.5 -14.5t90.5 -53.5h-1
+q12 -11 23 -24.5t26 -36t19 -27.5l-129 -99q-26 49 -54 70v1q-23 21 -97 21q-49 0 -84 -33t-35 -83z" />
+    <glyph glyph-name="_483" unicode="&#xf203;" 
+d="M1432 484q0 173 -234 239q-35 10 -53 16.5t-38 25t-29 46.5q0 2 -2 8.5t-3 12t-1 7.5q0 36 24.5 59.5t60.5 23.5q54 0 71 -15h-1q20 -15 39 -51l93 71q-39 54 -49 64q-33 29 -67.5 39t-85.5 10q-80 0 -142 -57.5t-62 -137.5q0 -7 2 -23q16 -96 64.5 -140t148.5 -73
+q29 -8 49 -15.5t45 -21.5t38.5 -34.5t13.5 -46.5v-5q1 -58 -40.5 -93t-100.5 -35q-97 0 -167 144q-23 47 -51.5 121.5t-48 125.5t-54 110.5t-74 95.5t-103.5 60.5t-147 24.5q-101 0 -192 -56t-144 -148t-50 -192v-1q4 -108 50.5 -199t133.5 -147.5t196 -56.5q186 0 279 110
+q20 27 31 51l-60 109q-42 -80 -99 -116t-146 -36q-115 0 -191 87t-76 204q0 105 82 189t186 84q112 0 170 -53.5t104 -172.5q8 -21 25.5 -68.5t28.5 -76.5t31.5 -74.5t38.5 -74t45.5 -62.5t55.5 -53.5t66 -33t80 -13.5q107 0 183 69.5t76 174.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_484" unicode="&#xf204;" horiz-adv-x="2048" 
+d="M1152 640q0 104 -40.5 198.5t-109.5 163.5t-163.5 109.5t-198.5 40.5t-198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5t198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5zM1920 640q0 104 -40.5 198.5
+t-109.5 163.5t-163.5 109.5t-198.5 40.5h-386q119 -90 188.5 -224t69.5 -288t-69.5 -288t-188.5 -224h386q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5zM2048 640q0 -130 -51 -248.5t-136.5 -204t-204 -136.5t-248.5 -51h-768q-130 0 -248.5 51t-204 136.5
+t-136.5 204t-51 248.5t51 248.5t136.5 204t204 136.5t248.5 51h768q130 0 248.5 -51t204 -136.5t136.5 -204t51 -248.5z" />
+    <glyph glyph-name="_485" unicode="&#xf205;" horiz-adv-x="2048" 
+d="M0 640q0 130 51 248.5t136.5 204t204 136.5t248.5 51h768q130 0 248.5 -51t204 -136.5t136.5 -204t51 -248.5t-51 -248.5t-136.5 -204t-204 -136.5t-248.5 -51h-768q-130 0 -248.5 51t-204 136.5t-136.5 204t-51 248.5zM1408 128q104 0 198.5 40.5t163.5 109.5
+t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5t-163.5 109.5t-198.5 40.5t-198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5z" />
+    <glyph glyph-name="_486" unicode="&#xf206;" horiz-adv-x="2304" 
+d="M762 384h-314q-40 0 -57.5 35t6.5 67l188 251q-65 31 -137 31q-132 0 -226 -94t-94 -226t94 -226t226 -94q115 0 203 72.5t111 183.5zM576 512h186q-18 85 -75 148zM1056 512l288 384h-480l-99 -132q105 -103 126 -252h165zM2176 448q0 132 -94 226t-226 94
+q-60 0 -121 -24l174 -260q15 -23 10 -49t-27 -40q-15 -11 -36 -11q-35 0 -53 29l-174 260q-93 -95 -93 -225q0 -132 94 -226t226 -94t226 94t94 226zM2304 448q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 97 39.5 183.5t109.5 149.5l-65 98l-353 -469
+q-18 -26 -51 -26h-197q-23 -164 -149 -274t-294 -110q-185 0 -316.5 131.5t-131.5 316.5t131.5 316.5t316.5 131.5q114 0 215 -55l137 183h-224q-26 0 -45 19t-19 45t19 45t45 19h384v-128h435l-85 128h-222q-26 0 -45 19t-19 45t19 45t45 19h256q33 0 53 -28l267 -400
+q91 44 192 44q185 0 316.5 -131.5t131.5 -316.5z" />
+    <glyph glyph-name="_487" unicode="&#xf207;" 
+d="M384 320q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1408 320q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1362 716l-72 384q-5 23 -22.5 37.5t-40.5 14.5
+h-918q-23 0 -40.5 -14.5t-22.5 -37.5l-72 -384q-5 -30 14 -53t49 -23h1062q30 0 49 23t14 53zM1136 1328q0 20 -14 34t-34 14h-640q-20 0 -34 -14t-14 -34t14 -34t34 -14h640q20 0 34 14t14 34zM1536 603v-603h-128v-128q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5v128h-768v-128q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5v128h-128v603q0 112 25 223l103 454q9 78 97.5 137t230 89t312.5 30t312.5 -30t230 -89t97.5 -137l105 -454q23 -102 23 -223z" />
+    <glyph glyph-name="_488" unicode="&#xf208;" horiz-adv-x="2048" 
+d="M1463 704q0 -35 -25 -60.5t-61 -25.5h-702q-36 0 -61 25.5t-25 60.5t25 60.5t61 25.5h702q36 0 61 -25.5t25 -60.5zM1677 704q0 86 -23 170h-982q-36 0 -61 25t-25 60q0 36 25 61t61 25h908q-88 143 -235 227t-320 84q-177 0 -327.5 -87.5t-238 -237.5t-87.5 -327
+q0 -86 23 -170h982q36 0 61 -25t25 -60q0 -36 -25 -61t-61 -25h-908q88 -143 235.5 -227t320.5 -84q132 0 253 51.5t208 139t139 208t52 253.5zM2048 959q0 -35 -25 -60t-61 -25h-131q17 -85 17 -170q0 -167 -65.5 -319.5t-175.5 -263t-262.5 -176t-319.5 -65.5
+q-246 0 -448.5 133t-301.5 350h-189q-36 0 -61 25t-25 61q0 35 25 60t61 25h132q-17 85 -17 170q0 167 65.5 319.5t175.5 263t262.5 176t320.5 65.5q245 0 447.5 -133t301.5 -350h188q36 0 61 -25t25 -61z" />
+    <glyph glyph-name="_489" unicode="&#xf209;" horiz-adv-x="1280" 
+d="M953 1158l-114 -328l117 -21q165 451 165 518q0 56 -38 56q-57 0 -130 -225zM654 471l33 -88q37 42 71 67l-33 5.5t-38.5 7t-32.5 8.5zM362 1367q0 -98 159 -521q17 10 49 10q15 0 75 -5l-121 351q-75 220 -123 220q-19 0 -29 -17.5t-10 -37.5zM283 608q0 -36 51.5 -119
+t117.5 -153t100 -70q14 0 25.5 13t11.5 27q0 24 -32 102q-13 32 -32 72t-47.5 89t-61.5 81t-62 32q-20 0 -45.5 -27t-25.5 -47zM125 273q0 -41 25 -104q59 -145 183.5 -227t281.5 -82q227 0 382 170q152 169 152 427q0 43 -1 67t-11.5 62t-30.5 56q-56 49 -211.5 75.5
+t-270.5 26.5q-37 0 -49 -11q-12 -5 -12 -35q0 -34 21.5 -60t55.5 -40t77.5 -23.5t87.5 -11.5t85 -4t70 0h23q24 0 40 -19q15 -19 19 -55q-28 -28 -96 -54q-61 -22 -93 -46q-64 -46 -108.5 -114t-44.5 -137q0 -31 18.5 -88.5t18.5 -87.5l-3 -12q-4 -12 -4 -14
+q-137 10 -146 216q-8 -2 -41 -2q2 -7 2 -21q0 -53 -40.5 -89.5t-94.5 -36.5q-82 0 -166.5 78t-84.5 159q0 34 33 67q52 -64 60 -76q77 -104 133 -104q12 0 26.5 8.5t14.5 20.5q0 34 -87.5 145t-116.5 111q-43 0 -70 -44.5t-27 -90.5zM11 264q0 101 42.5 163t136.5 88
+q-28 74 -28 104q0 62 61 123t122 61q29 0 70 -15q-163 462 -163 567q0 80 41 130.5t119 50.5q131 0 325 -581q6 -17 8 -23q6 16 29 79.5t43.5 118.5t54 127.5t64.5 123t70.5 86.5t76.5 36q71 0 112 -49t41 -122q0 -108 -159 -550q61 -15 100.5 -46t58.5 -78t26 -93.5
+t7 -110.5q0 -150 -47 -280t-132 -225t-211 -150t-278 -55q-111 0 -223 42q-149 57 -258 191.5t-109 286.5z" />
+    <glyph glyph-name="_490" unicode="&#xf20a;" horiz-adv-x="2048" 
+d="M785 528h207q-14 -158 -98.5 -248.5t-214.5 -90.5q-162 0 -254.5 116t-92.5 316q0 194 93 311.5t233 117.5q148 0 232 -87t97 -247h-203q-5 64 -35.5 99t-81.5 35q-57 0 -88.5 -60.5t-31.5 -177.5q0 -48 5 -84t18 -69.5t40 -51.5t66 -18q95 0 109 139zM1497 528h206
+q-14 -158 -98 -248.5t-214 -90.5q-162 0 -254.5 116t-92.5 316q0 194 93 311.5t233 117.5q148 0 232 -87t97 -247h-204q-4 64 -35 99t-81 35q-57 0 -88.5 -60.5t-31.5 -177.5q0 -48 5 -84t18 -69.5t39.5 -51.5t65.5 -18q49 0 76.5 38t33.5 101zM1856 647q0 207 -15.5 307
+t-60.5 161q-6 8 -13.5 14t-21.5 15t-16 11q-86 63 -697 63q-625 0 -710 -63q-5 -4 -17.5 -11.5t-21 -14t-14.5 -14.5q-45 -60 -60 -159.5t-15 -308.5q0 -208 15 -307.5t60 -160.5q6 -8 15 -15t20.5 -14t17.5 -12q44 -33 239.5 -49t470.5 -16q610 0 697 65q5 4 17 11t20.5 14
+t13.5 16q46 60 61 159t15 309zM2048 1408v-1536h-2048v1536h2048z" />
+    <glyph glyph-name="_491" unicode="&#xf20b;" 
+d="M992 912v-496q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v496q0 112 -80 192t-192 80h-272v-1152q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v1344q0 14 9 23t23 9h464q135 0 249 -66.5t180.5 -180.5t66.5 -249zM1376 1376v-880q0 -135 -66.5 -249t-180.5 -180.5
+t-249 -66.5h-464q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h160q14 0 23 -9t9 -23v-768h272q112 0 192 80t80 192v880q0 14 9 23t23 9h160q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_492" unicode="&#xf20c;" 
+d="M1311 694v-114q0 -24 -13.5 -38t-37.5 -14h-202q-24 0 -38 14t-14 38v114q0 24 14 38t38 14h202q24 0 37.5 -14t13.5 -38zM821 464v250q0 53 -32.5 85.5t-85.5 32.5h-133q-68 0 -96 -52q-28 52 -96 52h-130q-53 0 -85.5 -32.5t-32.5 -85.5v-250q0 -22 21 -22h55
+q22 0 22 22v230q0 24 13.5 38t38.5 14h94q24 0 38 -14t14 -38v-230q0 -22 21 -22h54q22 0 22 22v230q0 24 14 38t38 14h97q24 0 37.5 -14t13.5 -38v-230q0 -22 22 -22h55q21 0 21 22zM1410 560v154q0 53 -33 85.5t-86 32.5h-264q-53 0 -86 -32.5t-33 -85.5v-410
+q0 -21 22 -21h55q21 0 21 21v180q31 -42 94 -42h191q53 0 86 32.5t33 85.5zM1536 1176v-1072q0 -96 -68 -164t-164 -68h-1072q-96 0 -164 68t-68 164v1072q0 96 68 164t164 68h1072q96 0 164 -68t68 -164z" />
+    <glyph glyph-name="_493" unicode="&#xf20d;" 
+d="M915 450h-294l147 551zM1001 128h311l-324 1024h-440l-324 -1024h311l383 314zM1536 1120v-960q0 -118 -85 -203t-203 -85h-960q-118 0 -203 85t-85 203v960q0 118 85 203t203 85h960q118 0 203 -85t85 -203z" />
+    <glyph glyph-name="_494" unicode="&#xf20e;" horiz-adv-x="2048" 
+d="M2048 641q0 -21 -13 -36.5t-33 -19.5l-205 -356q3 -9 3 -18q0 -20 -12.5 -35.5t-32.5 -19.5l-193 -337q3 -8 3 -16q0 -23 -16.5 -40t-40.5 -17q-25 0 -41 18h-400q-17 -20 -43 -20t-43 20h-399q-17 -20 -43 -20q-23 0 -40 16.5t-17 40.5q0 8 4 20l-193 335
+q-20 4 -32.5 19.5t-12.5 35.5q0 9 3 18l-206 356q-20 5 -32.5 20.5t-12.5 35.5q0 21 13.5 36.5t33.5 19.5l199 344q0 1 -0.5 3t-0.5 3q0 36 34 51l209 363q-4 10 -4 18q0 24 17 40.5t40 16.5q26 0 44 -21h396q16 21 43 21t43 -21h398q18 21 44 21q23 0 40 -16.5t17 -40.5
+q0 -6 -4 -18l207 -358q23 -1 39 -17.5t16 -38.5q0 -13 -7 -27l187 -324q19 -4 31.5 -19.5t12.5 -35.5zM1063 -158h389l-342 354h-143l-342 -354h360q18 16 39 16t39 -16zM112 654q1 -4 1 -13q0 -10 -2 -15l208 -360l15 -6l188 199v347l-187 194q-13 -8 -29 -10zM986 1438
+h-388l190 -200l554 200h-280q-16 -16 -38 -16t-38 16zM1689 226q1 6 5 11l-64 68l-17 -79h76zM1583 226l22 105l-252 266l-296 -307l63 -64h463zM1495 -142l16 28l65 310h-427l333 -343q8 4 13 5zM578 -158h5l342 354h-373v-335l4 -6q14 -5 22 -13zM552 226h402l64 66
+l-309 321l-157 -166v-221zM359 226h163v189l-168 -177q4 -8 5 -12zM358 1051q0 -1 0.5 -2t0.5 -2q0 -16 -8 -29l171 -177v269zM552 1121v-311l153 -157l297 314l-223 236zM556 1425l-4 -8v-264l205 74l-191 201q-6 -2 -10 -3zM1447 1438h-16l-621 -224l213 -225zM1023 946
+l-297 -315l311 -319l296 307zM688 634l-136 141v-284zM1038 270l-42 -44h85zM1374 618l238 -251l132 624l-3 5l-1 1zM1718 1018q-8 13 -8 29v2l-216 376q-5 1 -13 5l-437 -463l310 -327zM522 1142v223l-163 -282zM522 196h-163l163 -283v283zM1607 196l-48 -227l130 227h-82
+zM1729 266l207 361q-2 10 -2 14q0 1 3 16l-171 296l-129 -612l77 -82q5 3 15 7z" />
+    <glyph glyph-name="f210" unicode="&#xf210;" 
+d="M0 856q0 131 91.5 226.5t222.5 95.5h742l352 358v-1470q0 -132 -91.5 -227t-222.5 -95h-780q-131 0 -222.5 95t-91.5 227v790zM1232 102l-176 180v425q0 46 -32 79t-78 33h-484q-46 0 -78 -33t-32 -79v-492q0 -46 32.5 -79.5t77.5 -33.5h770z" />
+    <glyph glyph-name="_496" unicode="&#xf211;" 
+d="M934 1386q-317 -121 -556 -362.5t-358 -560.5q-20 89 -20 176q0 208 102.5 384.5t278.5 279t384 102.5q82 0 169 -19zM1203 1267q93 -65 164 -155q-389 -113 -674.5 -400.5t-396.5 -676.5q-93 72 -155 162q112 386 395 671t667 399zM470 -67q115 356 379.5 622t619.5 384
+q40 -92 54 -195q-292 -120 -516 -345t-343 -518q-103 14 -194 52zM1536 -125q-193 50 -367 115q-135 -84 -290 -107q109 205 274 370.5t369 275.5q-21 -152 -101 -284q65 -175 115 -370z" />
+    <glyph glyph-name="f212" unicode="&#xf212;" horiz-adv-x="2048" 
+d="M1893 1144l155 -1272q-131 0 -257 57q-200 91 -393 91q-226 0 -374 -148q-148 148 -374 148q-193 0 -393 -91q-128 -57 -252 -57h-5l155 1272q224 127 482 127q233 0 387 -106q154 106 387 106q258 0 482 -127zM1398 157q129 0 232 -28.5t260 -93.5l-124 1021
+q-171 78 -368 78q-224 0 -374 -141q-150 141 -374 141q-197 0 -368 -78l-124 -1021q105 43 165.5 65t148.5 39.5t178 17.5q202 0 374 -108q172 108 374 108zM1438 191l-55 907q-211 -4 -359 -155q-152 155 -374 155q-176 0 -336 -66l-114 -941q124 51 228.5 76t221.5 25
+q209 0 374 -102q172 107 374 102z" />
+    <glyph glyph-name="_498" unicode="&#xf213;" horiz-adv-x="2048" 
+d="M1500 165v733q0 21 -15 36t-35 15h-93q-20 0 -35 -15t-15 -36v-733q0 -20 15 -35t35 -15h93q20 0 35 15t15 35zM1216 165v531q0 20 -15 35t-35 15h-101q-20 0 -35 -15t-15 -35v-531q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM924 165v429q0 20 -15 35t-35 15h-101
+q-20 0 -35 -15t-15 -35v-429q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM632 165v362q0 20 -15 35t-35 15h-101q-20 0 -35 -15t-15 -35v-362q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM2048 311q0 -166 -118 -284t-284 -118h-1244q-166 0 -284 118t-118 284
+q0 116 63 214.5t168 148.5q-10 34 -10 73q0 113 80.5 193.5t193.5 80.5q102 0 180 -67q45 183 194 300t338 117q149 0 275 -73.5t199.5 -199.5t73.5 -275q0 -66 -14 -122q135 -33 221 -142.5t86 -247.5z" />
+    <glyph glyph-name="_499" unicode="&#xf214;" 
+d="M0 1536h1536v-1392l-776 -338l-760 338v1392zM1436 209v926h-1336v-926l661 -294zM1436 1235v201h-1336v-201h1336zM181 937v-115h-37v115h37zM181 789v-115h-37v115h37zM181 641v-115h-37v115h37zM181 493v-115h-37v115h37zM181 345v-115h-37v115h37zM207 202l15 34
+l105 -47l-15 -33zM343 142l15 34l105 -46l-15 -34zM478 82l15 34l105 -46l-15 -34zM614 23l15 33l104 -46l-15 -34zM797 10l105 46l15 -33l-105 -47zM932 70l105 46l15 -34l-105 -46zM1068 130l105 46l15 -34l-105 -46zM1203 189l105 47l15 -34l-105 -46zM259 1389v-36h-114
+v36h114zM421 1389v-36h-115v36h115zM583 1389v-36h-115v36h115zM744 1389v-36h-114v36h114zM906 1389v-36h-114v36h114zM1068 1389v-36h-115v36h115zM1230 1389v-36h-115v36h115zM1391 1389v-36h-114v36h114zM181 1049v-79h-37v115h115v-36h-78zM421 1085v-36h-115v36h115z
+M583 1085v-36h-115v36h115zM744 1085v-36h-114v36h114zM906 1085v-36h-114v36h114zM1068 1085v-36h-115v36h115zM1230 1085v-36h-115v36h115zM1355 970v79h-78v36h115v-115h-37zM1355 822v115h37v-115h-37zM1355 674v115h37v-115h-37zM1355 526v115h37v-115h-37zM1355 378
+v115h37v-115h-37zM1355 230v115h37v-115h-37zM760 265q-129 0 -221 91.5t-92 221.5q0 129 92 221t221 92q130 0 221.5 -92t91.5 -221q0 -130 -91.5 -221.5t-221.5 -91.5zM595 646q0 -36 19.5 -56.5t49.5 -25t64 -7t64 -2t49.5 -9t19.5 -30.5q0 -49 -112 -49q-97 0 -123 51
+h-3l-31 -63q67 -42 162 -42q29 0 56.5 5t55.5 16t45.5 33t17.5 53q0 46 -27.5 69.5t-67.5 27t-79.5 3t-67 5t-27.5 25.5q0 21 20.5 33t40.5 15t41 3q34 0 70.5 -11t51.5 -34h3l30 58q-3 1 -21 8.5t-22.5 9t-19.5 7t-22 7t-20 4.5t-24 4t-23 1q-29 0 -56.5 -5t-54 -16.5
+t-43 -34t-16.5 -53.5z" />
+    <glyph glyph-name="_500" unicode="&#xf215;" horiz-adv-x="2048" 
+d="M863 504q0 112 -79.5 191.5t-191.5 79.5t-191 -79.5t-79 -191.5t79 -191t191 -79t191.5 79t79.5 191zM1726 505q0 112 -79 191t-191 79t-191.5 -79t-79.5 -191q0 -113 79.5 -192t191.5 -79t191 79.5t79 191.5zM2048 1314v-1348q0 -44 -31.5 -75.5t-76.5 -31.5h-1832
+q-45 0 -76.5 31.5t-31.5 75.5v1348q0 44 31.5 75.5t76.5 31.5h431q44 0 76 -31.5t32 -75.5v-161h754v161q0 44 32 75.5t76 31.5h431q45 0 76.5 -31.5t31.5 -75.5z" />
+    <glyph glyph-name="_501" unicode="&#xf216;" horiz-adv-x="2048" 
+d="M1430 953zM1690 749q148 0 253 -98.5t105 -244.5q0 -157 -109 -261.5t-267 -104.5q-85 0 -162 27.5t-138 73.5t-118 106t-109 126t-103.5 132.5t-108.5 126.5t-117 106t-136 73.5t-159 27.5q-154 0 -251.5 -91.5t-97.5 -244.5q0 -157 104 -250t263 -93q100 0 208 37.5
+t193 98.5q5 4 21 18.5t30 24t22 9.5q14 0 24.5 -10.5t10.5 -24.5q0 -24 -60 -77q-101 -88 -234.5 -142t-260.5 -54q-133 0 -245.5 58t-180 165t-67.5 241q0 205 141.5 341t347.5 136q120 0 226.5 -43.5t185.5 -113t151.5 -153t139 -167.5t133.5 -153.5t149.5 -113
+t172.5 -43.5q102 0 168.5 61.5t66.5 162.5q0 95 -64.5 159t-159.5 64q-30 0 -81.5 -18.5t-68.5 -18.5q-20 0 -35.5 15t-15.5 35q0 18 8.5 57t8.5 59q0 159 -107.5 263t-266.5 104q-58 0 -111.5 -18.5t-84 -40.5t-55.5 -40.5t-33 -18.5q-15 0 -25.5 10.5t-10.5 25.5
+q0 19 25 46q59 67 147 103.5t182 36.5q191 0 318 -125.5t127 -315.5q0 -37 -4 -66q57 15 115 15z" />
+    <glyph glyph-name="_502" unicode="&#xf217;" horiz-adv-x="1664" 
+d="M1216 832q0 26 -19 45t-45 19h-128v128q0 26 -19 45t-45 19t-45 -19t-19 -45v-128h-128q-26 0 -45 -19t-19 -45t19 -45t45 -19h128v-128q0 -26 19 -45t45 -19t45 19t19 45v128h128q26 0 45 19t19 45zM640 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1536 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1664 1088v-512q0 -24 -16 -42.5t-41 -21.5l-1044 -122q1 -7 4.5 -21.5t6 -26.5t2.5 -22q0 -16 -24 -64h920
+q26 0 45 -19t19 -45t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 14 11 39.5t29.5 59.5t20.5 38l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t20 -15.5t13 -24.5t7.5 -26.5t5.5 -29.5t4.5 -25.5h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="_503" unicode="&#xf218;" horiz-adv-x="1664" 
+d="M1280 832q0 26 -19 45t-45 19t-45 -19l-147 -146v293q0 26 -19 45t-45 19t-45 -19t-19 -45v-293l-147 146q-19 19 -45 19t-45 -19t-19 -45t19 -45l256 -256q19 -19 45 -19t45 19l256 256q19 19 19 45zM640 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1536 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1664 1088v-512q0 -24 -16 -42.5t-41 -21.5l-1044 -122q1 -7 4.5 -21.5t6 -26.5t2.5 -22q0 -16 -24 -64h920
+q26 0 45 -19t19 -45t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 14 11 39.5t29.5 59.5t20.5 38l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t20 -15.5t13 -24.5t7.5 -26.5t5.5 -29.5t4.5 -25.5h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="_504" unicode="&#xf219;" horiz-adv-x="2048" 
+d="M212 768l623 -665l-300 665h-323zM1024 -4l349 772h-698zM538 896l204 384h-262l-288 -384h346zM1213 103l623 665h-323zM683 896h682l-204 384h-274zM1510 896h346l-288 384h-262zM1651 1382l384 -512q14 -18 13 -41.5t-17 -40.5l-960 -1024q-18 -20 -47 -20t-47 20
+l-960 1024q-16 17 -17 40.5t13 41.5l384 512q18 26 51 26h1152q33 0 51 -26z" />
+    <glyph glyph-name="_505" unicode="&#xf21a;" horiz-adv-x="2048" 
+d="M1811 -19q19 19 45 19t45 -19l128 -128l-90 -90l-83 83l-83 -83q-18 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83
+q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-128 128l90 90l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83
+q19 19 45 19t45 -19l83 -83zM237 19q-19 -19 -45 -19t-45 19l-128 128l90 90l83 -82l83 82q19 19 45 19t45 -19l83 -82l64 64v293l-210 314q-17 26 -7 56.5t40 40.5l177 58v299h128v128h256v128h256v-128h256v-128h128v-299l177 -58q30 -10 40 -40.5t-7 -56.5l-210 -314
+v-293l19 18q19 19 45 19t45 -19l83 -82l83 82q19 19 45 19t45 -19l128 -128l-90 -90l-83 83l-83 -83q-18 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83
+q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83zM640 1152v-128l384 128l384 -128v128h-128v128h-512v-128h-128z" />
+    <glyph glyph-name="_506" unicode="&#xf21b;" 
+d="M576 0l96 448l-96 128l-128 64zM832 0l128 640l-128 -64l-96 -128zM992 1010q-2 4 -4 6q-10 8 -96 8q-70 0 -167 -19q-7 -2 -21 -2t-21 2q-97 19 -167 19q-86 0 -96 -8q-2 -2 -4 -6q2 -18 4 -27q2 -3 7.5 -6.5t7.5 -10.5q2 -4 7.5 -20.5t7 -20.5t7.5 -17t8.5 -17t9 -14
+t12 -13.5t14 -9.5t17.5 -8t20.5 -4t24.5 -2q36 0 59 12.5t32.5 30t14.5 34.5t11.5 29.5t17.5 12.5h12q11 0 17.5 -12.5t11.5 -29.5t14.5 -34.5t32.5 -30t59 -12.5q13 0 24.5 2t20.5 4t17.5 8t14 9.5t12 13.5t9 14t8.5 17t7.5 17t7 20.5t7.5 20.5q2 7 7.5 10.5t7.5 6.5
+q2 9 4 27zM1408 131q0 -121 -73 -190t-194 -69h-874q-121 0 -194 69t-73 190q0 61 4.5 118t19 125.5t37.5 123.5t63.5 103.5t93.5 74.5l-90 220h214q-22 64 -22 128q0 12 2 32q-194 40 -194 96q0 57 210 99q17 62 51.5 134t70.5 114q32 37 76 37q30 0 84 -31t84 -31t84 31
+t84 31q44 0 76 -37q36 -42 70.5 -114t51.5 -134q210 -42 210 -99q0 -56 -194 -96q7 -81 -20 -160h214l-82 -225q63 -33 107.5 -96.5t65.5 -143.5t29 -151.5t8 -148.5z" />
+    <glyph glyph-name="_507" unicode="&#xf21c;" horiz-adv-x="2304" 
+d="M2301 500q12 -103 -22 -198.5t-99 -163.5t-158.5 -106t-196.5 -31q-161 11 -279.5 125t-134.5 274q-12 111 27.5 210.5t118.5 170.5l-71 107q-96 -80 -151 -194t-55 -244q0 -27 -18.5 -46.5t-45.5 -19.5h-256h-69q-23 -164 -149 -274t-294 -110q-185 0 -316.5 131.5
+t-131.5 316.5t131.5 316.5t316.5 131.5q76 0 152 -27l24 45q-123 110 -304 110h-64q-26 0 -45 19t-19 45t19 45t45 19h128q78 0 145 -13.5t116.5 -38.5t71.5 -39.5t51 -36.5h512h115l-85 128h-222q-30 0 -49 22.5t-14 52.5q4 23 23 38t43 15h253q33 0 53 -28l70 -105
+l114 114q19 19 46 19h101q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-179l115 -172q131 63 275 36q143 -26 244 -134.5t118 -253.5zM448 128q115 0 203 72.5t111 183.5h-314q-35 0 -55 31q-18 32 -1 63l147 277q-47 13 -91 13q-132 0 -226 -94t-94 -226t94 -226
+t226 -94zM1856 128q132 0 226 94t94 226t-94 226t-226 94q-60 0 -121 -24l174 -260q15 -23 10 -49t-27 -40q-15 -11 -36 -11q-35 0 -53 29l-174 260q-93 -95 -93 -225q0 -132 94 -226t226 -94z" />
+    <glyph glyph-name="_508" unicode="&#xf21d;" 
+d="M1408 0q0 -63 -61.5 -113.5t-164 -81t-225 -46t-253.5 -15.5t-253.5 15.5t-225 46t-164 81t-61.5 113.5q0 49 33 88.5t91 66.5t118 44.5t131 29.5q26 5 48 -10.5t26 -41.5q5 -26 -10.5 -48t-41.5 -26q-58 -10 -106 -23.5t-76.5 -25.5t-48.5 -23.5t-27.5 -19.5t-8.5 -12
+q3 -11 27 -26.5t73 -33t114 -32.5t160.5 -25t201.5 -10t201.5 10t160.5 25t114 33t73 33.5t27 27.5q-1 4 -8.5 11t-27.5 19t-48.5 23.5t-76.5 25t-106 23.5q-26 4 -41.5 26t-10.5 48q4 26 26 41.5t48 10.5q71 -12 131 -29.5t118 -44.5t91 -66.5t33 -88.5zM1024 896v-384
+q0 -26 -19 -45t-45 -19h-64v-384q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v384h-64q-26 0 -45 19t-19 45v384q0 53 37.5 90.5t90.5 37.5h384q53 0 90.5 -37.5t37.5 -90.5zM928 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5
+t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="_509" unicode="&#xf21e;" horiz-adv-x="1792" 
+d="M1280 512h305q-5 -6 -10 -10.5t-9 -7.5l-3 -4l-623 -600q-18 -18 -44 -18t-44 18l-624 602q-5 2 -21 20h369q22 0 39.5 13.5t22.5 34.5l70 281l190 -667q6 -20 23 -33t39 -13q21 0 38 13t23 33l146 485l56 -112q18 -35 57 -35zM1792 940q0 -145 -103 -300h-369l-111 221
+q-8 17 -25.5 27t-36.5 8q-45 -5 -56 -46l-129 -430l-196 686q-6 20 -23.5 33t-39.5 13t-39 -13.5t-22 -34.5l-116 -464h-423q-103 155 -103 300q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5q224 0 351 -124
+t127 -344z" />
+    <glyph glyph-name="venus" unicode="&#xf221;" horiz-adv-x="1280" 
+d="M1152 960q0 -221 -147.5 -384.5t-364.5 -187.5v-260h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v260q-150 16 -271.5 103t-186 224t-52.5 292
+q11 134 80.5 249t182 188t245.5 88q170 19 319 -54t236 -212t87 -306zM128 960q0 -185 131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5z" />
+    <glyph glyph-name="_511" unicode="&#xf222;" 
+d="M1472 1408q26 0 45 -19t19 -45v-416q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v262l-382 -383q126 -156 126 -359q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123t223.5 45.5
+q203 0 359 -126l382 382h-261q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h416zM576 0q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_512" unicode="&#xf223;" horiz-adv-x="1280" 
+d="M830 1220q145 -72 233.5 -210.5t88.5 -305.5q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-217 24 -364.5 187.5
+t-147.5 384.5q0 167 88.5 305.5t233.5 210.5q-165 96 -228 273q-6 16 3.5 29.5t26.5 13.5h69q21 0 29 -20q44 -106 140 -171t214 -65t214 65t140 171q8 20 37 20h61q17 0 26.5 -13.5t3.5 -29.5q-63 -177 -228 -273zM576 256q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_513" unicode="&#xf224;" 
+d="M1024 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q126 -158 126 -359q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64
+q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-149 16 -270.5 103t-186.5 223.5t-53 291.5q16 204 160 353.5t347 172.5q118 14 228 -19t198 -103l255 254h-134q-14 0 -23 9t-9 23v64zM576 256q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_514" unicode="&#xf225;" horiz-adv-x="1792" 
+d="M1280 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q126 -158 126 -359q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64
+q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-217 24 -364.5 187.5t-147.5 384.5q0 201 126 359l-52 53l-101 -111q-9 -10 -22 -10.5t-23 7.5l-48 44q-10 8 -10.5 21.5t8.5 23.5l105 115l-111 112v-134q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9
+t-9 23v288q0 26 19 45t45 19h288q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-133l106 -107l86 94q9 10 22 10.5t23 -7.5l48 -44q10 -8 10.5 -21.5t-8.5 -23.5l-90 -99l57 -56q158 126 359 126t359 -126l255 254h-134q-14 0 -23 9t-9 23v64zM832 256q185 0 316.5 131.5
+t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_515" unicode="&#xf226;" horiz-adv-x="1792" 
+d="M1790 1007q12 -155 -52.5 -292t-186 -224t-271.5 -103v-260h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-512v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23
+t23 9h224v260q-150 16 -271.5 103t-186 224t-52.5 292q17 206 164.5 356.5t352.5 169.5q206 21 377 -94q171 115 377 94q205 -19 352.5 -169.5t164.5 -356.5zM896 647q128 131 128 313t-128 313q-128 -131 -128 -313t128 -313zM576 512q115 0 218 57q-154 165 -154 391
+q0 224 154 391q-103 57 -218 57q-185 0 -316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5zM1152 128v260q-137 15 -256 94q-119 -79 -256 -94v-260h512zM1216 512q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5q-115 0 -218 -57q154 -167 154 -391
+q0 -226 -154 -391q103 -57 218 -57z" />
+    <glyph glyph-name="_516" unicode="&#xf227;" horiz-adv-x="1920" 
+d="M1536 1120q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q76 -95 107.5 -214t9.5 -247q-31 -182 -166 -312t-318 -156q-210 -29 -384.5 80t-241.5 300q-117 6 -221 57.5t-177.5 133t-113.5 192.5t-32 230
+q9 135 78 252t182 191.5t248 89.5q118 14 227.5 -19t198.5 -103l255 254h-134q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q59 -74 93 -169q182 -9 328 -124l255 254h-134q-14 0 -23 9
+t-9 23v64zM1024 704q0 20 -4 58q-162 -25 -271 -150t-109 -292q0 -20 4 -58q162 25 271 150t109 292zM128 704q0 -168 111 -294t276 -149q-3 29 -3 59q0 210 135 369.5t338 196.5q-53 120 -163.5 193t-245.5 73q-185 0 -316.5 -131.5t-131.5 -316.5zM1088 -128
+q185 0 316.5 131.5t131.5 316.5q0 168 -111 294t-276 149q3 -28 3 -59q0 -210 -135 -369.5t-338 -196.5q53 -120 163.5 -193t245.5 -73z" />
+    <glyph glyph-name="_517" unicode="&#xf228;" horiz-adv-x="2048" 
+d="M1664 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q76 -95 107.5 -214t9.5 -247q-32 -180 -164.5 -310t-313.5 -157q-223 -34 -409 90q-117 -78 -256 -93v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23
+t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-155 17 -279.5 109.5t-187 237.5t-39.5 307q25 187 159.5 322.5t320.5 164.5q224 34 410 -90q146 97 320 97q201 0 359 -126l255 254h-134q-14 0 -23 9
+t-9 23v64zM896 391q128 131 128 313t-128 313q-128 -131 -128 -313t128 -313zM128 704q0 -185 131.5 -316.5t316.5 -131.5q117 0 218 57q-154 167 -154 391t154 391q-101 57 -218 57q-185 0 -316.5 -131.5t-131.5 -316.5zM1216 256q185 0 316.5 131.5t131.5 316.5
+t-131.5 316.5t-316.5 131.5q-117 0 -218 -57q154 -167 154 -391t-154 -391q101 -57 218 -57z" />
+    <glyph glyph-name="_518" unicode="&#xf229;" 
+d="M1472 1408q26 0 45 -19t19 -45v-416q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v262l-213 -214l140 -140q9 -10 9 -23t-9 -22l-46 -46q-9 -9 -22 -9t-23 9l-140 141l-78 -79q126 -156 126 -359q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5
+t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123t223.5 45.5q203 0 359 -126l78 78l-172 172q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l172 -172l213 213h-261q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h416zM576 0q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_519" unicode="&#xf22a;" horiz-adv-x="1280" 
+d="M640 892q217 -24 364.5 -187.5t147.5 -384.5q0 -167 -87 -306t-236 -212t-319 -54q-133 15 -245.5 88t-182 188t-80.5 249q-12 155 52.5 292t186 224t271.5 103v132h-160q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h160v165l-92 -92q-10 -9 -23 -9t-22 9l-46 46q-9 9 -9 22
+t9 23l202 201q19 19 45 19t45 -19l202 -201q9 -10 9 -23t-9 -22l-46 -46q-9 -9 -22 -9t-23 9l-92 92v-165h160q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-160v-132zM576 -128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5
+t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_520" unicode="&#xf22b;" horiz-adv-x="2048" 
+d="M1901 621q19 -19 19 -45t-19 -45l-294 -294q-9 -10 -22.5 -10t-22.5 10l-45 45q-10 9 -10 22.5t10 22.5l185 185h-294v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-132q-24 -217 -187.5 -364.5t-384.5 -147.5q-167 0 -306 87t-212 236t-54 319q15 133 88 245.5
+t188 182t249 80.5q155 12 292 -52.5t224 -186t103 -271.5h132v224q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-224h294l-185 185q-10 9 -10 22.5t10 22.5l45 45q9 10 22.5 10t22.5 -10zM576 128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5
+t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_521" unicode="&#xf22c;" horiz-adv-x="1280" 
+d="M1152 960q0 -221 -147.5 -384.5t-364.5 -187.5v-612q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v612q-217 24 -364.5 187.5t-147.5 384.5q0 117 45.5 223.5t123 184t184 123t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5zM576 512q185 0 316.5 131.5
+t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_522" unicode="&#xf22d;" horiz-adv-x="1280" 
+d="M1024 576q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1152 576q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123
+t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5z" />
+    <glyph glyph-name="_523" unicode="&#xf22e;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_524" unicode="&#xf22f;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_525" unicode="&#xf230;" 
+d="M1451 1408q35 0 60 -25t25 -60v-1366q0 -35 -25 -60t-60 -25h-391v595h199l30 232h-229v148q0 56 23.5 84t91.5 28l122 1v207q-63 9 -178 9q-136 0 -217.5 -80t-81.5 -226v-171h-200v-232h200v-595h-735q-35 0 -60 25t-25 60v1366q0 35 25 60t60 25h1366z" />
+    <glyph glyph-name="_526" unicode="&#xf231;" horiz-adv-x="1280" 
+d="M0 939q0 108 37.5 203.5t103.5 166.5t152 123t185 78t202 26q158 0 294 -66.5t221 -193.5t85 -287q0 -96 -19 -188t-60 -177t-100 -149.5t-145 -103t-189 -38.5q-68 0 -135 32t-96 88q-10 -39 -28 -112.5t-23.5 -95t-20.5 -71t-26 -71t-32 -62.5t-46 -77.5t-62 -86.5
+l-14 -5l-9 10q-15 157 -15 188q0 92 21.5 206.5t66.5 287.5t52 203q-32 65 -32 169q0 83 52 156t132 73q61 0 95 -40.5t34 -102.5q0 -66 -44 -191t-44 -187q0 -63 45 -104.5t109 -41.5q55 0 102 25t78.5 68t56 95t38 110.5t20 111t6.5 99.5q0 173 -109.5 269.5t-285.5 96.5
+q-200 0 -334 -129.5t-134 -328.5q0 -44 12.5 -85t27 -65t27 -45.5t12.5 -30.5q0 -28 -15 -73t-37 -45q-2 0 -17 3q-51 15 -90.5 56t-61 94.5t-32.5 108t-11 106.5z" />
+    <glyph glyph-name="_527" unicode="&#xf232;" 
+d="M985 562q13 0 97.5 -44t89.5 -53q2 -5 2 -15q0 -33 -17 -76q-16 -39 -71 -65.5t-102 -26.5q-57 0 -190 62q-98 45 -170 118t-148 185q-72 107 -71 194v8q3 91 74 158q24 22 52 22q6 0 18 -1.5t19 -1.5q19 0 26.5 -6.5t15.5 -27.5q8 -20 33 -88t25 -75q0 -21 -34.5 -57.5
+t-34.5 -46.5q0 -7 5 -15q34 -73 102 -137q56 -53 151 -101q12 -7 22 -7q15 0 54 48.5t52 48.5zM782 32q127 0 243.5 50t200.5 134t134 200.5t50 243.5t-50 243.5t-134 200.5t-200.5 134t-243.5 50t-243.5 -50t-200.5 -134t-134 -200.5t-50 -243.5q0 -203 120 -368l-79 -233
+l242 77q158 -104 345 -104zM782 1414q153 0 292.5 -60t240.5 -161t161 -240.5t60 -292.5t-60 -292.5t-161 -240.5t-240.5 -161t-292.5 -60q-195 0 -365 94l-417 -134l136 405q-108 178 -108 389q0 153 60 292.5t161 240.5t240.5 161t292.5 60z" />
+    <glyph glyph-name="_528" unicode="&#xf233;" horiz-adv-x="1792" 
+d="M128 128h1024v128h-1024v-128zM128 640h1024v128h-1024v-128zM1696 192q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM128 1152h1024v128h-1024v-128zM1696 704q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1696 1216
+q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1792 384v-384h-1792v384h1792zM1792 896v-384h-1792v384h1792zM1792 1408v-384h-1792v384h1792z" />
+    <glyph glyph-name="_529" unicode="&#xf234;" horiz-adv-x="2048" 
+d="M704 640q-159 0 -271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5t-112.5 -271.5t-271.5 -112.5zM1664 512h352q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-352v-352q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5
+t-9.5 22.5v352h-352q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h352v352q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5v-352zM928 288q0 -52 38 -90t90 -38h256v-238q-68 -50 -171 -50h-874q-121 0 -194 69t-73 190q0 53 3.5 103.5t14 109t26.5 108.5
+t43 97.5t62 81t85.5 53.5t111.5 20q19 0 39 -17q79 -61 154.5 -91.5t164.5 -30.5t164.5 30.5t154.5 91.5q20 17 39 17q132 0 217 -96h-223q-52 0 -90 -38t-38 -90v-192z" />
+    <glyph glyph-name="_530" unicode="&#xf235;" horiz-adv-x="2048" 
+d="M704 640q-159 0 -271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5t-112.5 -271.5t-271.5 -112.5zM1781 320l249 -249q9 -9 9 -23q0 -13 -9 -22l-136 -136q-9 -9 -22 -9q-14 0 -23 9l-249 249l-249 -249q-9 -9 -23 -9q-13 0 -22 9l-136 136
+q-9 9 -9 22q0 14 9 23l249 249l-249 249q-9 9 -9 23q0 13 9 22l136 136q9 9 22 9q14 0 23 -9l249 -249l249 249q9 9 23 9q13 0 22 -9l136 -136q9 -9 9 -22q0 -14 -9 -23zM1283 320l-181 -181q-37 -37 -37 -91q0 -53 37 -90l83 -83q-21 -3 -44 -3h-874q-121 0 -194 69
+t-73 190q0 53 3.5 103.5t14 109t26.5 108.5t43 97.5t62 81t85.5 53.5t111.5 20q19 0 39 -17q154 -122 319 -122t319 122q20 17 39 17q28 0 57 -6q-28 -27 -41 -50t-13 -56q0 -54 37 -91z" />
+    <glyph glyph-name="_531" unicode="&#xf236;" horiz-adv-x="2048" 
+d="M256 512h1728q26 0 45 -19t19 -45v-448h-256v256h-1536v-256h-256v1216q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-704zM832 832q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM2048 576v64q0 159 -112.5 271.5t-271.5 112.5h-704
+q-26 0 -45 -19t-19 -45v-384h1152z" />
+    <glyph glyph-name="_532" unicode="&#xf237;" 
+d="M1536 1536l-192 -448h192v-192h-274l-55 -128h329v-192h-411l-357 -832l-357 832h-411v192h329l-55 128h-274v192h192l-192 448h256l323 -768h378l323 768h256zM768 320l108 256h-216z" />
+    <glyph glyph-name="_533" unicode="&#xf238;" 
+d="M1088 1536q185 0 316.5 -93.5t131.5 -226.5v-896q0 -130 -125.5 -222t-305.5 -97l213 -202q16 -15 8 -35t-30 -20h-1056q-22 0 -30 20t8 35l213 202q-180 5 -305.5 97t-125.5 222v896q0 133 131.5 226.5t316.5 93.5h640zM768 192q80 0 136 56t56 136t-56 136t-136 56
+t-136 -56t-56 -136t56 -136t136 -56zM1344 768v512h-1152v-512h1152z" />
+    <glyph glyph-name="_534" unicode="&#xf239;" 
+d="M1088 1536q185 0 316.5 -93.5t131.5 -226.5v-896q0 -130 -125.5 -222t-305.5 -97l213 -202q16 -15 8 -35t-30 -20h-1056q-22 0 -30 20t8 35l213 202q-180 5 -305.5 97t-125.5 222v896q0 133 131.5 226.5t316.5 93.5h640zM288 224q66 0 113 47t47 113t-47 113t-113 47
+t-113 -47t-47 -113t47 -113t113 -47zM704 768v512h-544v-512h544zM1248 224q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47zM1408 768v512h-576v-512h576z" />
+    <glyph glyph-name="_535" unicode="&#xf23a;" horiz-adv-x="1792" 
+d="M597 1115v-1173q0 -25 -12.5 -42.5t-36.5 -17.5q-17 0 -33 8l-465 233q-21 10 -35.5 33.5t-14.5 46.5v1140q0 20 10 34t29 14q14 0 44 -15l511 -256q3 -3 3 -5zM661 1014l534 -866l-534 266v600zM1792 996v-1054q0 -25 -14 -40.5t-38 -15.5t-47 13l-441 220zM1789 1116
+q0 -3 -256.5 -419.5t-300.5 -487.5l-390 634l324 527q17 28 52 28q14 0 26 -6l541 -270q4 -2 4 -6z" />
+    <glyph glyph-name="_536" unicode="&#xf23b;" 
+d="M809 532l266 499h-112l-157 -312q-24 -48 -44 -92l-42 92l-155 312h-120l263 -493v-324h101v318zM1536 1408v-1536h-1536v1536h1536z" />
+    <glyph glyph-name="_537" unicode="&#xf23c;" horiz-adv-x="2296" 
+d="M478 -139q-8 -16 -27 -34.5t-37 -25.5q-25 -9 -51.5 3.5t-28.5 31.5q-1 22 40 55t68 38q23 4 34 -21.5t2 -46.5zM1819 -139q7 -16 26 -34.5t38 -25.5q25 -9 51.5 3.5t27.5 31.5q2 22 -39.5 55t-68.5 38q-22 4 -33 -21.5t-2 -46.5zM1867 -30q13 -27 56.5 -59.5t77.5 -41.5
+q45 -13 82 4.5t37 50.5q0 46 -67.5 100.5t-115.5 59.5q-40 5 -63.5 -37.5t-6.5 -76.5zM428 -30q-13 -27 -56 -59.5t-77 -41.5q-45 -13 -82 4.5t-37 50.5q0 46 67.5 100.5t115.5 59.5q40 5 63 -37.5t6 -76.5zM1158 1094h1q-41 0 -76 -15q27 -8 44 -30.5t17 -49.5
+q0 -35 -27 -60t-65 -25q-52 0 -80 43q-5 -23 -5 -42q0 -74 56 -126.5t135 -52.5q80 0 136 52.5t56 126.5t-56 126.5t-136 52.5zM1462 1312q-99 109 -220.5 131.5t-245.5 -44.5q27 60 82.5 96.5t118 39.5t121.5 -17t99.5 -74.5t44.5 -131.5zM2212 73q8 -11 -11 -42
+q7 -23 7 -40q1 -56 -44.5 -112.5t-109.5 -91.5t-118 -37q-48 -2 -92 21.5t-66 65.5q-687 -25 -1259 0q-23 -41 -66.5 -65t-92.5 -22q-86 3 -179.5 80.5t-92.5 160.5q2 22 7 40q-19 31 -11 42q6 10 31 1q14 22 41 51q-7 29 2 38q11 10 39 -4q29 20 59 34q0 29 13 37
+q23 12 51 -16q35 5 61 -2q18 -4 38 -19v73q-11 0 -18 2q-53 10 -97 44.5t-55 87.5q-9 38 0 81q15 62 93 95q2 17 19 35.5t36 23.5t33 -7.5t19 -30.5h13q46 -5 60 -23q3 -3 5 -7q10 1 30.5 3.5t30.5 3.5q-15 11 -30 17q-23 40 -91 43q0 6 1 10q-62 2 -118.5 18.5t-84.5 47.5
+q-32 36 -42.5 92t-2.5 112q16 126 90 179q23 16 52 4.5t32 -40.5q0 -1 1.5 -14t2.5 -21t3 -20t5.5 -19t8.5 -10q27 -14 76 -12q48 46 98 74q-40 4 -162 -14l47 46q61 58 163 111q145 73 282 86q-20 8 -41 15.5t-47 14t-42.5 10.5t-47.5 11t-43 10q595 126 904 -139
+q98 -84 158 -222q85 -10 121 9h1q5 3 8.5 10t5.5 19t3 19.5t3 21.5l1 14q3 28 32 40t52 -5q73 -52 91 -178q7 -57 -3.5 -113t-42.5 -91q-28 -32 -83.5 -48.5t-115.5 -18.5v-10q-71 -2 -95 -43q-14 -5 -31 -17q11 -1 32 -3.5t30 -3.5q1 5 5 8q16 18 60 23h13q5 18 19 30t33 8
+t36 -23t19 -36q79 -32 93 -95q9 -40 1 -81q-12 -53 -56 -88t-97 -44q-10 -2 -17 -2q0 -49 -1 -73q20 15 38 19q26 7 61 2q28 28 51 16q14 -9 14 -37q33 -16 59 -34q27 13 38 4q10 -10 2 -38q28 -30 41 -51q23 8 31 -1zM1937 1025q0 -29 -9 -54q82 -32 112 -132
+q4 37 -9.5 98.5t-41.5 90.5q-20 19 -36 17t-16 -20zM1859 925q35 -42 47.5 -108.5t-0.5 -124.5q67 13 97 45q13 14 18 28q-3 64 -31 114.5t-79 66.5q-15 -15 -52 -21zM1822 921q-30 0 -44 1q42 -115 53 -239q21 0 43 3q16 68 1 135t-53 100zM258 839q30 100 112 132
+q-9 25 -9 54q0 18 -16.5 20t-35.5 -17q-28 -29 -41.5 -90.5t-9.5 -98.5zM294 737q29 -31 97 -45q-13 58 -0.5 124.5t47.5 108.5v0q-37 6 -52 21q-51 -16 -78.5 -66t-31.5 -115q9 -17 18 -28zM471 683q14 124 73 235q-19 -4 -55 -18l-45 -19v1q-46 -89 -20 -196q25 -3 47 -3z
+M1434 644q8 -38 16.5 -108.5t11.5 -89.5q3 -18 9.5 -21.5t23.5 4.5q40 20 62 85.5t23 125.5q-24 2 -146 4zM1152 1285q-116 0 -199 -82.5t-83 -198.5q0 -117 83 -199.5t199 -82.5t199 82.5t83 199.5q0 116 -83 198.5t-199 82.5zM1380 646q-105 2 -211 0v1q-1 -27 2.5 -86
+t13.5 -66q29 -14 93.5 -14.5t95.5 10.5q9 3 11 39t-0.5 69.5t-4.5 46.5zM1112 447q8 4 9.5 48t-0.5 88t-4 63v1q-212 -3 -214 -3q-4 -20 -7 -62t0 -83t14 -46q34 -15 101 -16t101 10zM718 636q-16 -59 4.5 -118.5t77.5 -84.5q15 -8 24 -5t12 21q3 16 8 90t10 103
+q-69 -2 -136 -6zM591 510q3 -23 -34 -36q132 -141 271.5 -240t305.5 -154q172 49 310.5 146t293.5 250q-33 13 -30 34q0 2 0.5 3.5t1.5 3t1 2.5v1v-1q-17 2 -50 5.5t-48 4.5q-26 -90 -82 -132q-51 -38 -82 1q-5 6 -9 14q-7 13 -17 62q-2 -5 -5 -9t-7.5 -7t-8 -5.5t-9.5 -4
+l-10 -2.5t-12 -2l-12 -1.5t-13.5 -1t-13.5 -0.5q-106 -9 -163 11q-4 -17 -10 -26.5t-21 -15t-23 -7t-36 -3.5q-6 -1 -9 -1q-179 -17 -203 40q-2 -63 -56 -54q-47 8 -91 54q-12 13 -20 26q-17 29 -26 65q-58 -6 -87 -10q1 -2 4 -10zM507 -118q3 14 3 30q-17 71 -51 130
+t-73 70q-41 12 -101.5 -14.5t-104.5 -80t-39 -107.5q35 -53 100 -93t119 -42q51 -2 94 28t53 79zM510 53q23 -63 27 -119q195 113 392 174q-98 52 -180.5 120t-179.5 165q-6 -4 -29 -13q0 -1 -1 -4t-1 -5q31 -18 22 -37q-12 -23 -56 -34q-10 -13 -29 -24h-1q-2 -83 1 -150
+q19 -34 35 -73zM579 -113q532 -21 1145 0q-254 147 -428 196q-76 -35 -156 -57q-8 -3 -16 0q-65 21 -129 49q-208 -60 -416 -188h-1v-1q1 0 1 1zM1763 -67q4 54 28 120q14 38 33 71l-1 -1q3 77 3 153q-15 8 -30 25q-42 9 -56 33q-9 20 22 38q-2 4 -2 9q-16 4 -28 12
+q-204 -190 -383 -284q198 -59 414 -176zM2155 -90q5 54 -39 107.5t-104 80t-102 14.5q-38 -11 -72.5 -70.5t-51.5 -129.5q0 -16 3 -30q10 -49 53 -79t94 -28q54 2 119 42t100 93z" />
+    <glyph glyph-name="_538" unicode="&#xf23d;" horiz-adv-x="2304" 
+d="M1524 -25q0 -68 -48 -116t-116 -48t-116.5 48t-48.5 116t48.5 116.5t116.5 48.5t116 -48.5t48 -116.5zM775 -25q0 -68 -48.5 -116t-116.5 -48t-116 48t-48 116t48 116.5t116 48.5t116.5 -48.5t48.5 -116.5zM0 1469q57 -60 110.5 -104.5t121 -82t136 -63t166 -45.5
+t200 -31.5t250 -18.5t304 -9.5t372.5 -2.5q139 0 244.5 -5t181 -16.5t124 -27.5t71 -39.5t24 -51.5t-19.5 -64t-56.5 -76.5t-89.5 -91t-116 -104.5t-139 -119q-185 -157 -286 -247q29 51 76.5 109t94 105.5t94.5 98.5t83 91.5t54 80.5t13 70t-45.5 55.5t-116.5 41t-204 23.5
+t-304 5q-168 -2 -314 6t-256 23t-204.5 41t-159.5 51.5t-122.5 62.5t-91.5 66.5t-68 71.5t-50.5 69.5t-40 68t-36.5 59.5z" />
+    <glyph glyph-name="_539" unicode="&#xf23e;" horiz-adv-x="1792" 
+d="M896 1472q-169 0 -323 -66t-265.5 -177.5t-177.5 -265.5t-66 -323t66 -323t177.5 -265.5t265.5 -177.5t323 -66t323 66t265.5 177.5t177.5 265.5t66 323t-66 323t-177.5 265.5t-265.5 177.5t-323 66zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348
+t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM496 704q16 0 16 -16v-480q0 -16 -16 -16h-32q-16 0 -16 16v480q0 16 16 16h32zM896 640q53 0 90.5 -37.5t37.5 -90.5q0 -35 -17.5 -64t-46.5 -46v-114q0 -14 -9 -23
+t-23 -9h-64q-14 0 -23 9t-9 23v114q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5zM896 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM544 928v-96
+q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v96q0 93 65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5v-96q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v96q0 146 -103 249t-249 103t-249 -103t-103 -249zM1408 192v512q0 26 -19 45t-45 19h-896q-26 0 -45 -19t-19 -45v-512
+q0 -26 19 -45t45 -19h896q26 0 45 19t19 45z" />
+    <glyph glyph-name="_540" unicode="&#xf240;" horiz-adv-x="2304" 
+d="M1920 1024v-768h-1664v768h1664zM2048 448h128v384h-128v288q0 14 -9 23t-23 9h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288zM2304 832v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113
+v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="_541" unicode="&#xf241;" horiz-adv-x="2304" 
+d="M256 256v768h1280v-768h-1280zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_542" unicode="&#xf242;" horiz-adv-x="2304" 
+d="M256 256v768h896v-768h-896zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_543" unicode="&#xf243;" horiz-adv-x="2304" 
+d="M256 256v768h512v-768h-512zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_544" unicode="&#xf244;" horiz-adv-x="2304" 
+d="M2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9h-1856q-14 0 -23 -9t-9 -23
+v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_545" unicode="&#xf245;" horiz-adv-x="1280" 
+d="M1133 493q31 -30 14 -69q-17 -40 -59 -40h-382l201 -476q10 -25 0 -49t-34 -35l-177 -75q-25 -10 -49 0t-35 34l-191 452l-312 -312q-19 -19 -45 -19q-12 0 -24 5q-40 17 -40 59v1504q0 42 40 59q12 5 24 5q27 0 45 -19z" />
+    <glyph glyph-name="_546" unicode="&#xf246;" horiz-adv-x="1024" 
+d="M832 1408q-320 0 -320 -224v-416h128v-128h-128v-544q0 -224 320 -224h64v-128h-64q-272 0 -384 146q-112 -146 -384 -146h-64v128h64q320 0 320 224v544h-128v128h128v416q0 224 -320 224h-64v128h64q272 0 384 -146q112 146 384 146h64v-128h-64z" />
+    <glyph glyph-name="_547" unicode="&#xf247;" horiz-adv-x="2048" 
+d="M2048 1152h-128v-1024h128v-384h-384v128h-1280v-128h-384v384h128v1024h-128v384h384v-128h1280v128h384v-384zM1792 1408v-128h128v128h-128zM128 1408v-128h128v128h-128zM256 -128v128h-128v-128h128zM1664 0v128h128v1024h-128v128h-1280v-128h-128v-1024h128v-128
+h1280zM1920 -128v128h-128v-128h128zM1280 896h384v-768h-896v256h-384v768h896v-256zM512 512h640v512h-640v-512zM1536 256v512h-256v-384h-384v-128h640z" />
+    <glyph glyph-name="_548" unicode="&#xf248;" horiz-adv-x="2304" 
+d="M2304 768h-128v-640h128v-384h-384v128h-896v-128h-384v384h128v128h-384v-128h-384v384h128v640h-128v384h384v-128h896v128h384v-384h-128v-128h384v128h384v-384zM2048 1024v-128h128v128h-128zM1408 1408v-128h128v128h-128zM128 1408v-128h128v128h-128zM256 256
+v128h-128v-128h128zM1536 384h-128v-128h128v128zM384 384h896v128h128v640h-128v128h-896v-128h-128v-640h128v-128zM896 -128v128h-128v-128h128zM2176 -128v128h-128v-128h128zM2048 128v640h-128v128h-384v-384h128v-384h-384v128h-384v-128h128v-128h896v128h128z" />
+    <glyph glyph-name="_549" unicode="&#xf249;" 
+d="M1024 288v-416h-928q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1344q40 0 68 -28t28 -68v-928h-416q-40 0 -68 -28t-28 -68zM1152 256h381q-15 -82 -65 -132l-184 -184q-50 -50 -132 -65v381z" />
+    <glyph glyph-name="_550" unicode="&#xf24a;" 
+d="M1400 256h-248v-248q29 10 41 22l185 185q12 12 22 41zM1120 384h288v896h-1280v-1280h896v288q0 40 28 68t68 28zM1536 1312v-1024q0 -40 -20 -88t-48 -76l-184 -184q-28 -28 -76 -48t-88 -20h-1024q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1344q40 0 68 -28t28 -68
+z" />
+    <glyph glyph-name="_551" unicode="&#xf24b;" horiz-adv-x="2304" 
+d="M1951 538q0 -26 -15.5 -44.5t-38.5 -23.5q-8 -2 -18 -2h-153v140h153q10 0 18 -2q23 -5 38.5 -23.5t15.5 -44.5zM1933 751q0 -25 -15 -42t-38 -21q-3 -1 -15 -1h-139v129h139q3 0 8.5 -0.5t6.5 -0.5q23 -4 38 -21.5t15 -42.5zM728 587v308h-228v-308q0 -58 -38 -94.5
+t-105 -36.5q-108 0 -229 59v-112q53 -15 121 -23t109 -9l42 -1q328 0 328 217zM1442 403v113q-99 -52 -200 -59q-108 -8 -169 41t-61 142t61 142t169 41q101 -7 200 -58v112q-48 12 -100 19.5t-80 9.5l-28 2q-127 6 -218.5 -14t-140.5 -60t-71 -88t-22 -106t22 -106t71 -88
+t140.5 -60t218.5 -14q101 4 208 31zM2176 518q0 54 -43 88.5t-109 39.5v3q57 8 89 41.5t32 79.5q0 55 -41 88t-107 36q-3 0 -12 0.5t-14 0.5h-455v-510h491q74 0 121.5 36.5t47.5 96.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90
+t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_552" unicode="&#xf24c;" horiz-adv-x="2304" 
+d="M858 295v693q-106 -41 -172 -135.5t-66 -211.5t66 -211.5t172 -134.5zM1362 641q0 117 -66 211.5t-172 135.5v-694q106 41 172 135.5t66 211.5zM1577 641q0 -159 -78.5 -294t-213.5 -213.5t-294 -78.5q-119 0 -227.5 46.5t-187 125t-125 187t-46.5 227.5q0 159 78.5 294
+t213.5 213.5t294 78.5t294 -78.5t213.5 -213.5t78.5 -294zM1960 634q0 139 -55.5 261.5t-147.5 205.5t-213.5 131t-252.5 48h-301q-176 0 -323.5 -81t-235 -230t-87.5 -335q0 -171 87 -317.5t236 -231.5t323 -85h301q129 0 251.5 50.5t214.5 135t147.5 202.5t55.5 246z
+M2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_553" unicode="&#xf24d;" horiz-adv-x="1792" 
+d="M1664 -96v1088q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5v-1088q0 -13 9.5 -22.5t22.5 -9.5h1088q13 0 22.5 9.5t9.5 22.5zM1792 992v-1088q0 -66 -47 -113t-113 -47h-1088q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1088q66 0 113 -47t47 -113
+zM1408 1376v-160h-128v160q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5v-1088q0 -13 9.5 -22.5t22.5 -9.5h160v-128h-160q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1088q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="_554" unicode="&#xf24e;" horiz-adv-x="2304" 
+d="M1728 1088l-384 -704h768zM448 1088l-384 -704h768zM1269 1280q-14 -40 -45.5 -71.5t-71.5 -45.5v-1291h608q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1344q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h608v1291q-40 14 -71.5 45.5t-45.5 71.5h-491q-14 0 -23 9t-9 23v64
+q0 14 9 23t23 9h491q21 57 70 92.5t111 35.5t111 -35.5t70 -92.5h491q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-491zM1088 1264q33 0 56.5 23.5t23.5 56.5t-23.5 56.5t-56.5 23.5t-56.5 -23.5t-23.5 -56.5t23.5 -56.5t56.5 -23.5zM2176 384q0 -73 -46.5 -131t-117.5 -91
+t-144.5 -49.5t-139.5 -16.5t-139.5 16.5t-144.5 49.5t-117.5 91t-46.5 131q0 11 35 81t92 174.5t107 195.5t102 184t56 100q18 33 56 33t56 -33q4 -7 56 -100t102 -184t107 -195.5t92 -174.5t35 -81zM896 384q0 -73 -46.5 -131t-117.5 -91t-144.5 -49.5t-139.5 -16.5
+t-139.5 16.5t-144.5 49.5t-117.5 91t-46.5 131q0 11 35 81t92 174.5t107 195.5t102 184t56 100q18 33 56 33t56 -33q4 -7 56 -100t102 -184t107 -195.5t92 -174.5t35 -81z" />
+    <glyph glyph-name="_555" unicode="&#xf250;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM874 700q77 29 149 92.5t129.5 152.5t92.5 210t35 253h-1024q0 -132 35 -253t92.5 -210t129.5 -152.5t149 -92.5q19 -7 30.5 -23.5t11.5 -36.5t-11.5 -36.5t-30.5 -23.5q-77 -29 -149 -92.5
+t-129.5 -152.5t-92.5 -210t-35 -253h1024q0 132 -35 253t-92.5 210t-129.5 152.5t-149 92.5q-19 7 -30.5 23.5t-11.5 36.5t11.5 36.5t30.5 23.5z" />
+    <glyph glyph-name="_556" unicode="&#xf251;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM1280 1408h-1024q0 -66 9 -128h1006q9 61 9 128zM1280 -128q0 130 -34 249.5t-90.5 208t-126.5 152t-146 94.5h-230q-76 -31 -146 -94.5t-126.5 -152t-90.5 -208t-34 -249.5h1024z" />
+    <glyph glyph-name="_557" unicode="&#xf252;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM1280 1408h-1024q0 -206 85 -384h854q85 178 85 384zM1223 192q-54 141 -145.5 241.5t-194.5 142.5h-230q-103 -42 -194.5 -142.5t-145.5 -241.5h910z" />
+    <glyph glyph-name="_558" unicode="&#xf253;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM874 700q77 29 149 92.5t129.5 152.5t92.5 210t35 253h-1024q0 -132 35 -253t92.5 -210t129.5 -152.5t149 -92.5q19 -7 30.5 -23.5t11.5 -36.5t-11.5 -36.5t-30.5 -23.5q-137 -51 -244 -196
+h700q-107 145 -244 196q-19 7 -30.5 23.5t-11.5 36.5t11.5 36.5t30.5 23.5z" />
+    <glyph glyph-name="_559" unicode="&#xf254;" 
+d="M1504 -64q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v128q0 14 9 23t23 9h1472zM130 0q3 55 16 107t30 95t46 87t53.5 76t64.5 69.5t66 60t70.5 55t66.5 47.5t65 43q-43 28 -65 43t-66.5 47.5t-70.5 55t-66 60t-64.5 69.5t-53.5 76t-46 87
+t-30 95t-16 107h1276q-3 -55 -16 -107t-30 -95t-46 -87t-53.5 -76t-64.5 -69.5t-66 -60t-70.5 -55t-66.5 -47.5t-65 -43q43 -28 65 -43t66.5 -47.5t70.5 -55t66 -60t64.5 -69.5t53.5 -76t46 -87t30 -95t16 -107h-1276zM1504 1536q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9
+h-1472q-14 0 -23 9t-9 23v128q0 14 9 23t23 9h1472z" />
+    <glyph glyph-name="_560" unicode="&#xf255;" 
+d="M768 1152q-53 0 -90.5 -37.5t-37.5 -90.5v-128h-32v93q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-429l-32 30v172q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-224q0 -47 35 -82l310 -296q39 -39 39 -102q0 -26 19 -45t45 -19h640q26 0 45 19t19 45v25
+q0 41 10 77l108 436q10 36 10 77v246q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-32h-32v125q0 40 -25 72.5t-64 40.5q-14 2 -23 2q-46 0 -79 -33t-33 -79v-128h-32v122q0 51 -32.5 89.5t-82.5 43.5q-5 1 -13 1zM768 1280q84 0 149 -50q57 34 123 34q59 0 111 -27
+t86 -76q27 7 59 7q100 0 170 -71.5t70 -171.5v-246q0 -51 -13 -108l-109 -436q-6 -24 -6 -71q0 -80 -56 -136t-136 -56h-640q-84 0 -138 58.5t-54 142.5l-308 296q-76 73 -76 175v224q0 99 70.5 169.5t169.5 70.5q11 0 16 -1q6 95 75.5 160t164.5 65q52 0 98 -21
+q72 69 174 69z" />
+    <glyph glyph-name="_561" unicode="&#xf256;" horiz-adv-x="1792" 
+d="M880 1408q-46 0 -79 -33t-33 -79v-656h-32v528q0 46 -33 79t-79 33t-79 -33t-33 -79v-528v-256l-154 205q-38 51 -102 51q-53 0 -90.5 -37.5t-37.5 -90.5q0 -43 26 -77l384 -512q38 -51 102 -51h688q34 0 61 22t34 56l76 405q5 32 5 59v498q0 46 -33 79t-79 33t-79 -33
+t-33 -79v-272h-32v528q0 46 -33 79t-79 33t-79 -33t-33 -79v-528h-32v656q0 46 -33 79t-79 33zM880 1536q68 0 125.5 -35.5t88.5 -96.5q19 4 42 4q99 0 169.5 -70.5t70.5 -169.5v-17q105 6 180.5 -64t75.5 -175v-498q0 -40 -8 -83l-76 -404q-14 -79 -76.5 -131t-143.5 -52
+h-688q-60 0 -114.5 27.5t-90.5 74.5l-384 512q-51 68 -51 154q0 106 75 181t181 75q78 0 128 -34v434q0 99 70.5 169.5t169.5 70.5q23 0 42 -4q31 61 88.5 96.5t125.5 35.5z" />
+    <glyph glyph-name="_562" unicode="&#xf257;" horiz-adv-x="1792" 
+d="M1073 -128h-177q-163 0 -226 141q-23 49 -23 102v5q-62 30 -98.5 88.5t-36.5 127.5q0 38 5 48h-261q-106 0 -181 75t-75 181t75 181t181 75h113l-44 17q-74 28 -119.5 93.5t-45.5 145.5q0 106 75 181t181 75q46 0 91 -17l628 -239h401q106 0 181 -75t75 -181v-668
+q0 -88 -54 -157.5t-140 -90.5l-339 -85q-92 -23 -186 -23zM1024 583l-155 -71l-163 -74q-30 -14 -48 -41.5t-18 -60.5q0 -46 33 -79t79 -33q26 0 46 10l338 154q-49 10 -80.5 50t-31.5 90v55zM1344 272q0 46 -33 79t-79 33q-26 0 -46 -10l-290 -132q-28 -13 -37 -17
+t-30.5 -17t-29.5 -23.5t-16 -29t-8 -40.5q0 -50 31.5 -82t81.5 -32q20 0 38 9l352 160q30 14 48 41.5t18 60.5zM1112 1024l-650 248q-24 8 -46 8q-53 0 -90.5 -37.5t-37.5 -90.5q0 -40 22.5 -73t59.5 -47l526 -200v-64h-640q-53 0 -90.5 -37.5t-37.5 -90.5t37.5 -90.5
+t90.5 -37.5h535l233 106v198q0 63 46 106l111 102h-69zM1073 0q82 0 155 19l339 85q43 11 70 45.5t27 78.5v668q0 53 -37.5 90.5t-90.5 37.5h-308l-136 -126q-36 -33 -36 -82v-296q0 -46 33 -77t79 -31t79 35t33 81v208h32v-208q0 -70 -57 -114q52 -8 86.5 -48.5t34.5 -93.5
+q0 -42 -23 -78t-61 -53l-310 -141h91z" />
+    <glyph glyph-name="_563" unicode="&#xf258;" horiz-adv-x="2048" 
+d="M1151 1536q61 0 116 -28t91 -77l572 -781q118 -159 118 -359v-355q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v177l-286 143h-546q-80 0 -136 56t-56 136v32q0 119 84.5 203.5t203.5 84.5h420l42 128h-686q-100 0 -173.5 67.5t-81.5 166.5q-65 79 -65 182v32
+q0 80 56 136t136 56h959zM1920 -64v355q0 157 -93 284l-573 781q-39 52 -103 52h-959q-26 0 -45 -19t-19 -45q0 -32 1.5 -49.5t9.5 -40.5t25 -43q10 31 35.5 50t56.5 19h832v-32h-832q-26 0 -45 -19t-19 -45q0 -44 3 -58q8 -44 44 -73t81 -29h640h91q40 0 68 -28t28 -68
+q0 -15 -5 -30l-64 -192q-10 -29 -35 -47.5t-56 -18.5h-443q-66 0 -113 -47t-47 -113v-32q0 -26 19 -45t45 -19h561q16 0 29 -7l317 -158q24 -13 38.5 -36t14.5 -50v-197q0 -26 19 -45t45 -19h384q26 0 45 19t19 45z" />
+    <glyph glyph-name="_564" unicode="&#xf259;" horiz-adv-x="2048" 
+d="M459 -256q-77 0 -137.5 47.5t-79.5 122.5l-101 401q-13 57 -13 108q0 45 -5 67l-116 477q-7 27 -7 57q0 93 62 161t155 78q17 85 82.5 139t152.5 54q83 0 148 -51.5t85 -132.5l83 -348l103 428q20 81 85 132.5t148 51.5q89 0 155.5 -57.5t80.5 -144.5q92 -10 152 -79
+t60 -162q0 -24 -7 -59l-123 -512q10 7 37.5 28.5t38.5 29.5t35 23t41 20.5t41.5 11t49.5 5.5q105 0 180 -74t75 -179q0 -62 -28.5 -118t-78.5 -94l-507 -380q-68 -51 -153 -51h-694zM1104 1408q-38 0 -68.5 -24t-39.5 -62l-164 -682h-127l-145 602q-9 38 -39.5 62t-68.5 24
+q-48 0 -80 -33t-32 -80q0 -15 3 -28l132 -547h-26l-99 408q-9 37 -40 62.5t-69 25.5q-47 0 -80 -33t-33 -79q0 -14 3 -26l116 -478q7 -28 9 -86t10 -88l100 -401q8 -32 34 -52.5t59 -20.5h694q42 0 76 26l507 379q56 43 56 110q0 52 -37.5 88.5t-89.5 36.5q-43 0 -77 -26
+l-307 -230v227q0 4 32 138t68 282t39 161q4 18 4 29q0 47 -32 81t-79 34q-39 0 -69.5 -24t-39.5 -62l-116 -482h-26l150 624q3 14 3 28q0 48 -31.5 82t-79.5 34z" />
+    <glyph glyph-name="_565" unicode="&#xf25a;" horiz-adv-x="1792" 
+d="M640 1408q-53 0 -90.5 -37.5t-37.5 -90.5v-512v-384l-151 202q-41 54 -107 54q-52 0 -89 -38t-37 -90q0 -43 26 -77l384 -512q38 -51 102 -51h718q22 0 39.5 13.5t22.5 34.5l92 368q24 96 24 194v217q0 41 -28 71t-68 30t-68 -28t-28 -68h-32v61q0 48 -32 81.5t-80 33.5
+q-46 0 -79 -33t-33 -79v-64h-32v90q0 55 -37 94.5t-91 39.5q-53 0 -90.5 -37.5t-37.5 -90.5v-96h-32v570q0 55 -37 94.5t-91 39.5zM640 1536q107 0 181.5 -77.5t74.5 -184.5v-220q22 2 32 2q99 0 173 -69q47 21 99 21q113 0 184 -87q27 7 56 7q94 0 159 -67.5t65 -161.5
+v-217q0 -116 -28 -225l-92 -368q-16 -64 -68 -104.5t-118 -40.5h-718q-60 0 -114.5 27.5t-90.5 74.5l-384 512q-51 68 -51 154q0 105 74.5 180.5t179.5 75.5q71 0 130 -35v547q0 106 75 181t181 75zM768 128v384h-32v-384h32zM1024 128v384h-32v-384h32zM1280 128v384h-32
+v-384h32z" />
+    <glyph glyph-name="_566" unicode="&#xf25b;" 
+d="M1288 889q60 0 107 -23q141 -63 141 -226v-177q0 -94 -23 -186l-85 -339q-21 -86 -90.5 -140t-157.5 -54h-668q-106 0 -181 75t-75 181v401l-239 628q-17 45 -17 91q0 106 75 181t181 75q80 0 145.5 -45.5t93.5 -119.5l17 -44v113q0 106 75 181t181 75t181 -75t75 -181
+v-261q27 5 48 5q69 0 127.5 -36.5t88.5 -98.5zM1072 896q-33 0 -60.5 -18t-41.5 -48l-74 -163l-71 -155h55q50 0 90 -31.5t50 -80.5l154 338q10 20 10 46q0 46 -33 79t-79 33zM1293 761q-22 0 -40.5 -8t-29 -16t-23.5 -29.5t-17 -30.5t-17 -37l-132 -290q-10 -20 -10 -46
+q0 -46 33 -79t79 -33q33 0 60.5 18t41.5 48l160 352q9 18 9 38q0 50 -32 81.5t-82 31.5zM128 1120q0 -22 8 -46l248 -650v-69l102 111q43 46 106 46h198l106 233v535q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5v-640h-64l-200 526q-14 37 -47 59.5t-73 22.5
+q-53 0 -90.5 -37.5t-37.5 -90.5zM1180 -128q44 0 78.5 27t45.5 70l85 339q19 73 19 155v91l-141 -310q-17 -38 -53 -61t-78 -23q-53 0 -93.5 34.5t-48.5 86.5q-44 -57 -114 -57h-208v32h208q46 0 81 33t35 79t-31 79t-77 33h-296q-49 0 -82 -36l-126 -136v-308
+q0 -53 37.5 -90.5t90.5 -37.5h668z" />
+    <glyph glyph-name="_567" unicode="&#xf25c;" horiz-adv-x="1973" 
+d="M857 992v-117q0 -13 -9.5 -22t-22.5 -9h-298v-812q0 -13 -9 -22.5t-22 -9.5h-135q-13 0 -22.5 9t-9.5 23v812h-297q-13 0 -22.5 9t-9.5 22v117q0 14 9 23t23 9h793q13 0 22.5 -9.5t9.5 -22.5zM1895 995l77 -961q1 -13 -8 -24q-10 -10 -23 -10h-134q-12 0 -21 8.5
+t-10 20.5l-46 588l-189 -425q-8 -19 -29 -19h-120q-20 0 -29 19l-188 427l-45 -590q-1 -12 -10 -20.5t-21 -8.5h-135q-13 0 -23 10q-9 10 -9 24l78 961q1 12 10 20.5t21 8.5h142q20 0 29 -19l220 -520q10 -24 20 -51q3 7 9.5 24.5t10.5 26.5l221 520q9 19 29 19h141
+q13 0 22 -8.5t10 -20.5z" />
+    <glyph glyph-name="_568" unicode="&#xf25d;" horiz-adv-x="1792" 
+d="M1042 833q0 88 -60 121q-33 18 -117 18h-123v-281h162q66 0 102 37t36 105zM1094 548l205 -373q8 -17 -1 -31q-8 -16 -27 -16h-152q-20 0 -28 17l-194 365h-155v-350q0 -14 -9 -23t-23 -9h-134q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h294q128 0 190 -24q85 -31 134 -109
+t49 -180q0 -92 -42.5 -165.5t-115.5 -109.5q6 -10 9 -16zM896 1376q-150 0 -286 -58.5t-234.5 -157t-157 -234.5t-58.5 -286t58.5 -286t157 -234.5t234.5 -157t286 -58.5t286 58.5t234.5 157t157 234.5t58.5 286t-58.5 286t-157 234.5t-234.5 157t-286 58.5zM1792 640
+q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_569" unicode="&#xf25e;" horiz-adv-x="1792" 
+d="M605 303q153 0 257 104q14 18 3 36l-45 82q-6 13 -24 17q-16 2 -27 -11l-4 -3q-4 -4 -11.5 -10t-17.5 -13.5t-23.5 -14.5t-28.5 -13t-33.5 -9.5t-37.5 -3.5q-76 0 -125 50t-49 127q0 76 48 125.5t122 49.5q37 0 71.5 -14t50.5 -28l16 -14q11 -11 26 -10q16 2 24 14l53 78
+q13 20 -2 39q-3 4 -11 12t-30 23.5t-48.5 28t-67.5 22.5t-86 10q-148 0 -246 -96.5t-98 -240.5q0 -146 97 -241.5t247 -95.5zM1235 303q153 0 257 104q14 18 4 36l-45 82q-8 14 -25 17q-16 2 -27 -11l-4 -3q-4 -4 -11.5 -10t-17.5 -13.5t-23.5 -14.5t-28.5 -13t-33.5 -9.5
+t-37.5 -3.5q-76 0 -125 50t-49 127q0 76 48 125.5t122 49.5q37 0 71.5 -14t50.5 -28l16 -14q11 -11 26 -10q16 2 24 14l53 78q13 20 -2 39q-3 4 -11 12t-30 23.5t-48.5 28t-67.5 22.5t-86 10q-147 0 -245.5 -96.5t-98.5 -240.5q0 -146 97 -241.5t247 -95.5zM896 1376
+q-150 0 -286 -58.5t-234.5 -157t-157 -234.5t-58.5 -286t58.5 -286t157 -234.5t234.5 -157t286 -58.5t286 58.5t234.5 157t157 234.5t58.5 286t-58.5 286t-157 234.5t-234.5 157t-286 58.5zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191
+t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71z" />
+    <glyph glyph-name="f260" unicode="&#xf260;" horiz-adv-x="2048" 
+d="M736 736l384 -384l-384 -384l-672 672l672 672l168 -168l-96 -96l-72 72l-480 -480l480 -480l193 193l-289 287zM1312 1312l672 -672l-672 -672l-168 168l96 96l72 -72l480 480l-480 480l-193 -193l289 -287l-96 -96l-384 384z" />
+    <glyph glyph-name="f261" unicode="&#xf261;" horiz-adv-x="1792" 
+d="M717 182l271 271l-279 279l-88 -88l192 -191l-96 -96l-279 279l279 279l40 -40l87 87l-127 128l-454 -454zM1075 190l454 454l-454 454l-271 -271l279 -279l88 88l-192 191l96 96l279 -279l-279 -279l-40 40l-87 -88zM1792 640q0 -182 -71 -348t-191 -286t-286 -191
+t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_572" unicode="&#xf262;" horiz-adv-x="2304" 
+d="M651 539q0 -39 -27.5 -66.5t-65.5 -27.5q-39 0 -66.5 27.5t-27.5 66.5q0 38 27.5 65.5t66.5 27.5q38 0 65.5 -27.5t27.5 -65.5zM1805 540q0 -39 -27.5 -66.5t-66.5 -27.5t-66.5 27.5t-27.5 66.5t27.5 66t66.5 27t66.5 -27t27.5 -66zM765 539q0 79 -56.5 136t-136.5 57
+t-136.5 -56.5t-56.5 -136.5t56.5 -136.5t136.5 -56.5t136.5 56.5t56.5 136.5zM1918 540q0 80 -56.5 136.5t-136.5 56.5q-79 0 -136 -56.5t-57 -136.5t56.5 -136.5t136.5 -56.5t136.5 56.5t56.5 136.5zM850 539q0 -116 -81.5 -197.5t-196.5 -81.5q-116 0 -197.5 82t-81.5 197
+t82 196.5t197 81.5t196.5 -81.5t81.5 -196.5zM2004 540q0 -115 -81.5 -196.5t-197.5 -81.5q-115 0 -196.5 81.5t-81.5 196.5t81.5 196.5t196.5 81.5q116 0 197.5 -81.5t81.5 -196.5zM1040 537q0 191 -135.5 326.5t-326.5 135.5q-125 0 -231 -62t-168 -168.5t-62 -231.5
+t62 -231.5t168 -168.5t231 -62q191 0 326.5 135.5t135.5 326.5zM1708 1110q-254 111 -556 111q-319 0 -573 -110q117 0 223 -45.5t182.5 -122.5t122 -183t45.5 -223q0 115 43.5 219.5t118 180.5t177.5 123t217 50zM2187 537q0 191 -135 326.5t-326 135.5t-326.5 -135.5
+t-135.5 -326.5t135.5 -326.5t326.5 -135.5t326 135.5t135 326.5zM1921 1103h383q-44 -51 -75 -114.5t-40 -114.5q110 -151 110 -337q0 -156 -77 -288t-209 -208.5t-287 -76.5q-133 0 -249 56t-196 155q-47 -56 -129 -179q-11 22 -53.5 82.5t-74.5 97.5
+q-80 -99 -196.5 -155.5t-249.5 -56.5q-155 0 -287 76.5t-209 208.5t-77 288q0 186 110 337q-9 51 -40 114.5t-75 114.5h365q149 100 355 156.5t432 56.5q224 0 421 -56t348 -157z" />
+    <glyph glyph-name="f263" unicode="&#xf263;" horiz-adv-x="1280" 
+d="M640 629q-188 0 -321 133t-133 320q0 188 133 321t321 133t321 -133t133 -321q0 -187 -133 -320t-321 -133zM640 1306q-92 0 -157.5 -65.5t-65.5 -158.5q0 -92 65.5 -157.5t157.5 -65.5t157.5 65.5t65.5 157.5q0 93 -65.5 158.5t-157.5 65.5zM1163 574q13 -27 15 -49.5
+t-4.5 -40.5t-26.5 -38.5t-42.5 -37t-61.5 -41.5q-115 -73 -315 -94l73 -72l267 -267q30 -31 30 -74t-30 -73l-12 -13q-31 -30 -74 -30t-74 30q-67 68 -267 268l-267 -268q-31 -30 -74 -30t-73 30l-12 13q-31 30 -31 73t31 74l267 267l72 72q-203 21 -317 94
+q-39 25 -61.5 41.5t-42.5 37t-26.5 38.5t-4.5 40.5t15 49.5q10 20 28 35t42 22t56 -2t65 -35q5 -4 15 -11t43 -24.5t69 -30.5t92 -24t113 -11q91 0 174 25.5t120 50.5l38 25q33 26 65 35t56 2t42 -22t28 -35z" />
+    <glyph glyph-name="_574" unicode="&#xf264;" 
+d="M927 956q0 -66 -46.5 -112.5t-112.5 -46.5t-112.5 46.5t-46.5 112.5t46.5 112.5t112.5 46.5t112.5 -46.5t46.5 -112.5zM1141 593q-10 20 -28 32t-47.5 9.5t-60.5 -27.5q-10 -8 -29 -20t-81 -32t-127 -20t-124 18t-86 36l-27 18q-31 25 -60.5 27.5t-47.5 -9.5t-28 -32
+q-22 -45 -2 -74.5t87 -73.5q83 -53 226 -67l-51 -52q-142 -142 -191 -190q-22 -22 -22 -52.5t22 -52.5l9 -9q22 -22 52.5 -22t52.5 22l191 191q114 -115 191 -191q22 -22 52.5 -22t52.5 22l9 9q22 22 22 52.5t-22 52.5l-191 190l-52 52q141 14 225 67q67 44 87 73.5t-2 74.5
+zM1092 956q0 134 -95 229t-229 95t-229 -95t-95 -229t95 -229t229 -95t229 95t95 229zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_575" unicode="&#xf265;" horiz-adv-x="1720" 
+d="M1565 1408q65 0 110 -45.5t45 -110.5v-519q0 -176 -68 -336t-182.5 -275t-274 -182.5t-334.5 -67.5q-176 0 -335.5 67.5t-274.5 182.5t-183 275t-68 336v519q0 64 46 110t110 46h1409zM861 344q47 0 82 33l404 388q37 35 37 85q0 49 -34.5 83.5t-83.5 34.5q-47 0 -82 -33
+l-323 -310l-323 310q-35 33 -81 33q-49 0 -83.5 -34.5t-34.5 -83.5q0 -51 36 -85l405 -388q33 -33 81 -33z" />
+    <glyph glyph-name="_576" unicode="&#xf266;" horiz-adv-x="2304" 
+d="M1494 -103l-295 695q-25 -49 -158.5 -305.5t-198.5 -389.5q-1 -1 -27.5 -0.5t-26.5 1.5q-82 193 -255.5 587t-259.5 596q-21 50 -66.5 107.5t-103.5 100.5t-102 43q0 5 -0.5 24t-0.5 27h583v-50q-39 -2 -79.5 -16t-66.5 -43t-10 -64q26 -59 216.5 -499t235.5 -540
+q31 61 140 266.5t131 247.5q-19 39 -126 281t-136 295q-38 69 -201 71v50l513 -1v-47q-60 -2 -93.5 -25t-12.5 -69q33 -70 87 -189.5t86 -187.5q110 214 173 363q24 55 -10 79.5t-129 26.5q1 7 1 25v24q64 0 170.5 0.5t180 1t92.5 0.5v-49q-62 -2 -119 -33t-90 -81
+l-213 -442q13 -33 127.5 -290t121.5 -274l441 1017q-14 38 -49.5 62.5t-65 31.5t-55.5 8v50l460 -4l1 -2l-1 -44q-139 -4 -201 -145q-526 -1216 -559 -1291h-49z" />
+    <glyph glyph-name="_577" unicode="&#xf267;" horiz-adv-x="1792" 
+d="M949 643q0 -26 -16.5 -45t-41.5 -19q-26 0 -45 16.5t-19 41.5q0 26 17 45t42 19t44 -16.5t19 -41.5zM964 585l350 581q-9 -8 -67.5 -62.5t-125.5 -116.5t-136.5 -127t-117 -110.5t-50.5 -51.5l-349 -580q7 7 67 62t126 116.5t136 127t117 111t50 50.5zM1611 640
+q0 -201 -104 -371q-3 2 -17 11t-26.5 16.5t-16.5 7.5q-13 0 -13 -13q0 -10 59 -44q-74 -112 -184.5 -190.5t-241.5 -110.5l-16 67q-1 10 -15 10q-5 0 -8 -5.5t-2 -9.5l16 -68q-72 -15 -146 -15q-199 0 -372 105q1 2 13 20.5t21.5 33.5t9.5 19q0 13 -13 13q-6 0 -17 -14.5
+t-22.5 -34.5t-13.5 -23q-113 75 -192 187.5t-110 244.5l69 15q10 3 10 15q0 5 -5.5 8t-10.5 2l-68 -15q-14 72 -14 139q0 206 109 379q2 -1 18.5 -12t30 -19t17.5 -8q13 0 13 12q0 6 -12.5 15.5t-32.5 21.5l-20 12q77 112 189 189t244 107l15 -67q2 -10 15 -10q5 0 8 5.5
+t2 10.5l-15 66q71 13 134 13q204 0 379 -109q-39 -56 -39 -65q0 -13 12 -13q11 0 48 64q111 -75 187.5 -186t107.5 -241l-56 -12q-10 -2 -10 -16q0 -5 5.5 -8t9.5 -2l57 13q14 -72 14 -140zM1696 640q0 163 -63.5 311t-170.5 255t-255 170.5t-311 63.5t-311 -63.5
+t-255 -170.5t-170.5 -255t-63.5 -311t63.5 -311t170.5 -255t255 -170.5t311 -63.5t311 63.5t255 170.5t170.5 255t63.5 311zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191
+t191 -286t71 -348z" />
+    <glyph glyph-name="_578" unicode="&#xf268;" horiz-adv-x="1792" 
+d="M893 1536q240 2 451 -120q232 -134 352 -372l-742 39q-160 9 -294 -74.5t-185 -229.5l-276 424q128 159 311 245.5t383 87.5zM146 1131l337 -663q72 -143 211 -217t293 -45l-230 -451q-212 33 -385 157.5t-272.5 316t-99.5 411.5q0 267 146 491zM1732 962
+q58 -150 59.5 -310.5t-48.5 -306t-153 -272t-246 -209.5q-230 -133 -498 -119l405 623q88 131 82.5 290.5t-106.5 277.5zM896 942q125 0 213.5 -88.5t88.5 -213.5t-88.5 -213.5t-213.5 -88.5t-213.5 88.5t-88.5 213.5t88.5 213.5t213.5 88.5z" />
+    <glyph glyph-name="_579" unicode="&#xf269;" horiz-adv-x="1792" 
+d="M903 -256q-283 0 -504.5 150.5t-329.5 398.5q-58 131 -67 301t26 332.5t111 312t179 242.5l-11 -281q11 14 68 15.5t70 -15.5q42 81 160.5 138t234.5 59q-54 -45 -119.5 -148.5t-58.5 -163.5q25 -8 62.5 -13.5t63 -7.5t68 -4t50.5 -3q15 -5 9.5 -45.5t-30.5 -75.5
+q-5 -7 -16.5 -18.5t-56.5 -35.5t-101 -34l15 -189l-139 67q-18 -43 -7.5 -81.5t36 -66.5t65.5 -41.5t81 -6.5q51 9 98 34.5t83.5 45t73.5 17.5q61 -4 89.5 -33t19.5 -65q-1 -2 -2.5 -5.5t-8.5 -12.5t-18 -15.5t-31.5 -10.5t-46.5 -1q-60 -95 -144.5 -135.5t-209.5 -29.5
+q74 -61 162.5 -82.5t168.5 -6t154.5 52t128 87.5t80.5 104q43 91 39 192.5t-37.5 188.5t-78.5 125q87 -38 137 -79.5t77 -112.5q15 170 -57.5 343t-209.5 284q265 -77 412 -279.5t151 -517.5q2 -127 -40.5 -255t-123.5 -238t-189 -196t-247.5 -135.5t-288.5 -49.5z" />
+    <glyph glyph-name="_580" unicode="&#xf26a;" horiz-adv-x="1792" 
+d="M1493 1308q-165 110 -359 110q-155 0 -293 -73t-240 -200q-75 -93 -119.5 -218t-48.5 -266v-42q4 -141 48.5 -266t119.5 -218q102 -127 240 -200t293 -73q194 0 359 110q-121 -108 -274.5 -168t-322.5 -60q-29 0 -43 1q-175 8 -333 82t-272 193t-181 281t-67 339
+q0 182 71 348t191 286t286 191t348 71h3q168 -1 320.5 -60.5t273.5 -167.5zM1792 640q0 -192 -77 -362.5t-213 -296.5q-104 -63 -222 -63q-137 0 -255 84q154 56 253.5 233t99.5 405q0 227 -99 404t-253 234q119 83 254 83q119 0 226 -65q135 -125 210.5 -295t75.5 -361z
+" />
+    <glyph glyph-name="_581" unicode="&#xf26b;" horiz-adv-x="1792" 
+d="M1792 599q0 -56 -7 -104h-1151q0 -146 109.5 -244.5t257.5 -98.5q99 0 185.5 46.5t136.5 130.5h423q-56 -159 -170.5 -281t-267.5 -188.5t-321 -66.5q-187 0 -356 83q-228 -116 -394 -116q-237 0 -237 263q0 115 45 275q17 60 109 229q199 360 475 606
+q-184 -79 -427 -354q63 274 283.5 449.5t501.5 175.5q30 0 45 -1q255 117 433 117q64 0 116 -13t94.5 -40.5t66.5 -76.5t24 -115q0 -116 -75 -286q101 -182 101 -390zM1722 1239q0 83 -53 132t-137 49q-108 0 -254 -70q121 -47 222.5 -131.5t170.5 -195.5q51 135 51 216z
+M128 2q0 -86 48.5 -132.5t134.5 -46.5q115 0 266 83q-122 72 -213.5 183t-137.5 245q-98 -205 -98 -332zM632 715h728q-5 142 -113 237t-251 95q-144 0 -251.5 -95t-112.5 -237z" />
+    <glyph glyph-name="_582" unicode="&#xf26c;" horiz-adv-x="2048" 
+d="M1792 288v960q0 13 -9.5 22.5t-22.5 9.5h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5zM1920 1248v-960q0 -66 -47 -113t-113 -47h-736v-128h352q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23
+v64q0 14 9 23t23 9h352v128h-736q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="_583" unicode="&#xf26d;" horiz-adv-x="1792" 
+d="M138 1408h197q-70 -64 -126 -149q-36 -56 -59 -115t-30 -125.5t-8.5 -120t10.5 -132t21 -126t28 -136.5q4 -19 6 -28q51 -238 81 -329q57 -171 152 -275h-272q-48 0 -82 34t-34 82v1304q0 48 34 82t82 34zM1346 1408h308q48 0 82 -34t34 -82v-1304q0 -48 -34 -82t-82 -34
+h-178q212 210 196 565l-469 -101q-2 -45 -12 -82t-31 -72t-59.5 -59.5t-93.5 -36.5q-123 -26 -199 40q-32 27 -53 61t-51.5 129t-64.5 258q-35 163 -45.5 263t-5.5 139t23 77q20 41 62.5 73t102.5 45q45 12 83.5 6.5t67 -17t54 -35t43 -48t34.5 -56.5l468 100
+q-68 175 -180 287z" />
+    <glyph glyph-name="_584" unicode="&#xf26e;" 
+d="M1401 -11l-6 -6q-113 -113 -259 -175q-154 -64 -317 -64q-165 0 -317 64q-148 63 -259 175q-113 112 -175 258q-42 103 -54 189q-4 28 48 36q51 8 56 -20q1 -1 1 -4q18 -90 46 -159q50 -124 152 -226q98 -98 226 -152q132 -56 276 -56q143 0 276 56q128 55 225 152l6 6
+q10 10 25 6q12 -3 33 -22q36 -37 17 -58zM929 604l-66 -66l63 -63q21 -21 -7 -49q-17 -17 -32 -17q-10 0 -19 10l-62 61l-66 -66q-5 -5 -15 -5q-15 0 -31 16l-2 2q-18 15 -18 29q0 7 8 17l66 65l-66 66q-16 16 14 45q18 18 31 18q6 0 13 -5l65 -66l65 65q18 17 48 -13
+q27 -27 11 -44zM1400 547q0 -118 -46 -228q-45 -105 -126 -186q-80 -80 -187 -126t-228 -46t-228 46t-187 126q-82 82 -125 186q-15 33 -15 40h-1q-9 27 43 44q50 16 60 -12q37 -99 97 -167h1v339v2q3 136 102 232q105 103 253 103q147 0 251 -103t104 -249
+q0 -147 -104.5 -251t-250.5 -104q-58 0 -112 16q-28 11 -13 61q16 51 44 43l14 -3q14 -3 33 -6t30 -3q104 0 176 71.5t72 174.5q0 101 -72 171q-71 71 -175 71q-107 0 -178 -80q-64 -72 -64 -160v-413q110 -67 242 -67q96 0 185 36.5t156 103.5t103.5 155t36.5 183
+q0 198 -141 339q-140 140 -339 140q-200 0 -340 -140q-53 -53 -77 -87l-2 -2q-8 -11 -13 -15.5t-21.5 -9.5t-38.5 3q-21 5 -36.5 16.5t-15.5 26.5v680q0 15 10.5 26.5t27.5 11.5h877q30 0 30 -55t-30 -55h-811v-483h1q40 42 102 84t108 61q109 46 231 46q121 0 228 -46
+t187 -126q81 -81 126 -186q46 -112 46 -229zM1369 1128q9 -8 9 -18t-5.5 -18t-16.5 -21q-26 -26 -39 -26q-9 0 -16 7q-106 91 -207 133q-128 56 -276 56q-133 0 -262 -49q-27 -10 -45 37q-9 25 -8 38q3 16 16 20q130 57 299 57q164 0 316 -64q137 -58 235 -152z" />
+    <glyph glyph-name="_585" unicode="&#xf270;" horiz-adv-x="1792" 
+d="M1551 60q15 6 26 3t11 -17.5t-15 -33.5q-13 -16 -44 -43.5t-95.5 -68t-141 -74t-188 -58t-229.5 -24.5q-119 0 -238 31t-209 76.5t-172.5 104t-132.5 105t-84 87.5q-8 9 -10 16.5t1 12t8 7t11.5 2t11.5 -4.5q192 -117 300 -166q389 -176 799 -90q190 40 391 135z
+M1758 175q11 -16 2.5 -69.5t-28.5 -102.5q-34 -83 -85 -124q-17 -14 -26 -9t0 24q21 45 44.5 121.5t6.5 98.5q-5 7 -15.5 11.5t-27 6t-29.5 2.5t-35 0t-31.5 -2t-31 -3t-22.5 -2q-6 -1 -13 -1.5t-11 -1t-8.5 -1t-7 -0.5h-5.5h-4.5t-3 0.5t-2 1.5l-1.5 3q-6 16 47 40t103 30
+q46 7 108 1t76 -24zM1364 618q0 -31 13.5 -64t32 -58t37.5 -46t33 -32l13 -11l-227 -224q-40 37 -79 75.5t-58 58.5l-19 20q-11 11 -25 33q-38 -59 -97.5 -102.5t-127.5 -63.5t-140 -23t-137.5 21t-117.5 65.5t-83 113t-31 162.5q0 84 28 154t72 116.5t106.5 83t122.5 57
+t130 34.5t119.5 18.5t99.5 6.5v127q0 65 -21 97q-34 53 -121 53q-6 0 -16.5 -1t-40.5 -12t-56 -29.5t-56 -59.5t-48 -96l-294 27q0 60 22 119t67 113t108 95t151.5 65.5t190.5 24.5q100 0 181 -25t129.5 -61.5t81 -83t45 -86t12.5 -73.5v-589zM692 597q0 -86 70 -133
+q66 -44 139 -22q84 25 114 123q14 45 14 101v162q-59 -2 -111 -12t-106.5 -33.5t-87 -71t-32.5 -114.5z" />
+    <glyph glyph-name="_586" unicode="&#xf271;" horiz-adv-x="1792" 
+d="M1536 1280q52 0 90 -38t38 -90v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128zM1152 1376v-288q0 -14 9 -23t23 -9
+h64q14 0 23 9t9 23v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM384 1376v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM1536 -128v1024h-1408v-1024h1408zM896 448h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224
+v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v224q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-224z" />
+    <glyph glyph-name="_587" unicode="&#xf272;" horiz-adv-x="1792" 
+d="M1152 416v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23
+t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47
+t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_588" unicode="&#xf273;" horiz-adv-x="1792" 
+d="M1111 151l-46 -46q-9 -9 -22 -9t-23 9l-188 189l-188 -189q-10 -9 -23 -9t-22 9l-46 46q-9 9 -9 22t9 23l189 188l-189 188q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l188 -188l188 188q10 9 23 9t22 -9l46 -46q9 -9 9 -22t-9 -23l-188 -188l188 -188q9 -10 9 -23t-9 -22z
+M128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280
+q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_589" unicode="&#xf274;" horiz-adv-x="1792" 
+d="M1303 572l-512 -512q-10 -9 -23 -9t-23 9l-288 288q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l220 -220l444 444q10 9 23 9t22 -9l46 -46q9 -9 9 -22t-9 -23zM128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23
+t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47
+t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_590" unicode="&#xf275;" horiz-adv-x="1792" 
+d="M448 1536q26 0 45 -19t19 -45v-891l536 429q17 14 40 14q26 0 45 -19t19 -45v-379l536 429q17 14 40 14q26 0 45 -19t19 -45v-1152q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h384z" />
+    <glyph glyph-name="_591" unicode="&#xf276;" horiz-adv-x="1024" 
+d="M512 448q66 0 128 15v-655q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v655q62 -15 128 -15zM512 1536q212 0 362 -150t150 -362t-150 -362t-362 -150t-362 150t-150 362t150 362t362 150zM512 1312q14 0 23 9t9 23t-9 23t-23 9q-146 0 -249 -103t-103 -249
+q0 -14 9 -23t23 -9t23 9t9 23q0 119 84.5 203.5t203.5 84.5z" />
+    <glyph glyph-name="_592" unicode="&#xf277;" horiz-adv-x="1792" 
+d="M1745 1239q10 -10 10 -23t-10 -23l-141 -141q-28 -28 -68 -28h-1344q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h576v64q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-64h512q40 0 68 -28zM768 320h256v-512q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v512zM1600 768
+q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-1344q-40 0 -68 28l-141 141q-10 10 -10 23t10 23l141 141q28 28 68 28h512v192h256v-192h576z" />
+    <glyph glyph-name="_593" unicode="&#xf278;" horiz-adv-x="2048" 
+d="M2020 1525q28 -20 28 -53v-1408q0 -20 -11 -36t-29 -23l-640 -256q-24 -11 -48 0l-616 246l-616 -246q-10 -5 -24 -5q-19 0 -36 11q-28 20 -28 53v1408q0 20 11 36t29 23l640 256q24 11 48 0l616 -246l616 246q32 13 60 -6zM736 1390v-1270l576 -230v1270zM128 1173
+v-1270l544 217v1270zM1920 107v1270l-544 -217v-1270z" />
+    <glyph glyph-name="_594" unicode="&#xf279;" horiz-adv-x="1792" 
+d="M512 1536q13 0 22.5 -9.5t9.5 -22.5v-1472q0 -20 -17 -28l-480 -256q-7 -4 -15 -4q-13 0 -22.5 9.5t-9.5 22.5v1472q0 20 17 28l480 256q7 4 15 4zM1760 1536q13 0 22.5 -9.5t9.5 -22.5v-1472q0 -20 -17 -28l-480 -256q-7 -4 -15 -4q-13 0 -22.5 9.5t-9.5 22.5v1472
+q0 20 17 28l480 256q7 4 15 4zM640 1536q8 0 14 -3l512 -256q18 -10 18 -29v-1472q0 -13 -9.5 -22.5t-22.5 -9.5q-8 0 -14 3l-512 256q-18 10 -18 29v1472q0 13 9.5 22.5t22.5 9.5z" />
+    <glyph glyph-name="_595" unicode="&#xf27a;" horiz-adv-x="1792" 
+d="M640 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1408 640q0 53 -37.5 90.5t-90.5 37.5
+t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-110 0 -211 18q-173 -173 -435 -229q-52 -10 -86 -13q-12 -1 -22 6t-13 18q-4 15 20 37q5 5 23.5 21.5t25.5 23.5t23.5 25.5t24 31.5t20.5 37
+t20 48t14.5 57.5t12.5 72.5q-146 90 -229.5 216.5t-83.5 269.5q0 174 120 321.5t326 233t450 85.5t450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="_596" unicode="&#xf27b;" horiz-adv-x="1792" 
+d="M640 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1024 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 -53 -37.5 -90.5t-90.5 -37.5
+t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM896 1152q-204 0 -381.5 -69.5t-282 -187.5t-104.5 -255q0 -112 71.5 -213.5t201.5 -175.5l87 -50l-27 -96q-24 -91 -70 -172q152 63 275 171l43 38l57 -6q69 -8 130 -8q204 0 381.5 69.5t282 187.5
+t104.5 255t-104.5 255t-282 187.5t-381.5 69.5zM1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22h-5q-15 0 -27 10.5t-16 27.5v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51
+t27 59t26 76q-157 89 -247.5 220t-90.5 281q0 130 71 248.5t191 204.5t286 136.5t348 50.5t348 -50.5t286 -136.5t191 -204.5t71 -248.5z" />
+    <glyph glyph-name="_597" unicode="&#xf27c;" horiz-adv-x="1024" 
+d="M512 345l512 295v-591l-512 -296v592zM0 640v-591l512 296zM512 1527v-591l-512 -296v591zM512 936l512 295v-591z" />
+    <glyph glyph-name="_598" unicode="&#xf27d;" horiz-adv-x="1792" 
+d="M1709 1018q-10 -236 -332 -651q-333 -431 -562 -431q-142 0 -240 263q-44 160 -132 482q-72 262 -157 262q-18 0 -127 -76l-77 98q24 21 108 96.5t130 115.5q156 138 241 146q95 9 153 -55.5t81 -203.5q44 -287 66 -373q55 -249 120 -249q51 0 154 161q101 161 109 246
+q13 139 -109 139q-57 0 -121 -26q120 393 459 382q251 -8 236 -326z" />
+    <glyph glyph-name="f27e" unicode="&#xf27e;" 
+d="M0 1408h1536v-1536h-1536v1536zM1085 293l-221 631l221 297h-634l221 -297l-221 -631l317 -304z" />
+    <glyph glyph-name="uniF280" unicode="&#xf280;" 
+d="M0 1408h1536v-1536h-1536v1536zM908 1088l-12 -33l75 -83l-31 -114l25 -25l107 57l107 -57l25 25l-31 114l75 83l-12 33h-95l-53 96h-32l-53 -96h-95zM641 925q32 0 44.5 -16t11.5 -63l174 21q0 55 -17.5 92.5t-50.5 56t-69 25.5t-85 7q-133 0 -199 -57.5t-66 -182.5v-72
+h-96v-128h76q20 0 20 -8v-382q0 -14 -5 -20t-18 -7l-73 -7v-88h448v86l-149 14q-6 1 -8.5 1.5t-3.5 2.5t-0.5 4t1 7t0.5 10v387h191l38 128h-231q-6 0 -2 6t4 9v80q0 27 1.5 40.5t7.5 28t19.5 20t36.5 5.5zM1248 96v86l-54 9q-7 1 -9.5 2.5t-2.5 3t1 7.5t1 12v520h-275
+l-23 -101l83 -22q23 -7 23 -27v-370q0 -14 -6 -18.5t-20 -6.5l-70 -9v-86h352z" />
+    <glyph glyph-name="uniF281" unicode="&#xf281;" horiz-adv-x="1792" 
+d="M1792 690q0 -58 -29.5 -105.5t-79.5 -72.5q12 -46 12 -96q0 -155 -106.5 -287t-290.5 -208.5t-400 -76.5t-399.5 76.5t-290 208.5t-106.5 287q0 47 11 94q-51 25 -82 73.5t-31 106.5q0 82 58 140.5t141 58.5q85 0 145 -63q218 152 515 162l116 521q3 13 15 21t26 5
+l369 -81q18 37 54 59.5t79 22.5q62 0 106 -43.5t44 -105.5t-44 -106t-106 -44t-105.5 43.5t-43.5 105.5l-334 74l-104 -472q300 -9 519 -160q58 61 143 61q83 0 141 -58.5t58 -140.5zM418 491q0 -62 43.5 -106t105.5 -44t106 44t44 106t-44 105.5t-106 43.5q-61 0 -105 -44
+t-44 -105zM1228 136q11 11 11 26t-11 26q-10 10 -25 10t-26 -10q-41 -42 -121 -62t-160 -20t-160 20t-121 62q-11 10 -26 10t-25 -10q-11 -10 -11 -25.5t11 -26.5q43 -43 118.5 -68t122.5 -29.5t91 -4.5t91 4.5t122.5 29.5t118.5 68zM1225 341q62 0 105.5 44t43.5 106
+q0 61 -44 105t-105 44q-62 0 -106 -43.5t-44 -105.5t44 -106t106 -44z" />
+    <glyph glyph-name="_602" unicode="&#xf282;" horiz-adv-x="1792" 
+d="M69 741h1q16 126 58.5 241.5t115 217t167.5 176t223.5 117.5t276.5 43q231 0 414 -105.5t294 -303.5q104 -187 104 -442v-188h-1125q1 -111 53.5 -192.5t136.5 -122.5t189.5 -57t213 -3t208 46.5t173.5 84.5v-377q-92 -55 -229.5 -92t-312.5 -38t-316 53
+q-189 73 -311.5 249t-124.5 372q-3 242 111 412t325 268q-48 -60 -78 -125.5t-46 -159.5h635q8 77 -8 140t-47 101.5t-70.5 66.5t-80.5 41t-75 20.5t-56 8.5l-22 1q-135 -5 -259.5 -44.5t-223.5 -104.5t-176 -140.5t-138 -163.5z" />
+    <glyph glyph-name="_603" unicode="&#xf283;" horiz-adv-x="2304" 
+d="M0 32v608h2304v-608q0 -66 -47 -113t-113 -47h-1984q-66 0 -113 47t-47 113zM640 256v-128h384v128h-384zM256 256v-128h256v128h-256zM2144 1408q66 0 113 -47t47 -113v-224h-2304v224q0 66 47 113t113 47h1984z" />
+    <glyph glyph-name="_604" unicode="&#xf284;" horiz-adv-x="1792" 
+d="M1584 246l-218 111q-74 -120 -196.5 -189t-263.5 -69q-147 0 -271 72t-196 196t-72 270q0 110 42.5 209.5t115 172t172 115t209.5 42.5q131 0 247.5 -60.5t192.5 -168.5l215 125q-110 169 -286.5 265t-378.5 96q-161 0 -308 -63t-253 -169t-169 -253t-63 -308t63 -308
+t169 -253t253 -169t308 -63q213 0 397.5 107t290.5 292zM1030 643l693 -352q-116 -253 -334.5 -400t-492.5 -147q-182 0 -348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71q260 0 470.5 -133.5t335.5 -366.5zM1543 640h-39v-160h-96v352h136q32 0 54.5 -20
+t28.5 -48t1 -56t-27.5 -48t-57.5 -20z" />
+    <glyph glyph-name="uniF285" unicode="&#xf285;" horiz-adv-x="1792" 
+d="M1427 827l-614 386l92 151h855zM405 562l-184 116v858l1183 -743zM1424 697l147 -95v-858l-532 335zM1387 718l-500 -802h-855l356 571z" />
+    <glyph glyph-name="uniF286" unicode="&#xf286;" horiz-adv-x="1792" 
+d="M640 528v224q0 16 -16 16h-96q-16 0 -16 -16v-224q0 -16 16 -16h96q16 0 16 16zM1152 528v224q0 16 -16 16h-96q-16 0 -16 -16v-224q0 -16 16 -16h96q16 0 16 16zM1664 496v-752h-640v320q0 80 -56 136t-136 56t-136 -56t-56 -136v-320h-640v752q0 16 16 16h96
+q16 0 16 -16v-112h128v624q0 16 16 16h96q16 0 16 -16v-112h128v112q0 16 16 16h96q16 0 16 -16v-112h128v112q0 6 2.5 9.5t8.5 5t9.5 2t11.5 0t9 -0.5v391q-32 15 -32 50q0 23 16.5 39t38.5 16t38.5 -16t16.5 -39q0 -35 -32 -50v-17q45 10 83 10q21 0 59.5 -7.5t54.5 -7.5
+q17 0 47 7.5t37 7.5q16 0 16 -16v-210q0 -15 -35 -21.5t-62 -6.5q-18 0 -54.5 7.5t-55.5 7.5q-40 0 -90 -12v-133q1 0 9 0.5t11.5 0t9.5 -2t8.5 -5t2.5 -9.5v-112h128v112q0 16 16 16h96q16 0 16 -16v-112h128v112q0 16 16 16h96q16 0 16 -16v-624h128v112q0 16 16 16h96
+q16 0 16 -16z" />
+    <glyph glyph-name="_607" unicode="&#xf287;" horiz-adv-x="2304" 
+d="M2288 731q16 -8 16 -27t-16 -27l-320 -192q-8 -5 -16 -5q-9 0 -16 4q-16 10 -16 28v128h-858q37 -58 83 -165q16 -37 24.5 -55t24 -49t27 -47t27 -34t31.5 -26t33 -8h96v96q0 14 9 23t23 9h320q14 0 23 -9t9 -23v-320q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v96h-96
+q-32 0 -61 10t-51 23.5t-45 40.5t-37 46t-33.5 57t-28.5 57.5t-28 60.5q-23 53 -37 81.5t-36 65t-44.5 53.5t-46.5 17h-360q-22 -84 -91 -138t-157 -54q-106 0 -181 75t-75 181t75 181t181 75q88 0 157 -54t91 -138h104q24 0 46.5 17t44.5 53.5t36 65t37 81.5q19 41 28 60.5
+t28.5 57.5t33.5 57t37 46t45 40.5t51 23.5t61 10h107q21 57 70 92.5t111 35.5q80 0 136 -56t56 -136t-56 -136t-136 -56q-62 0 -111 35.5t-70 92.5h-107q-17 0 -33 -8t-31.5 -26t-27 -34t-27 -47t-24 -49t-24.5 -55q-46 -107 -83 -165h1114v128q0 18 16 28t32 -1z" />
+    <glyph glyph-name="_608" unicode="&#xf288;" horiz-adv-x="1792" 
+d="M1150 774q0 -56 -39.5 -95t-95.5 -39h-253v269h253q56 0 95.5 -39.5t39.5 -95.5zM1329 774q0 130 -91.5 222t-222.5 92h-433v-896h180v269h253q130 0 222 91.5t92 221.5zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348
+t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_609" unicode="&#xf289;" horiz-adv-x="2304" 
+d="M1645 438q0 59 -34 106.5t-87 68.5q-7 -45 -23 -92q-7 -24 -27.5 -38t-44.5 -14q-12 0 -24 3q-31 10 -45 38.5t-4 58.5q23 71 23 143q0 123 -61 227.5t-166 165.5t-228 61q-134 0 -247 -73t-167 -194q108 -28 188 -106q22 -23 22 -55t-22 -54t-54 -22t-55 22
+q-75 75 -180 75q-106 0 -181 -74.5t-75 -180.5t75 -180.5t181 -74.5h1046q79 0 134.5 55.5t55.5 133.5zM1798 438q0 -142 -100.5 -242t-242.5 -100h-1046q-169 0 -289 119.5t-120 288.5q0 153 100 267t249 136q62 184 221 298t354 114q235 0 408.5 -158.5t196.5 -389.5
+q116 -25 192.5 -118.5t76.5 -214.5zM2048 438q0 -175 -97 -319q-23 -33 -64 -33q-24 0 -43 13q-26 17 -32 48.5t12 57.5q71 104 71 233t-71 233q-18 26 -12 57t32 49t57.5 11.5t49.5 -32.5q97 -142 97 -318zM2304 438q0 -244 -134 -443q-23 -34 -64 -34q-23 0 -42 13
+q-26 18 -32.5 49t11.5 57q108 164 108 358q0 195 -108 357q-18 26 -11.5 57.5t32.5 48.5q26 18 57 12t49 -33q134 -198 134 -442z" />
+    <glyph glyph-name="_610" unicode="&#xf28a;" 
+d="M1500 -13q0 -89 -63 -152.5t-153 -63.5t-153.5 63.5t-63.5 152.5q0 90 63.5 153.5t153.5 63.5t153 -63.5t63 -153.5zM1267 268q-115 -15 -192.5 -102.5t-77.5 -205.5q0 -74 33 -138q-146 -78 -379 -78q-109 0 -201 21t-153.5 54.5t-110.5 76.5t-76 85t-44.5 83
+t-23.5 66.5t-6 39.5q0 19 4.5 42.5t18.5 56t36.5 58t64 43.5t94.5 18t94 -17.5t63 -41t35.5 -53t17.5 -49t4 -33.5q0 -34 -23 -81q28 -27 82 -42t93 -17l40 -1q115 0 190 51t75 133q0 26 -9 48.5t-31.5 44.5t-49.5 41t-74 44t-93.5 47.5t-119.5 56.5q-28 13 -43 20
+q-116 55 -187 100t-122.5 102t-72 125.5t-20.5 162.5q0 78 20.5 150t66 137.5t112.5 114t166.5 77t221.5 28.5q120 0 220 -26t164.5 -67t109.5 -94t64 -105.5t19 -103.5q0 -46 -15 -82.5t-36.5 -58t-48.5 -36t-49 -19.5t-39 -5h-8h-32t-39 5t-44 14t-41 28t-37 46t-24 70.5
+t-10 97.5q-15 16 -59 25.5t-81 10.5l-37 1q-68 0 -117.5 -31t-70.5 -70t-21 -76q0 -24 5 -43t24 -46t53 -51t97 -53.5t150 -58.5q76 -25 138.5 -53.5t109 -55.5t83 -59t60.5 -59.5t41 -62.5t26.5 -62t14.5 -63.5t6 -62t1 -62.5z" />
+    <glyph glyph-name="_611" unicode="&#xf28b;" 
+d="M704 352v576q0 14 -9 23t-23 9h-256q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h256q14 0 23 9t9 23zM1152 352v576q0 14 -9 23t-23 9h-256q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h256q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103
+t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_612" unicode="&#xf28c;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM768 96q148 0 273 73t198 198t73 273t-73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273
+t73 -273t198 -198t273 -73zM864 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-192zM480 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-192z" />
+    <glyph glyph-name="_613" unicode="&#xf28d;" 
+d="M1088 352v576q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="_614" unicode="&#xf28e;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM768 96q148 0 273 73t198 198t73 273t-73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273
+t73 -273t198 -198t273 -73zM480 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h576q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-576z" />
+    <glyph glyph-name="_615" unicode="&#xf290;" horiz-adv-x="1792" 
+d="M1757 128l35 -313q3 -28 -16 -50q-19 -21 -48 -21h-1664q-29 0 -48 21q-19 22 -16 50l35 313h1722zM1664 967l86 -775h-1708l86 775q3 24 21 40.5t43 16.5h256v-128q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5v128h384v-128q0 -53 37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5v128h256q25 0 43 -16.5t21 -40.5zM1280 1152v-256q0 -26 -19 -45t-45 -19t-45 19t-19 45v256q0 106 -75 181t-181 75t-181 -75t-75 -181v-256q0 -26 -19 -45t-45 -19t-45 19t-19 45v256q0 159 112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="_616" unicode="&#xf291;" horiz-adv-x="2048" 
+d="M1920 768q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5h-15l-115 -662q-8 -46 -44 -76t-82 -30h-1280q-46 0 -82 30t-44 76l-115 662h-15q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5h1792zM485 -32q26 2 43.5 22.5t15.5 46.5l-32 416q-2 26 -22.5 43.5
+t-46.5 15.5t-43.5 -22.5t-15.5 -46.5l32 -416q2 -25 20.5 -42t43.5 -17h5zM896 32v416q0 26 -19 45t-45 19t-45 -19t-19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45zM1280 32v416q0 26 -19 45t-45 19t-45 -19t-19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45zM1632 27l32 416
+q2 26 -15.5 46.5t-43.5 22.5t-46.5 -15.5t-22.5 -43.5l-32 -416q-2 -26 15.5 -46.5t43.5 -22.5h5q25 0 43.5 17t20.5 42zM476 1244l-93 -412h-132l101 441q19 88 89 143.5t160 55.5h167q0 26 19 45t45 19h384q26 0 45 -19t19 -45h167q90 0 160 -55.5t89 -143.5l101 -441
+h-132l-93 412q-11 44 -45.5 72t-79.5 28h-167q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45h-167q-45 0 -79.5 -28t-45.5 -72z" />
+    <glyph glyph-name="_617" unicode="&#xf292;" horiz-adv-x="1792" 
+d="M991 512l64 256h-254l-64 -256h254zM1759 1016l-56 -224q-7 -24 -31 -24h-327l-64 -256h311q15 0 25 -12q10 -14 6 -28l-56 -224q-5 -24 -31 -24h-327l-81 -328q-7 -24 -31 -24h-224q-16 0 -26 12q-9 12 -6 28l78 312h-254l-81 -328q-7 -24 -31 -24h-225q-15 0 -25 12
+q-9 12 -6 28l78 312h-311q-15 0 -25 12q-9 12 -6 28l56 224q7 24 31 24h327l64 256h-311q-15 0 -25 12q-10 14 -6 28l56 224q5 24 31 24h327l81 328q7 24 32 24h224q15 0 25 -12q9 -12 6 -28l-78 -312h254l81 328q7 24 32 24h224q15 0 25 -12q9 -12 6 -28l-78 -312h311
+q15 0 25 -12q9 -12 6 -28z" />
+    <glyph glyph-name="_618" unicode="&#xf293;" 
+d="M841 483l148 -148l-149 -149zM840 1094l149 -149l-148 -148zM710 -130l464 464l-306 306l306 306l-464 464v-611l-255 255l-93 -93l320 -321l-320 -321l93 -93l255 255v-611zM1429 640q0 -209 -32 -365.5t-87.5 -257t-140.5 -162.5t-181.5 -86.5t-219.5 -24.5
+t-219.5 24.5t-181.5 86.5t-140.5 162.5t-87.5 257t-32 365.5t32 365.5t87.5 257t140.5 162.5t181.5 86.5t219.5 24.5t219.5 -24.5t181.5 -86.5t140.5 -162.5t87.5 -257t32 -365.5z" />
+    <glyph glyph-name="_619" unicode="&#xf294;" horiz-adv-x="1024" 
+d="M596 113l173 172l-173 172v-344zM596 823l173 172l-173 172v-344zM628 640l356 -356l-539 -540v711l-297 -296l-108 108l372 373l-372 373l108 108l297 -296v711l539 -540z" />
+    <glyph glyph-name="_620" unicode="&#xf295;" 
+d="M1280 256q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM512 1024q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM1536 256q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5
+t112.5 -271.5zM1440 1344q0 -20 -13 -38l-1056 -1408q-19 -26 -51 -26h-160q-26 0 -45 19t-19 45q0 20 13 38l1056 1408q19 26 51 26h160q26 0 45 -19t19 -45zM768 1024q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5
+t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="_621" unicode="&#xf296;" horiz-adv-x="1792" 
+d="M104 830l792 -1015l-868 630q-18 13 -25 34.5t0 42.5l101 308v0zM566 830h660l-330 -1015v0zM368 1442l198 -612h-462l198 612q8 23 33 23t33 -23zM1688 830l101 -308q7 -21 0 -42.5t-25 -34.5l-868 -630l792 1015v0zM1688 830h-462l198 612q8 23 33 23t33 -23z" />
+    <glyph glyph-name="_622" unicode="&#xf297;" horiz-adv-x="1792" 
+d="M384 704h160v224h-160v-224zM1221 372v92q-104 -36 -243 -38q-135 -1 -259.5 46.5t-220.5 122.5l1 -96q88 -80 212 -128.5t272 -47.5q129 0 238 49zM640 704h640v224h-640v-224zM1792 736q0 -187 -99 -352q89 -102 89 -229q0 -157 -129.5 -268t-313.5 -111
+q-122 0 -225 52.5t-161 140.5q-19 -1 -57 -1t-57 1q-58 -88 -161 -140.5t-225 -52.5q-184 0 -313.5 111t-129.5 268q0 127 89 229q-99 165 -99 352q0 209 120 385.5t326.5 279.5t449.5 103t449.5 -103t326.5 -279.5t120 -385.5z" />
+    <glyph glyph-name="_623" unicode="&#xf298;" 
+d="M515 625v-128h-252v128h252zM515 880v-127h-252v127h252zM1273 369v-128h-341v128h341zM1273 625v-128h-672v128h672zM1273 880v-127h-672v127h672zM1408 20v1240q0 8 -6 14t-14 6h-32l-378 -256l-210 171l-210 -171l-378 256h-32q-8 0 -14 -6t-6 -14v-1240q0 -8 6 -14
+t14 -6h1240q8 0 14 6t6 14zM553 1130l185 150h-406zM983 1130l221 150h-406zM1536 1260v-1240q0 -62 -43 -105t-105 -43h-1240q-62 0 -105 43t-43 105v1240q0 62 43 105t105 43h1240q62 0 105 -43t43 -105z" />
+    <glyph glyph-name="_624" unicode="&#xf299;" horiz-adv-x="1792" 
+d="M896 720q-104 196 -160 278q-139 202 -347 318q-34 19 -70 36q-89 40 -94 32t34 -38l39 -31q62 -43 112.5 -93.5t94.5 -116.5t70.5 -113t70.5 -131q9 -17 13 -25q44 -84 84 -153t98 -154t115.5 -150t131 -123.5t148.5 -90.5q153 -66 154 -60q1 3 -49 37q-53 36 -81 57
+q-77 58 -179 211t-185 310zM549 177q-76 60 -132.5 125t-98 143.5t-71 154.5t-58.5 186t-52 209t-60.5 252t-76.5 289q273 0 497.5 -36t379 -92t271 -144.5t185.5 -172.5t110 -198.5t56 -199.5t12.5 -198.5t-9.5 -173t-20 -143.5t-13 -107l323 -327h-104l-281 285
+q-22 -2 -91.5 -14t-121.5 -19t-138 -6t-160.5 17t-167.5 59t-179 111z" />
+    <glyph glyph-name="_625" unicode="&#xf29a;" horiz-adv-x="1792" 
+d="M1374 879q-6 26 -28.5 39.5t-48.5 7.5q-261 -62 -401 -62t-401 62q-26 6 -48.5 -7.5t-28.5 -39.5t7.5 -48.5t39.5 -28.5q194 -46 303 -58q-2 -158 -15.5 -269t-26.5 -155.5t-41 -115.5l-9 -21q-10 -25 1 -49t36 -34q9 -4 23 -4q44 0 60 41l8 20q54 139 71 259h42
+q17 -120 71 -259l8 -20q16 -41 60 -41q14 0 23 4q25 10 36 34t1 49l-9 21q-28 71 -41 115.5t-26.5 155.5t-15.5 269q109 12 303 58q26 6 39.5 28.5t7.5 48.5zM1024 1024q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5z
+M1600 640q0 -143 -55.5 -273.5t-150 -225t-225 -150t-273.5 -55.5t-273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5zM896 1408q-156 0 -298 -61t-245 -164t-164 -245t-61 -298t61 -298
+t164 -245t245 -164t298 -61t298 61t245 164t164 245t61 298t-61 298t-164 245t-245 164t-298 61zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_626" unicode="&#xf29b;" 
+d="M1438 723q34 -35 29 -82l-44 -551q-4 -42 -34.5 -70t-71.5 -28q-6 0 -9 1q-44 3 -72.5 36.5t-25.5 77.5l35 429l-143 -8q55 -113 55 -240q0 -216 -148 -372l-137 137q91 101 91 235q0 145 -102.5 248t-247.5 103q-134 0 -236 -92l-137 138q120 114 284 141l264 300
+l-149 87l-181 -161q-33 -30 -77 -27.5t-73 35.5t-26.5 77t34.5 73l239 213q26 23 60 26.5t64 -14.5l488 -283q36 -21 48 -68q17 -67 -26 -117l-205 -232l371 20q49 3 83 -32zM1240 1180q-74 0 -126 52t-52 126t52 126t126 52t126.5 -52t52.5 -126t-52.5 -126t-126.5 -52z
+M613 -62q106 0 196 61l139 -139q-146 -116 -335 -116q-148 0 -273.5 73t-198.5 198t-73 273q0 188 116 336l139 -139q-60 -88 -60 -197q0 -145 102.5 -247.5t247.5 -102.5z" />
+    <glyph glyph-name="_627" unicode="&#xf29c;" 
+d="M880 336v-160q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v160q0 14 9 23t23 9h160q14 0 23 -9t9 -23zM1136 832q0 -50 -15 -90t-45.5 -69t-52 -44t-59.5 -36q-32 -18 -46.5 -28t-26 -24t-11.5 -29v-32q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v68q0 35 10.5 64.5
+t24 47.5t39 35.5t41 25.5t44.5 21q53 25 75 43t22 49q0 42 -43.5 71.5t-95.5 29.5q-56 0 -95 -27q-29 -20 -80 -83q-9 -12 -25 -12q-11 0 -19 6l-108 82q-10 7 -12 20t5 23q122 192 349 192q129 0 238.5 -89.5t109.5 -214.5zM768 1280q-130 0 -248.5 -51t-204 -136.5
+t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5
+t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_628" unicode="&#xf29d;" horiz-adv-x="1408" 
+d="M366 1225q-64 0 -110 45.5t-46 110.5q0 64 46 109.5t110 45.5t109.5 -45.5t45.5 -109.5q0 -65 -45.5 -110.5t-109.5 -45.5zM917 583q0 -50 -30 -67.5t-63.5 -6.5t-47.5 34l-367 438q-7 12 -14 15.5t-11 1.5l-3 -3q-7 -8 4 -21l122 -139l1 -354l-161 -457
+q-67 -192 -92 -234q-15 -26 -28 -32q-50 -26 -103 -1q-29 13 -41.5 43t-9.5 57q2 17 197 618l5 416l-85 -164l35 -222q4 -24 -1 -42t-14 -27.5t-19 -16t-17 -7.5l-7 -2q-19 -3 -34.5 3t-24 16t-14 22t-7.5 19.5t-2 9.5l-46 299l211 381q23 34 113 34q75 0 107 -40l424 -521
+q7 -5 14 -17l3 -3l-1 -1q7 -13 7 -29zM514 433q43 -113 88.5 -225t69.5 -168l24 -55q36 -93 42 -125q11 -70 -36 -97q-35 -22 -66 -16t-51 22t-29 35h-1q-6 16 -8 25l-124 351zM1338 -159q31 -49 31 -57q0 -5 -3 -7q-9 -5 -14.5 0.5t-15.5 26t-16 30.5q-114 172 -423 661
+q3 -1 7 1t7 4l3 2q11 9 11 17z" />
+    <glyph glyph-name="_629" unicode="&#xf29e;" horiz-adv-x="2304" 
+d="M504 542h171l-1 265zM1530 641q0 87 -50.5 140t-146.5 53h-54v-388h52q91 0 145 57t54 138zM956 1018l1 -756q0 -14 -9.5 -24t-23.5 -10h-216q-14 0 -23.5 10t-9.5 24v62h-291l-55 -81q-10 -15 -28 -15h-267q-21 0 -30.5 18t3.5 35l556 757q9 14 27 14h332q14 0 24 -10
+t10 -24zM1783 641q0 -193 -125.5 -303t-324.5 -110h-270q-14 0 -24 10t-10 24v756q0 14 10 24t24 10h268q200 0 326 -109t126 -302zM1939 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-44.5 -108t-73.5 -102.5h-51q38 45 66.5 104.5t41.5 112t21 98t9 72.5l1 27q0 8 -0.5 22.5
+t-7.5 60t-20 91.5t-41 111.5t-66 124.5h43q41 -47 72 -107t45.5 -111.5t23 -96t10.5 -70.5zM2123 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-45 -108t-74 -102.5h-51q38 45 66.5 104.5t41.5 112t21 98t9 72.5l1 27q0 8 -0.5 22.5t-7.5 60t-19.5 91.5t-40.5 111.5t-66 124.5
+h43q41 -47 72 -107t45.5 -111.5t23 -96t10.5 -70.5zM2304 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-44.5 -108t-73.5 -102.5h-51q38 45 66 104.5t41 112t21 98t9 72.5l1 27q0 8 -0.5 22.5t-7.5 60t-19.5 91.5t-40.5 111.5t-66 124.5h43q41 -47 72 -107t45.5 -111.5t23 -96
+t9.5 -70.5z" />
+    <glyph glyph-name="uniF2A0" unicode="&#xf2a0;" horiz-adv-x="1408" 
+d="M617 -153q0 11 -13 58t-31 107t-20 69q-1 4 -5 26.5t-8.5 36t-13.5 21.5q-15 14 -51 14q-23 0 -70 -5.5t-71 -5.5q-34 0 -47 11q-6 5 -11 15.5t-7.5 20t-6.5 24t-5 18.5q-37 128 -37 255t37 255q1 4 5 18.5t6.5 24t7.5 20t11 15.5q13 11 47 11q24 0 71 -5.5t70 -5.5
+q36 0 51 14q9 8 13.5 21.5t8.5 36t5 26.5q2 9 20 69t31 107t13 58q0 22 -43.5 52.5t-75.5 42.5q-20 8 -45 8q-34 0 -98 -18q-57 -17 -96.5 -40.5t-71 -66t-46 -70t-45.5 -94.5q-6 -12 -9 -19q-49 -107 -68 -216t-19 -244t19 -244t68 -216q56 -122 83 -161q63 -91 179 -127
+l6 -2q64 -18 98 -18q25 0 45 8q32 12 75.5 42.5t43.5 52.5zM776 760q-26 0 -45 19t-19 45.5t19 45.5q37 37 37 90q0 52 -37 91q-19 19 -19 45t19 45t45 19t45 -19q75 -75 75 -181t-75 -181q-21 -19 -45 -19zM957 579q-27 0 -45 19q-19 19 -19 45t19 45q112 114 112 272
+t-112 272q-19 19 -19 45t19 45t45 19t45 -19q150 -150 150 -362t-150 -362q-18 -19 -45 -19zM1138 398q-27 0 -45 19q-19 19 -19 45t19 45q90 91 138.5 208t48.5 245t-48.5 245t-138.5 208q-19 19 -19 45t19 45t45 19t45 -19q109 -109 167 -249t58 -294t-58 -294t-167 -249
+q-18 -19 -45 -19z" />
+    <glyph glyph-name="uniF2A1" unicode="&#xf2a1;" horiz-adv-x="2176" 
+d="M192 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM704 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM704 864q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1472 352
+q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1472 864q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 864
+q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 1376q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM384 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 192q0 -80 -56 -136
+t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 1216q0 -80 -56 -136t-136 -56
+t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM2176 192q0 -80 -56 -136t-136 -56t-136 56
+t-56 136t56 136t136 56t136 -56t56 -136zM1664 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM2176 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136
+t56 136t136 56t136 -56t56 -136zM2176 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="uniF2A2" unicode="&#xf2a2;" horiz-adv-x="1792" 
+d="M128 -192q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM320 0q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM365 365l256 -256l-90 -90l-256 256zM704 384q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45z
+M1411 704q0 -59 -11.5 -108.5t-37.5 -93.5t-44 -67.5t-53 -64.5q-31 -35 -45.5 -54t-33.5 -50t-26.5 -64t-7.5 -74q0 -159 -112.5 -271.5t-271.5 -112.5q-26 0 -45 19t-19 45t19 45t45 19q106 0 181 75t75 181q0 57 11.5 105.5t37 91t43.5 66.5t52 63q40 46 59.5 72
+t37.5 74.5t18 103.5q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 117 45.5 223.5t123 184t184 123t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5zM896 576q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45
+t45 19t45 -19t19 -45zM1184 704q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 93 -65.5 158.5t-158.5 65.5q-92 0 -158 -65.5t-66 -158.5q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 146 103 249t249 103t249 -103t103 -249zM1578 993q10 -25 -1 -49t-36 -34q-9 -4 -23 -4
+q-19 0 -35.5 11t-23.5 30q-68 178 -224 295q-21 16 -25 42t12 47q17 21 43 25t47 -12q183 -137 266 -351zM1788 1074q9 -25 -1.5 -49t-35.5 -34q-11 -4 -23 -4q-44 0 -60 41q-92 238 -297 393q-22 16 -25.5 42t12.5 47q16 22 42 25.5t47 -12.5q235 -175 341 -449z" />
+    <glyph glyph-name="uniF2A3" unicode="&#xf2a3;" horiz-adv-x="2304" 
+d="M1032 576q-59 2 -84 55q-17 34 -48 53.5t-68 19.5q-53 0 -90.5 -37.5t-37.5 -90.5q0 -56 36 -89l10 -8q34 -31 82 -31q37 0 68 19.5t48 53.5q25 53 84 55zM1600 704q0 56 -36 89l-10 8q-34 31 -82 31q-37 0 -68 -19.5t-48 -53.5q-25 -53 -84 -55q59 -2 84 -55
+q17 -34 48 -53.5t68 -19.5q53 0 90.5 37.5t37.5 90.5zM1174 925q-17 -35 -55 -48t-73 4q-62 31 -134 31q-51 0 -99 -17q3 0 9.5 0.5t9.5 0.5q92 0 170.5 -50t118.5 -133q17 -36 3.5 -73.5t-49.5 -54.5q-18 -9 -39 -9q21 0 39 -9q36 -17 49.5 -54.5t-3.5 -73.5
+q-40 -83 -118.5 -133t-170.5 -50h-6q-16 2 -44 4l-290 27l-239 -120q-14 -7 -29 -7q-40 0 -57 35l-160 320q-11 23 -4 47.5t29 37.5l209 119l148 267q17 155 91.5 291.5t195.5 236.5q31 25 70.5 21.5t64.5 -34.5t21.5 -70t-34.5 -65q-70 -59 -117 -128q123 84 267 101
+q40 5 71.5 -19t35.5 -64q5 -40 -19 -71.5t-64 -35.5q-84 -10 -159 -55q46 10 99 10q115 0 218 -50q36 -18 49 -55.5t-5 -73.5zM2137 1085l160 -320q11 -23 4 -47.5t-29 -37.5l-209 -119l-148 -267q-17 -155 -91.5 -291.5t-195.5 -236.5q-26 -22 -61 -22q-45 0 -74 35
+q-25 31 -21.5 70t34.5 65q70 59 117 128q-123 -84 -267 -101q-4 -1 -12 -1q-36 0 -63.5 24t-31.5 60q-5 40 19 71.5t64 35.5q84 10 159 55q-46 -10 -99 -10q-115 0 -218 50q-36 18 -49 55.5t5 73.5q17 35 55 48t73 -4q62 -31 134 -31q51 0 99 17q-3 0 -9.5 -0.5t-9.5 -0.5
+q-92 0 -170.5 50t-118.5 133q-17 36 -3.5 73.5t49.5 54.5q18 9 39 9q-21 0 -39 9q-36 17 -49.5 54.5t3.5 73.5q40 83 118.5 133t170.5 50h6h1q14 -2 42 -4l291 -27l239 120q14 7 29 7q40 0 57 -35z" />
+    <glyph glyph-name="uniF2A4" unicode="&#xf2a4;" horiz-adv-x="1792" 
+d="M1056 704q0 -26 19 -45t45 -19t45 19t19 45q0 146 -103 249t-249 103t-249 -103t-103 -249q0 -26 19 -45t45 -19t45 19t19 45q0 93 66 158.5t158 65.5t158 -65.5t66 -158.5zM835 1280q-117 0 -223.5 -45.5t-184 -123t-123 -184t-45.5 -223.5q0 -26 19 -45t45 -19t45 19
+t19 45q0 185 131.5 316.5t316.5 131.5t316.5 -131.5t131.5 -316.5q0 -55 -18 -103.5t-37.5 -74.5t-59.5 -72q-34 -39 -52 -63t-43.5 -66.5t-37 -91t-11.5 -105.5q0 -106 -75 -181t-181 -75q-26 0 -45 -19t-19 -45t19 -45t45 -19q159 0 271.5 112.5t112.5 271.5q0 41 7.5 74
+t26.5 64t33.5 50t45.5 54q35 41 53 64.5t44 67.5t37.5 93.5t11.5 108.5q0 117 -45.5 223.5t-123 184t-184 123t-223.5 45.5zM591 561l226 -226l-579 -579q-12 -12 -29 -12t-29 12l-168 168q-12 12 -12 29t12 29zM1612 1524l168 -168q12 -12 12 -29t-12 -30l-233 -233
+l-26 -25l-71 -71q-66 153 -195 258l91 91l207 207q13 12 30 12t29 -12z" />
+    <glyph glyph-name="uniF2A5" unicode="&#xf2a5;" 
+d="M866 1021q0 -27 -13 -94q-11 -50 -31.5 -150t-30.5 -150q-2 -11 -4.5 -12.5t-13.5 -2.5q-20 -2 -31 -2q-58 0 -84 49.5t-26 113.5q0 88 35 174t103 124q28 14 51 14q28 0 36.5 -16.5t8.5 -47.5zM1352 597q0 14 -39 75.5t-52 66.5q-21 8 -34 8q-91 0 -226 -77l-2 2
+q3 22 27.5 135t24.5 178q0 233 -242 233q-24 0 -68 -6q-94 -17 -168.5 -89.5t-111.5 -166.5t-37 -189q0 -146 80.5 -225t227.5 -79q25 0 25 -3t-1 -5q-4 -34 -26 -117q-14 -52 -51.5 -101t-82.5 -49q-42 0 -42 47q0 24 10.5 47.5t25 39.5t29.5 28.5t26 20t11 8.5q0 3 -7 10
+q-24 22 -58.5 36.5t-65.5 14.5q-35 0 -63.5 -34t-41 -75t-12.5 -75q0 -88 51.5 -142t138.5 -54q82 0 155 53t117.5 126t65.5 153q6 22 15.5 66.5t14.5 66.5q3 12 14 18q118 60 227 60q48 0 127 -18q1 -1 4 -1q5 0 9.5 4.5t4.5 8.5zM1536 1120v-960q0 -119 -84.5 -203.5
+t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF2A6" unicode="&#xf2a6;" horiz-adv-x="1535" 
+d="M744 1231q0 24 -2 38.5t-8.5 30t-21 23t-37.5 7.5q-39 0 -78 -23q-105 -58 -159 -190.5t-54 -269.5q0 -44 8.5 -85.5t26.5 -80.5t52.5 -62.5t81.5 -23.5q4 0 18 -0.5t20 0t16 3t15 8.5t7 16q16 77 48 231.5t48 231.5q19 91 19 146zM1498 575q0 -7 -7.5 -13.5t-15.5 -6.5
+l-6 1q-22 3 -62 11t-72 12.5t-63 4.5q-167 0 -351 -93q-15 -8 -21 -27q-10 -36 -24.5 -105.5t-22.5 -100.5q-23 -91 -70 -179.5t-112.5 -164.5t-154.5 -123t-185 -47q-135 0 -214.5 83.5t-79.5 219.5q0 53 19.5 117t63 116.5t97.5 52.5q38 0 120 -33.5t83 -61.5
+q0 -1 -16.5 -12.5t-39.5 -31t-46 -44.5t-39 -61t-16 -74q0 -33 16.5 -53t48.5 -20q45 0 85 31.5t66.5 78t48 105.5t32.5 107t16 90v9q0 2 -3.5 3.5t-8.5 1.5h-10t-10 -0.5t-6 -0.5q-227 0 -352 122.5t-125 348.5q0 108 34.5 221t96 210t156 167.5t204.5 89.5q52 9 106 9
+q374 0 374 -360q0 -98 -38 -273t-43 -211l3 -3q101 57 182.5 88t167.5 31q22 0 53 -13q19 -7 80 -102.5t61 -116.5z" />
+    <glyph glyph-name="uniF2A7" unicode="&#xf2a7;" horiz-adv-x="1664" 
+d="M831 863q32 0 59 -18l222 -148q61 -40 110 -97l146 -170q40 -46 29 -106l-72 -413q-6 -32 -29.5 -53.5t-55.5 -25.5l-527 -56l-352 -32h-9q-39 0 -67.5 28t-28.5 68q0 37 27 64t65 32l260 32h-448q-41 0 -69.5 30t-26.5 71q2 39 32 65t69 26l442 1l-521 64q-41 5 -66 37
+t-19 73q6 35 34.5 57.5t65.5 22.5h10l481 -60l-351 94q-38 10 -62 41.5t-18 68.5q6 36 33 58.5t62 22.5q6 0 20 -2l448 -96l217 -37q1 0 3 -0.5t3 -0.5q23 0 30.5 23t-12.5 36l-186 125q-35 23 -42 63.5t18 73.5q27 38 76 38zM761 661l186 -125l-218 37l-5 2l-36 38
+l-238 262q-1 1 -2.5 3.5t-2.5 3.5q-24 31 -18.5 70t37.5 64q31 23 68 17.5t64 -33.5l142 -147q-2 -1 -5 -3.5t-4 -4.5q-32 -45 -23 -99t55 -85zM1648 1115l15 -266q4 -73 -11 -147l-48 -219q-12 -59 -67 -87l-106 -54q2 62 -39 109l-146 170q-53 61 -117 103l-222 148
+q-34 23 -76 23q-51 0 -88 -37l-235 312q-25 33 -18 73.5t41 63.5q33 22 71.5 14t62.5 -40l266 -352l-262 455q-21 35 -10.5 75t47.5 59q35 18 72.5 6t57.5 -46l241 -420l-136 337q-15 35 -4.5 74t44.5 56q37 19 76 6t56 -51l193 -415l101 -196q8 -15 23 -17.5t27 7.5t11 26
+l-12 224q-2 41 26 71t69 31q39 0 67 -28.5t30 -67.5z" />
+    <glyph glyph-name="uniF2A8" unicode="&#xf2a8;" horiz-adv-x="1792" 
+d="M335 180q-2 0 -6 2q-86 57 -168.5 145t-139.5 180q-21 30 -21 69q0 9 2 19t4 18t7 18t8.5 16t10.5 17t10 15t12 15.5t11 14.5q184 251 452 365q-110 198 -110 211q0 19 17 29q116 64 128 64q18 0 28 -16l124 -229q92 19 192 19q266 0 497.5 -137.5t378.5 -369.5
+q20 -31 20 -69t-20 -69q-91 -142 -218.5 -253.5t-278.5 -175.5q110 -198 110 -211q0 -20 -17 -29q-116 -64 -127 -64q-19 0 -29 16l-124 229l-64 119l-444 820l7 7q-58 -24 -99 -47q3 -5 127 -234t243 -449t119 -223q0 -7 -9 -9q-13 -3 -72 -3q-57 0 -60 7l-456 841
+q-39 -28 -82 -68q24 -43 214 -393.5t190 -354.5q0 -10 -11 -10q-14 0 -82.5 22t-72.5 28l-106 197l-224 413q-44 -53 -78 -106q2 -3 18 -25t23 -34l176 -327q0 -10 -10 -10zM1165 282l49 -91q273 111 450 385q-180 277 -459 389q67 -64 103 -148.5t36 -176.5
+q0 -106 -47 -200.5t-132 -157.5zM848 896q0 -20 14 -34t34 -14q86 0 147 -61t61 -147q0 -20 14 -34t34 -14t34 14t14 34q0 126 -89 215t-215 89q-20 0 -34 -14t-14 -34zM1214 961l-9 4l7 -7z" />
+    <glyph glyph-name="uniF2A9" unicode="&#xf2a9;" horiz-adv-x="1280" 
+d="M1050 430q0 -215 -147 -374q-148 -161 -378 -161q-232 0 -378 161q-147 159 -147 374q0 147 68 270.5t189 196.5t268 73q96 0 182 -31q-32 -62 -39 -126q-66 28 -143 28q-167 0 -280.5 -123t-113.5 -291q0 -170 112.5 -288.5t281.5 -118.5t281 118.5t112 288.5
+q0 89 -32 166q66 13 123 49q41 -98 41 -212zM846 619q0 -192 -79.5 -345t-238.5 -253l-14 -1q-29 0 -62 5q83 32 146.5 102.5t99.5 154.5t58.5 189t30 192.5t7.5 178.5q0 69 -3 103q55 -160 55 -326zM791 947v-2q-73 214 -206 440q88 -59 142.5 -186.5t63.5 -251.5z
+M1035 744q-83 0 -160 75q218 120 290 247q19 37 21 56q-42 -94 -139.5 -166.5t-204.5 -97.5q-35 54 -35 113q0 37 17 79t43 68q46 44 157 74q59 16 106 58.5t74 100.5q74 -105 74 -253q0 -109 -24 -170q-32 -77 -88.5 -130.5t-130.5 -53.5z" />
+    <glyph glyph-name="uniF2AA" unicode="&#xf2aa;" 
+d="M1050 495q0 78 -28 147q-41 -25 -85 -34q22 -50 22 -114q0 -117 -77 -198.5t-193 -81.5t-193.5 81.5t-77.5 198.5q0 115 78 199.5t193 84.5q53 0 98 -19q4 43 27 87q-60 21 -125 21q-154 0 -257.5 -108.5t-103.5 -263.5t103.5 -261t257.5 -106t257.5 106.5t103.5 260.5z
+M872 850q2 -24 2 -71q0 -63 -5 -123t-20.5 -132.5t-40.5 -130t-68.5 -106t-100.5 -70.5q21 -3 42 -3h10q219 139 219 411q0 116 -38 225zM872 850q-4 80 -44 171.5t-98 130.5q92 -156 142 -302zM1207 955q0 102 -51 174q-41 -86 -124 -109q-69 -19 -109 -53.5t-40 -99.5
+q0 -40 24 -77q74 17 140.5 67t95.5 115q-4 -52 -74.5 -111.5t-138.5 -97.5q52 -52 110 -52q51 0 90 37t60 90q17 42 17 117zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="uniF2AB" unicode="&#xf2ab;" 
+d="M1279 388q0 22 -22 27q-67 15 -118 59t-80 108q-7 19 -7 25q0 15 19.5 26t43 17t43 20.5t19.5 36.5q0 19 -18.5 31.5t-38.5 12.5q-12 0 -32 -8t-31 -8q-4 0 -12 2q5 95 5 114q0 79 -17 114q-36 78 -103 121.5t-152 43.5q-199 0 -275 -165q-17 -35 -17 -114q0 -19 5 -114
+q-4 -2 -14 -2q-12 0 -32 7.5t-30 7.5q-21 0 -38.5 -12t-17.5 -32q0 -21 19.5 -35.5t43 -20.5t43 -17t19.5 -26q0 -6 -7 -25q-64 -138 -198 -167q-22 -5 -22 -27q0 -46 137 -68q2 -5 6 -26t11.5 -30.5t23.5 -9.5q12 0 37.5 4.5t39.5 4.5q35 0 67 -15t54 -32.5t57.5 -32.5
+t76.5 -15q43 0 79 15t57.5 32.5t53.5 32.5t67 15q14 0 39.5 -4t38.5 -4q16 0 23 10t11 30t6 25q137 22 137 68zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="uniF2AC" unicode="&#xf2ac;" horiz-adv-x="1664" 
+d="M848 1408q134 1 240.5 -68.5t163.5 -192.5q27 -58 27 -179q0 -47 -9 -191q14 -7 28 -7q18 0 51 13.5t51 13.5q29 0 56 -18t27 -46q0 -32 -31.5 -54t-69 -31.5t-69 -29t-31.5 -47.5q0 -15 12 -43q37 -82 102.5 -150t144.5 -101q28 -12 80 -23q28 -6 28 -35
+q0 -70 -219 -103q-7 -11 -11 -39t-14 -46.5t-33 -18.5q-20 0 -62 6.5t-64 6.5q-37 0 -62 -5q-32 -5 -63 -22.5t-58 -38t-58 -40.5t-76 -33.5t-99 -13.5q-52 0 -96.5 13.5t-75 33.5t-57.5 40.5t-58 38t-62 22.5q-26 5 -63 5q-24 0 -65.5 -7.5t-58.5 -7.5q-25 0 -35 18.5
+t-14 47.5t-11 40q-219 33 -219 103q0 29 28 35q52 11 80 23q78 32 144.5 101t102.5 150q12 28 12 43q0 28 -31.5 47.5t-69.5 29.5t-69.5 31.5t-31.5 52.5q0 27 26 45.5t55 18.5q15 0 48 -13t53 -13q18 0 32 7q-9 142 -9 190q0 122 27 180q64 137 172 198t264 63z" />
+    <glyph glyph-name="uniF2AD" unicode="&#xf2ad;" 
+d="M1280 388q0 22 -22 27q-67 14 -118 58t-80 109q-7 14 -7 25q0 15 19.5 26t42.5 17t42.5 20.5t19.5 36.5q0 19 -18.5 31.5t-38.5 12.5q-11 0 -31 -8t-32 -8q-4 0 -12 2q5 63 5 115q0 78 -17 114q-36 78 -102.5 121.5t-152.5 43.5q-198 0 -275 -165q-18 -38 -18 -115
+q0 -38 6 -114q-10 -2 -15 -2q-11 0 -31.5 8t-30.5 8q-20 0 -37.5 -12.5t-17.5 -32.5q0 -21 19.5 -35.5t42.5 -20.5t42.5 -17t19.5 -26q0 -11 -7 -25q-64 -138 -198 -167q-22 -5 -22 -27q0 -47 138 -69q2 -5 6 -26t11 -30.5t23 -9.5q13 0 38.5 5t38.5 5q35 0 67.5 -15
+t54.5 -32.5t57.5 -32.5t76.5 -15q43 0 79 15t57.5 32.5t54 32.5t67.5 15q13 0 39 -4.5t39 -4.5q15 0 22.5 9.5t11.5 31t5 24.5q138 22 138 69zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960
+q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF2AE" unicode="&#xf2ae;" horiz-adv-x="2304" 
+d="M2304 1536q-69 -46 -125 -92t-89 -81t-59.5 -71.5t-37.5 -57.5t-22 -44.5t-14 -29.5q-10 -18 -35.5 -136.5t-48.5 -164.5q-15 -29 -50 -60.5t-67.5 -50.5t-72.5 -41t-48 -28q-47 -31 -151 -231q-341 14 -630 -158q-92 -53 -303 -179q47 16 86 31t55 22l15 7
+q71 27 163 64.5t133.5 53.5t108 34.5t142.5 31.5q186 31 465 -7q1 0 10 -3q11 -6 14 -17t-3 -22l-194 -345q-15 -29 -47 -22q-128 24 -354 24q-146 0 -402 -44.5t-392 -46.5q-82 -1 -149 13t-107 37t-61 40t-33 34l-1 1v2q0 6 6 6q138 0 371 55q192 366 374.5 524t383.5 158
+q5 0 14.5 -0.5t38 -5t55 -12t61.5 -24.5t63 -39.5t54 -59t40 -82.5l102 177q2 4 21 42.5t44.5 86.5t61 109.5t84 133.5t100.5 137q66 82 128 141.5t121.5 96.5t92.5 53.5t88 39.5z" />
+    <glyph glyph-name="uniF2B0" unicode="&#xf2b0;" 
+d="M1322 640q0 -45 -5 -76l-236 14l224 -78q-19 -73 -58 -141l-214 103l177 -158q-44 -61 -107 -108l-157 178l103 -215q-61 -37 -140 -59l-79 228l14 -240q-38 -6 -76 -6t-76 6l14 238l-78 -226q-74 19 -140 59l103 215l-157 -178q-59 43 -108 108l178 158l-214 -104
+q-39 69 -58 141l224 79l-237 -14q-5 42 -5 76q0 35 5 77l238 -14l-225 79q19 73 58 140l214 -104l-177 159q46 61 107 108l158 -178l-103 215q67 39 140 58l77 -224l-13 236q36 6 75 6q38 0 76 -6l-14 -237l78 225q74 -19 140 -59l-103 -214l158 178q61 -47 107 -108
+l-177 -159l213 104q37 -62 58 -141l-224 -78l237 14q5 -31 5 -77zM1352 640q0 160 -78.5 295.5t-213 214t-292.5 78.5q-119 0 -227 -46.5t-186.5 -125t-124.5 -187.5t-46 -229q0 -119 46 -228t124.5 -187.5t186.5 -125t227 -46.5q158 0 292.5 78.5t213 214t78.5 294.5z
+M1425 1023v-766l-657 -383l-657 383v766l657 383zM768 -183l708 412v823l-708 411l-708 -411v-823zM1536 1088v-896l-768 -448l-768 448v896l768 448z" />
+    <glyph glyph-name="uniF2B1" unicode="&#xf2b1;" horiz-adv-x="1664" 
+d="M339 1318h691l-26 -72h-665q-110 0 -188.5 -79t-78.5 -189v-771q0 -95 60.5 -169.5t153.5 -93.5q23 -5 98 -5v-72h-45q-140 0 -239.5 100t-99.5 240v771q0 140 99.5 240t239.5 100zM1190 1536h247l-482 -1294q-23 -61 -40.5 -103.5t-45 -98t-54 -93.5t-64.5 -78.5
+t-79.5 -65t-95.5 -41t-116 -18.5v195q163 26 220 182q20 52 20 105q0 54 -20 106l-285 733h228l187 -585zM1664 978v-1111h-795q37 55 45 73h678v1038q0 85 -49.5 155t-129.5 99l25 67q101 -34 163.5 -123.5t62.5 -197.5z" />
+    <glyph glyph-name="uniF2B2" unicode="&#xf2b2;" horiz-adv-x="1792" 
+d="M852 1227q0 -29 -17 -52.5t-45 -23.5t-45 23.5t-17 52.5t17 52.5t45 23.5t45 -23.5t17 -52.5zM688 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50 -21.5t-20 -51.5v-114q0 -30 20.5 -52t49.5 -22q30 0 50.5 22t20.5 52zM860 -149v114q0 30 -20 51.5t-50 21.5t-50.5 -21.5
+t-20.5 -51.5v-114q0 -30 20.5 -52t50.5 -22q29 0 49.5 22t20.5 52zM1034 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50.5 -21.5t-20.5 -51.5v-114q0 -30 20.5 -52t50.5 -22t50.5 22t20.5 52zM1208 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50.5 -21.5t-20.5 -51.5v-114
+q0 -30 20.5 -52t50.5 -22t50.5 22t20.5 52zM1476 535q-84 -160 -232 -259.5t-323 -99.5q-123 0 -229.5 51.5t-178.5 137t-113 197.5t-41 232q0 88 21 174q-104 -175 -104 -390q0 -162 65 -312t185 -251q30 57 91 57q56 0 86 -50q32 50 87 50q56 0 86 -50q32 50 87 50t87 -50
+q30 50 86 50q28 0 52.5 -15.5t37.5 -40.5q112 94 177 231.5t73 287.5zM1326 564q0 75 -72 75q-17 0 -47 -6q-95 -19 -149 -19q-226 0 -226 243q0 86 30 204q-83 -127 -83 -275q0 -150 89 -260.5t235 -110.5q111 0 210 70q13 48 13 79zM884 1223q0 50 -32 89.5t-81 39.5
+t-81 -39.5t-32 -89.5q0 -51 31.5 -90.5t81.5 -39.5t81.5 39.5t31.5 90.5zM1513 884q0 96 -37.5 179t-113 137t-173.5 54q-77 0 -149 -35t-127 -94q-48 -159 -48 -268q0 -104 45.5 -157t147.5 -53q53 0 142 19q36 6 53 6q51 0 77.5 -28t26.5 -80q0 -26 -4 -46
+q75 68 117.5 165.5t42.5 200.5zM1792 667q0 -111 -33.5 -249.5t-93.5 -204.5q-58 -64 -195 -142.5t-228 -104.5l-4 -1v-114q0 -43 -29.5 -75t-72.5 -32q-56 0 -86 50q-32 -50 -87 -50t-87 50q-30 -50 -86 -50q-55 0 -87 50q-30 -50 -86 -50q-47 0 -75 33.5t-28 81.5
+q-90 -68 -198 -68q-118 0 -211 80q54 1 106 20q-113 31 -182 127q32 -7 71 -7q89 0 164 46q-192 192 -240 306q-24 56 -24 160q0 57 9 125.5t31.5 146.5t55 141t86.5 105t120 42q59 0 81 -52q19 29 42 54q2 3 12 13t13 16q10 15 23 38t25 42t28 39q87 111 211.5 177
+t260.5 66q35 0 62 -4q59 64 146 64q83 0 140 -57q5 -5 5 -12q0 -5 -6 -13.5t-12.5 -16t-16 -17l-10.5 -10.5q17 -6 36 -18t19 -24q0 -6 -16 -25q157 -138 197 -378q25 30 60 30q45 0 100 -49q90 -80 90 -279z" />
+    <glyph glyph-name="uniF2B3" unicode="&#xf2b3;" 
+d="M917 631q0 33 -6 64h-362v-132h217q-12 -76 -74.5 -120.5t-142.5 -44.5q-99 0 -169 71.5t-70 170.5t70 170.5t169 71.5q93 0 153 -59l104 101q-108 100 -257 100q-160 0 -272 -112.5t-112 -271.5t112 -271.5t272 -112.5q165 0 266.5 105t101.5 270zM1262 585h109v110
+h-109v110h-110v-110h-110v-110h110v-110h110v110zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="uniF2B4" unicode="&#xf2b4;" 
+d="M1536 1024v-839q0 -48 -49 -62q-174 -52 -338 -52q-73 0 -215.5 29.5t-227.5 29.5q-164 0 -370 -48v-338h-160v1368q-63 25 -101 81t-38 124q0 91 64 155t155 64t155 -64t64 -155q0 -68 -38 -124t-101 -81v-68q190 44 343 44q99 0 198 -15q14 -2 111.5 -22.5t149.5 -20.5
+q77 0 165 18q11 2 80 21t89 19q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="uniF2B5" unicode="&#xf2b5;" horiz-adv-x="2304" 
+d="M192 384q40 0 56 32t0 64t-56 32t-56 -32t0 -64t56 -32zM1665 442q-10 13 -38.5 50t-41.5 54t-38 49t-42.5 53t-40.5 47t-45 49l-125 -140q-83 -94 -208.5 -92t-205.5 98q-57 69 -56.5 158t58.5 157l177 206q-22 11 -51 16.5t-47.5 6t-56.5 -0.5t-49 -1q-92 0 -158 -66
+l-158 -158h-155v-544q5 0 21 0.5t22 0t19.5 -2t20.5 -4.5t17.5 -8.5t18.5 -13.5l297 -292q115 -111 227 -111q78 0 125 47q57 -20 112.5 8t72.5 85q74 -6 127 44q20 18 36 45.5t14 50.5q10 -10 43 -10q43 0 77 21t49.5 53t12 71.5t-30.5 73.5zM1824 384h96v512h-93l-157 180
+q-66 76 -169 76h-167q-89 0 -146 -67l-209 -243q-28 -33 -28 -75t27 -75q43 -51 110 -52t111 49l193 218q25 23 53.5 21.5t47 -27t8.5 -56.5q16 -19 56 -63t60 -68q29 -36 82.5 -105.5t64.5 -84.5q52 -66 60 -140zM2112 384q40 0 56 32t0 64t-56 32t-56 -32t0 -64t56 -32z
+M2304 960v-640q0 -26 -19 -45t-45 -19h-434q-27 -65 -82 -106.5t-125 -51.5q-33 -48 -80.5 -81.5t-102.5 -45.5q-42 -53 -104.5 -81.5t-128.5 -24.5q-60 -34 -126 -39.5t-127.5 14t-117 53.5t-103.5 81l-287 282h-358q-26 0 -45 19t-19 45v672q0 26 19 45t45 19h421
+q14 14 47 48t47.5 48t44 40t50.5 37.5t51 25.5t62 19.5t68 5.5h117q99 0 181 -56q82 56 181 56h167q35 0 67 -6t56.5 -14.5t51.5 -26.5t44.5 -31t43 -39.5t39 -42t41 -48t41.5 -48.5h355q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="uniF2B6" unicode="&#xf2b6;" horiz-adv-x="1792" 
+d="M1792 882v-978q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v978q0 15 11 24q8 7 39 34.5t41.5 36t45.5 37.5t70 55.5t96 73t143.5 107t192.5 140.5q5 4 52.5 40t71.5 52.5t64 35t69 18.5t69 -18.5t65 -35.5t71 -52t52 -40q110 -80 192.5 -140.5t143.5 -107
+t96 -73t70 -55.5t45.5 -37.5t41.5 -36t39 -34.5q11 -9 11 -24zM1228 297q263 191 345 252q11 8 12.5 20.5t-6.5 23.5l-38 52q-8 11 -21 12.5t-24 -6.5q-231 -169 -343 -250q-5 -3 -52 -39t-71.5 -52.5t-64.5 -35t-69 -18.5t-69 18.5t-64.5 35t-71.5 52.5t-52 39
+q-186 134 -343 250q-11 8 -24 6.5t-21 -12.5l-38 -52q-8 -11 -6.5 -23.5t12.5 -20.5q82 -61 345 -252q10 -8 50 -38t65 -47t64 -39.5t77.5 -33.5t75.5 -11t75.5 11t79 34.5t64.5 39.5t65 47.5t48 36.5z" />
+    <glyph glyph-name="uniF2B7" unicode="&#xf2b7;" horiz-adv-x="1792" 
+d="M1474 623l39 -51q8 -11 6.5 -23.5t-11.5 -20.5q-43 -34 -126.5 -98.5t-146.5 -113t-67 -51.5q-39 -32 -60 -48t-60.5 -41t-76.5 -36.5t-74 -11.5h-1h-1q-37 0 -74 11.5t-76 36.5t-61 41.5t-60 47.5q-5 4 -65 50.5t-143.5 111t-122.5 94.5q-11 8 -12.5 20.5t6.5 23.5
+l37 52q8 11 21.5 13t24.5 -7q94 -73 306 -236q5 -4 43.5 -35t60.5 -46.5t56.5 -32.5t58.5 -17h1h1q24 0 58.5 17t56.5 32.5t60.5 46.5t43.5 35q258 198 313 242q11 8 24 6.5t21 -12.5zM1664 -96v928q-90 83 -159 139q-91 74 -389 304q-3 2 -43 35t-61 48t-56 32.5t-59 17.5
+h-1h-1q-24 0 -59 -17.5t-56 -32.5t-61 -48t-43 -35q-215 -166 -315.5 -245.5t-129.5 -104t-82 -74.5q-14 -12 -21 -19v-928q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1792 832v-928q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v928q0 56 41 94
+q123 114 350 290.5t233 181.5q36 30 59 47.5t61.5 42t76 36.5t74.5 12h1h1q37 0 74.5 -12t76 -36.5t61.5 -42t59 -47.5q43 -36 156 -122t226 -177t201 -173q41 -38 41 -94z" />
+    <glyph glyph-name="uniF2B8" unicode="&#xf2b8;" 
+d="M330 1l202 -214l-34 236l-216 213zM556 -225l274 218l-11 245l-300 -215zM245 413l227 -213l-48 327l-245 204zM495 189l317 214l-14 324l-352 -200zM843 178l95 -80l-2 239l-103 79q0 -1 1 -8.5t0 -12t-5 -7.5l-78 -52l85 -70q7 -6 7 -88zM138 930l256 -200l-68 465
+l-279 173zM1173 267l15 234l-230 -164l2 -240zM417 722l373 194l-19 441l-423 -163zM1270 357l20 233l-226 142l-2 -105l144 -95q6 -4 4 -9l-7 -119zM1461 496l30 222l-179 -128l-20 -228zM1273 329l-71 49l-8 -117q0 -5 -4 -8l-234 -187q-7 -5 -14 0l-98 83l7 -161
+q0 -5 -4 -8l-293 -234q-4 -2 -6 -2q-8 2 -8 3l-228 242q-4 4 -59 277q-2 7 5 11l61 37q-94 86 -95 92l-72 351q-2 7 6 12l94 45q-133 100 -135 108l-96 466q-2 10 7 13l433 135q5 0 8 -1l317 -153q6 -4 6 -9l20 -463q0 -7 -6 -10l-118 -61l126 -85q5 -2 5 -8l5 -123l121 74
+q5 4 11 0l84 -56l3 110q0 6 5 9l206 126q6 3 11 0l245 -135q4 -4 5 -7t-6.5 -60t-17.5 -124.5t-10 -70.5q0 -5 -4 -7l-191 -153q-6 -5 -13 0z" />
+    <glyph glyph-name="uniF2B9" unicode="&#xf2b9;" horiz-adv-x="1664" 
+d="M1201 298q0 57 -5.5 107t-21 100.5t-39.5 86t-64 58t-91 22.5q-6 -4 -33.5 -20.5t-42.5 -24.5t-40.5 -20t-49 -17t-46.5 -5t-46.5 5t-49 17t-40.5 20t-42.5 24.5t-33.5 20.5q-51 0 -91 -22.5t-64 -58t-39.5 -86t-21 -100.5t-5.5 -107q0 -73 42 -121.5t103 -48.5h576
+q61 0 103 48.5t42 121.5zM1028 892q0 108 -76.5 184t-183.5 76t-183.5 -76t-76.5 -184q0 -107 76.5 -183t183.5 -76t183.5 76t76.5 183zM1664 352v-192q0 -14 -9 -23t-23 -9h-96v-224q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h1216
+q66 0 113 -47t47 -113v-224h96q14 0 23 -9t9 -23v-192q0 -14 -9 -23t-23 -9h-96v-128h96q14 0 23 -9t9 -23v-192q0 -14 -9 -23t-23 -9h-96v-128h96q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="uniF2BA" unicode="&#xf2ba;" horiz-adv-x="1664" 
+d="M1028 892q0 -107 -76.5 -183t-183.5 -76t-183.5 76t-76.5 183q0 108 76.5 184t183.5 76t183.5 -76t76.5 -184zM980 672q46 0 82.5 -17t60 -47.5t39.5 -67t24 -81t11.5 -82.5t3.5 -79q0 -67 -39.5 -118.5t-105.5 -51.5h-576q-66 0 -105.5 51.5t-39.5 118.5q0 48 4.5 93.5
+t18.5 98.5t36.5 91.5t63 64.5t93.5 26h5q7 -4 32 -19.5t35.5 -21t33 -17t37 -16t35 -9t39.5 -4.5t39.5 4.5t35 9t37 16t33 17t35.5 21t32 19.5zM1664 928q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-128h96q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-128h96
+q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-224q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h1216q66 0 113 -47t47 -113v-224h96q13 0 22.5 -9.5t9.5 -22.5v-192zM1408 -96v1472q0 13 -9.5 22.5t-22.5 9.5h-1216
+q-13 0 -22.5 -9.5t-9.5 -22.5v-1472q0 -13 9.5 -22.5t22.5 -9.5h1216q13 0 22.5 9.5t9.5 22.5z" />
+    <glyph glyph-name="uniF2BB" unicode="&#xf2bb;" horiz-adv-x="2048" 
+d="M1024 405q0 64 -9 117.5t-29.5 103t-60.5 78t-97 28.5q-6 -4 -30 -18t-37.5 -21.5t-35.5 -17.5t-43 -14.5t-42 -4.5t-42 4.5t-43 14.5t-35.5 17.5t-37.5 21.5t-30 18q-57 0 -97 -28.5t-60.5 -78t-29.5 -103t-9 -117.5t37 -106.5t91 -42.5h512q54 0 91 42.5t37 106.5z
+M867 925q0 94 -66.5 160.5t-160.5 66.5t-160.5 -66.5t-66.5 -160.5t66.5 -160.5t160.5 -66.5t160.5 66.5t66.5 160.5zM1792 416v64q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM1792 676v56q0 15 -10.5 25.5t-25.5 10.5h-568
+q-15 0 -25.5 -10.5t-10.5 -25.5v-56q0 -15 10.5 -25.5t25.5 -10.5h568q15 0 25.5 10.5t10.5 25.5zM1792 928v64q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-352v96q0 14 -9 23t-23 9
+h-64q-14 0 -23 -9t-9 -23v-96h-768v96q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-96h-352q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2BC" unicode="&#xf2bc;" horiz-adv-x="2048" 
+d="M1024 405q0 -64 -37 -106.5t-91 -42.5h-512q-54 0 -91 42.5t-37 106.5t9 117.5t29.5 103t60.5 78t97 28.5q6 -4 30 -18t37.5 -21.5t35.5 -17.5t43 -14.5t42 -4.5t42 4.5t43 14.5t35.5 17.5t37.5 21.5t30 18q57 0 97 -28.5t60.5 -78t29.5 -103t9 -117.5zM867 925
+q0 -94 -66.5 -160.5t-160.5 -66.5t-160.5 66.5t-66.5 160.5t66.5 160.5t160.5 66.5t160.5 -66.5t66.5 -160.5zM1792 480v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM1792 732v-56q0 -15 -10.5 -25.5t-25.5 -10.5h-568
+q-15 0 -25.5 10.5t-10.5 25.5v56q0 15 10.5 25.5t25.5 10.5h568q15 0 25.5 -10.5t10.5 -25.5zM1792 992v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM1920 32v1216q0 13 -9.5 22.5t-22.5 9.5h-1728q-13 0 -22.5 -9.5
+t-9.5 -22.5v-1216q0 -13 9.5 -22.5t22.5 -9.5h352v96q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-96h768v96q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-96h352q13 0 22.5 9.5t9.5 22.5zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-1728q-66 0 -113 47t-47 113v1216q0 66 47 113
+t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2BD" unicode="&#xf2bd;" horiz-adv-x="1792" 
+d="M1523 197q-22 155 -87.5 257.5t-184.5 118.5q-67 -74 -159.5 -115.5t-195.5 -41.5t-195.5 41.5t-159.5 115.5q-119 -16 -184.5 -118.5t-87.5 -257.5q106 -150 271 -237.5t356 -87.5t356 87.5t271 237.5zM1280 896q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5
+t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM1792 640q0 -182 -71 -347.5t-190.5 -286t-285.5 -191.5t-349 -71q-182 0 -348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2BE" unicode="&#xf2be;" horiz-adv-x="1792" 
+d="M896 1536q182 0 348 -71t286 -191t191 -286t71 -348q0 -181 -70.5 -347t-190.5 -286t-286 -191.5t-349 -71.5t-349 71t-285.5 191.5t-190.5 286t-71 347.5t71 348t191 286t286 191t348 71zM1515 185q149 205 149 455q0 156 -61 298t-164 245t-245 164t-298 61t-298 -61
+t-245 -164t-164 -245t-61 -298q0 -250 149 -455q66 327 306 327q131 -128 313 -128t313 128q240 0 306 -327zM1280 832q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5z" />
+    <glyph glyph-name="uniF2C0" unicode="&#xf2c0;" 
+d="M1201 752q47 -14 89.5 -38t89 -73t79.5 -115.5t55 -172t22 -236.5q0 -154 -100 -263.5t-241 -109.5h-854q-141 0 -241 109.5t-100 263.5q0 131 22 236.5t55 172t79.5 115.5t89 73t89.5 38q-79 125 -79 272q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5
+t198.5 -40.5t163.5 -109.5t109.5 -163.5t40.5 -198.5q0 -147 -79 -272zM768 1408q-159 0 -271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5t-112.5 271.5t-271.5 112.5zM1195 -128q88 0 150.5 71.5t62.5 173.5q0 239 -78.5 377t-225.5 145
+q-145 -127 -336 -127t-336 127q-147 -7 -225.5 -145t-78.5 -377q0 -102 62.5 -173.5t150.5 -71.5h854z" />
+    <glyph glyph-name="uniF2C1" unicode="&#xf2c1;" horiz-adv-x="1280" 
+d="M1024 278q0 -64 -37 -107t-91 -43h-512q-54 0 -91 43t-37 107t9 118t29.5 104t61 78.5t96.5 28.5q80 -75 188 -75t188 75q56 0 96.5 -28.5t61 -78.5t29.5 -104t9 -118zM870 797q0 -94 -67.5 -160.5t-162.5 -66.5t-162.5 66.5t-67.5 160.5t67.5 160.5t162.5 66.5
+t162.5 -66.5t67.5 -160.5zM1152 -96v1376h-1024v-1376q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1280 1376v-1472q0 -66 -47 -113t-113 -47h-960q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h352v-96q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v96h352
+q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C2" unicode="&#xf2c2;" horiz-adv-x="2048" 
+d="M896 324q0 54 -7.5 100.5t-24.5 90t-51 68.5t-81 25q-64 -64 -156 -64t-156 64q-47 0 -81 -25t-51 -68.5t-24.5 -90t-7.5 -100.5q0 -55 31.5 -93.5t75.5 -38.5h426q44 0 75.5 38.5t31.5 93.5zM768 768q0 80 -56 136t-136 56t-136 -56t-56 -136t56 -136t136 -56t136 56
+t56 136zM1792 288v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM1408 544v64q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1792 544v64q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23
+v-64q0 -14 9 -23t23 -9h192q14 0 23 9t9 23zM1792 800v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM128 1152h1792v96q0 14 -9 23t-23 9h-1728q-14 0 -23 -9t-9 -23v-96zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-1728
+q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C3" unicode="&#xf2c3;" horiz-adv-x="2048" 
+d="M896 324q0 -55 -31.5 -93.5t-75.5 -38.5h-426q-44 0 -75.5 38.5t-31.5 93.5q0 54 7.5 100.5t24.5 90t51 68.5t81 25q64 -64 156 -64t156 64q47 0 81 -25t51 -68.5t24.5 -90t7.5 -100.5zM768 768q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136z
+M1792 352v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704q14 0 23 -9t9 -23zM1408 608v-64q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h320q14 0 23 -9t9 -23zM1792 608v-64q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v64
+q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 864v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704q14 0 23 -9t9 -23zM1920 32v1120h-1792v-1120q0 -13 9.5 -22.5t22.5 -9.5h1728q13 0 22.5 9.5t9.5 22.5zM2048 1248v-1216q0 -66 -47 -113t-113 -47
+h-1728q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C4" unicode="&#xf2c4;" horiz-adv-x="1792" 
+d="M1255 749q0 318 -105 474.5t-330 156.5q-222 0 -326 -157t-104 -474q0 -316 104 -471.5t326 -155.5q74 0 131 17q-22 43 -39 73t-44 65t-53.5 56.5t-63 36t-77.5 14.5q-46 0 -79 -16l-49 97q105 91 276 91q132 0 215.5 -54t150.5 -155q67 149 67 402zM1645 117h117
+q3 -27 -2 -67t-26.5 -95t-58 -100.5t-107 -78t-162.5 -32.5q-71 0 -130.5 19t-105.5 56t-79 78t-66 96q-97 -27 -205 -27q-150 0 -292.5 58t-253 158.5t-178 249t-67.5 317.5q0 170 67.5 319.5t178.5 250.5t253.5 159t291.5 58q121 0 238.5 -36t217 -106t176 -164.5
+t119.5 -219t43 -261.5q0 -190 -80.5 -347.5t-218.5 -264.5q47 -70 93.5 -106.5t104.5 -36.5q61 0 94 37.5t38 85.5z" />
+    <glyph glyph-name="uniF2C5" unicode="&#xf2c5;" horiz-adv-x="2304" 
+d="M453 -101q0 -21 -16 -37.5t-37 -16.5q-1 0 -13 3q-63 15 -162 140q-225 284 -225 676q0 341 213 614q39 51 95 103.5t94 52.5q19 0 35 -13.5t16 -32.5q0 -27 -63 -90q-98 -102 -147 -184q-119 -199 -119 -449q0 -281 123 -491q50 -85 136 -173q2 -3 14.5 -16t19.5 -21
+t17 -20.5t14.5 -23.5t4.5 -21zM1796 33q0 -29 -17.5 -48.5t-46.5 -19.5h-1081q-26 0 -45 19t-19 45q0 29 17.5 48.5t46.5 19.5h1081q26 0 45 -19t19 -45zM1581 644q0 -134 -67 -233q-25 -38 -69.5 -78.5t-83.5 -60.5q-16 -10 -27 -10q-7 0 -15 6t-8 12q0 9 19 30t42 46
+t42 67.5t19 88.5q0 76 -35 130q-29 42 -46 42q-3 0 -3 -5q0 -12 7.5 -35.5t7.5 -36.5q0 -22 -21.5 -35t-44.5 -13q-66 0 -66 76q0 15 1.5 44t1.5 44q0 25 -10 46q-13 25 -42 53.5t-51 28.5q-5 0 -7 -0.5t-3.5 -2.5t-1.5 -6q0 -2 16 -26t16 -54q0 -37 -19 -68t-46 -54
+t-53.5 -46t-45.5 -54t-19 -68q0 -98 42 -160q29 -43 79 -63q16 -5 17 -10q1 -2 1 -5q0 -16 -18 -16q-6 0 -33 11q-119 43 -195 139.5t-76 218.5q0 55 24.5 115.5t60 115t70.5 108.5t59.5 113.5t24.5 111.5q0 53 -25 94q-29 48 -56 64q-19 9 -19 21q0 20 41 20q50 0 110 -29
+q41 -19 71 -44.5t49.5 -51t33.5 -62.5t22 -69t16 -80q0 -1 3 -17.5t4.5 -25t5.5 -25t9 -27t11 -21.5t14.5 -16.5t18.5 -5.5q23 0 37 14t14 37q0 25 -20 67t-20 52t10 10q27 0 93 -70q72 -76 102.5 -156t30.5 -186zM2304 615q0 -274 -138 -503q-19 -32 -48 -72t-68 -86.5
+t-81 -77t-74 -30.5q-16 0 -31 15.5t-15 31.5q0 15 29 50.5t68.5 77t48.5 52.5q183 230 183 531q0 131 -20.5 235t-72.5 211q-58 119 -163 228q-2 3 -13 13.5t-16.5 16.5t-15 17.5t-15 20t-9.5 18.5t-4 19q0 19 16 35.5t35 16.5q70 0 196 -169q98 -131 146 -273t60 -314
+q2 -42 2 -64z" />
+    <glyph glyph-name="uniF2C6" unicode="&#xf2c6;" horiz-adv-x="1792" 
+d="M1189 229l147 693q9 44 -10.5 63t-51.5 7l-864 -333q-29 -11 -39.5 -25t-2.5 -26.5t32 -19.5l221 -69l513 323q21 14 32 6q7 -5 -4 -15l-415 -375v0v0l-16 -228q23 0 45 22l108 104l224 -165q64 -36 81 38zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71
+t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2C7" unicode="&#xf2c7;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v907h128v-907q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2C8" unicode="&#xf2c8;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v651h128v-651q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2C9" unicode="&#xf2c9;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v395h128v-395q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2CA" unicode="&#xf2ca;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v139h128v-139q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2CB" unicode="&#xf2cb;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 79 56 135.5t136 56.5t136 -56.5t56 -135.5zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5t93.5 226.5z
+M896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192v128h192z" />
+    <glyph glyph-name="uniF2CC" unicode="&#xf2cc;" horiz-adv-x="1920" 
+d="M1433 1287q10 -10 10 -23t-10 -23l-626 -626q-10 -10 -23 -10t-23 10l-82 82q-10 10 -10 23t10 23l44 44q-72 91 -81.5 207t46.5 215q-74 71 -176 71q-106 0 -181 -75t-75 -181v-1280h-256v1280q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5q106 0 201 -41
+t166 -115q94 39 197 24.5t185 -79.5l44 44q10 10 23 10t23 -10zM1344 1024q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1600 896q-26 0 -45 19t-19 45t19 45t45 19t45 -19t19 -45t-19 -45t-45 -19zM1856 1024q26 0 45 -19t19 -45t-19 -45t-45 -19
+t-45 19t-19 45t19 45t45 19zM1216 896q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1408 832q0 26 19 45t45 19t45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45zM1728 896q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 768
+q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1344 640q-26 0 -45 19t-19 45t19 45t45 19t45 -19t19 -45t-19 -45t-45 -19zM1600 768q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1216 512q-26 0 -45 19t-19 45t19 45t45 19t45 -19
+t19 -45t-19 -45t-45 -19zM1472 640q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 512q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1344 512q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1216 384
+q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 256q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19z" />
+    <glyph glyph-name="uniF2CD" unicode="&#xf2cd;" horiz-adv-x="1792" 
+d="M1664 448v-192q0 -169 -128 -286v-194q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v118q-63 -22 -128 -22h-768q-65 0 -128 22v-110q0 -17 -9.5 -28.5t-22.5 -11.5h-64q-13 0 -22.5 11.5t-9.5 28.5v186q-128 117 -128 286v192h1536zM704 864q0 -14 -9 -23t-23 -9t-23 9
+t-9 23t9 23t23 9t23 -9t9 -23zM768 928q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM704 992q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 992q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM768 1056q0 -14 -9 -23t-23 -9t-23 9
+t-9 23t9 23t23 9t23 -9t9 -23zM704 1120q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1792 608v-64q0 -14 -9 -23t-23 -9h-1728q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v640q0 106 75 181t181 75q108 0 184 -78q46 19 98 12t93 -39l22 22q11 11 22 0l42 -42
+q11 -11 0 -22l-314 -314q-11 -11 -22 0l-42 42q-11 11 0 22l22 22q-36 46 -40.5 104t23.5 108q-37 35 -88 35q-53 0 -90.5 -37.5t-37.5 -90.5v-640h1504q14 0 23 -9t9 -23zM896 1056q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 1120q0 -14 -9 -23t-23 -9
+t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM768 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM960 1120q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM896 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 1248q0 -14 -9 -23
+t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1024 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM960 1248q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1088 1248q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23z" />
+    <glyph glyph-name="uniF2CE" unicode="&#xf2ce;" 
+d="M994 344q0 -86 -17 -197q-31 -215 -55 -313q-22 -90 -152 -90t-152 90q-24 98 -55 313q-17 110 -17 197q0 168 224 168t224 -168zM1536 768q0 -240 -134 -434t-350 -280q-8 -3 -15 3t-6 15q7 48 10 66q4 32 6 47q1 9 9 12q159 81 255.5 234t96.5 337q0 180 -91 330.5
+t-247 234.5t-337 74q-124 -7 -237 -61t-193.5 -140.5t-128 -202t-46.5 -240.5q1 -184 99 -336.5t257 -231.5q7 -3 9 -12q3 -21 6 -45q1 -9 5 -32.5t6 -35.5q1 -9 -6.5 -15t-15.5 -2q-148 58 -261 169.5t-173.5 264t-52.5 319.5q7 143 66 273.5t154.5 227t225 157.5t272.5 70
+q164 10 315.5 -46.5t261 -160.5t175 -250.5t65.5 -308.5zM994 800q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5zM1282 768q0 -122 -53.5 -228.5t-146.5 -177.5q-8 -6 -16 -2t-10 14q-6 52 -29 92q-7 10 3 20
+q58 54 91 127t33 155q0 111 -58.5 204t-157.5 141.5t-212 36.5q-133 -15 -229 -113t-109 -231q-10 -92 23.5 -176t98.5 -144q10 -10 3 -20q-24 -41 -29 -93q-2 -9 -10 -13t-16 2q-95 74 -148.5 183t-51.5 234q3 131 69 244t177 181.5t241 74.5q144 7 268 -60t196.5 -187.5
+t72.5 -263.5z" />
+    <glyph glyph-name="uniF2D0" unicode="&#xf2d0;" horiz-adv-x="1792" 
+d="M256 128h1280v768h-1280v-768zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D1" unicode="&#xf2d1;" horiz-adv-x="1792" 
+d="M1792 224v-192q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v192q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D2" unicode="&#xf2d2;" horiz-adv-x="2048" 
+d="M256 0h768v512h-768v-512zM1280 512h512v768h-768v-256h96q66 0 113 -47t47 -113v-352zM2048 1376v-960q0 -66 -47 -113t-113 -47h-608v-352q0 -66 -47 -113t-113 -47h-960q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h608v352q0 66 47 113t113 47h960q66 0 113 -47
+t47 -113z" />
+    <glyph glyph-name="uniF2D3" unicode="&#xf2d3;" horiz-adv-x="1792" 
+d="M1175 215l146 146q10 10 10 23t-10 23l-233 233l233 233q10 10 10 23t-10 23l-146 146q-10 10 -23 10t-23 -10l-233 -233l-233 233q-10 10 -23 10t-23 -10l-146 -146q-10 -10 -10 -23t10 -23l233 -233l-233 -233q-10 -10 -10 -23t10 -23l146 -146q10 -10 23 -10t23 10
+l233 233l233 -233q10 -10 23 -10t23 10zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D4" unicode="&#xf2d4;" horiz-adv-x="1792" 
+d="M1257 425l-146 -146q-10 -10 -23 -10t-23 10l-169 169l-169 -169q-10 -10 -23 -10t-23 10l-146 146q-10 10 -10 23t10 23l169 169l-169 169q-10 10 -10 23t10 23l146 146q10 10 23 10t23 -10l169 -169l169 169q10 10 23 10t23 -10l146 -146q10 -10 10 -23t-10 -23
+l-169 -169l169 -169q10 -10 10 -23t-10 -23zM256 128h1280v1024h-1280v-1024zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D5" unicode="&#xf2d5;" horiz-adv-x="1792" 
+d="M1070 358l306 564h-654l-306 -564h654zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2D6" unicode="&#xf2d6;" horiz-adv-x="1794" 
+d="M1291 1060q-15 17 -35 8.5t-26 -28.5t5 -38q14 -17 40 -14.5t34 20.5t-18 52zM895 814q-8 -8 -19.5 -8t-18.5 8q-8 8 -8 19t8 18q7 8 18.5 8t19.5 -8q7 -7 7 -18t-7 -19zM1060 740l-35 -35q-12 -13 -29.5 -13t-30.5 13l-38 38q-12 13 -12 30t12 30l35 35q12 12 29.5 12
+t30.5 -12l38 -39q12 -12 12 -29.5t-12 -29.5zM951 870q-7 -8 -18.5 -8t-19.5 8q-7 8 -7 19t7 19q8 8 19 8t19 -8t8 -19t-8 -19zM1354 968q-34 -64 -107.5 -85.5t-127.5 16.5q-38 28 -61 66.5t-21 87.5t39 92t75.5 53t70.5 -5t70 -51q2 -2 13 -12.5t14.5 -13.5t13 -13.5
+t12.5 -15.5t10 -15.5t8.5 -18t4 -18.5t1 -21t-5 -22t-9.5 -24zM1555 486q3 20 -8.5 34.5t-27.5 21.5t-33 17t-23 20q-40 71 -84 98.5t-113 11.5q19 13 40 18.5t33 4.5l12 -1q2 45 -34 90q6 20 6.5 40.5t-2.5 30.5l-3 10q43 24 71 65t34 91q10 84 -43 150.5t-137 76.5
+q-60 7 -114 -18.5t-82 -74.5q-30 -51 -33.5 -101t14.5 -87t43.5 -64t56.5 -42q-45 4 -88 36t-57 88q-28 108 32 222q-16 21 -29 32q-50 0 -89 -19q19 24 42 37t36 14l13 1q0 50 -13 78q-10 21 -32.5 28.5t-47 -3.5t-37.5 -40q2 4 4 7q-7 -28 -6.5 -75.5t19 -117t48.5 -122.5
+q-25 -14 -47 -36q-35 -16 -85.5 -70.5t-84.5 -101.5l-33 -46q-90 -34 -181 -125.5t-75 -162.5q1 -16 11 -27q-15 -12 -30 -30q-21 -25 -21 -54t21.5 -40t63.5 6q41 19 77 49.5t55 60.5q-2 2 -6.5 5t-20.5 7.5t-33 3.5q23 5 51 12.5t40 10t27.5 6t26 4t23.5 0.5q14 -7 22 34
+q7 37 7 90q0 102 -40 150q106 -103 101 -219q-1 -29 -15 -50t-27 -27l-13 -6q-4 -7 -19 -32t-26 -45.5t-26.5 -52t-25 -61t-17 -63t-6.5 -66.5t10 -63q-35 54 -37 80q-22 -24 -34.5 -39t-33.5 -42t-30.5 -46t-16.5 -41t-0.5 -38t25.5 -27q45 -25 144 64t190.5 221.5
+t122.5 228.5q86 52 145 115.5t86 119.5q47 -93 154 -178q104 -83 167 -80q39 2 46 43zM1794 640q0 -182 -71 -348t-191 -286t-286.5 -191t-348.5 -71t-348.5 71t-286.5 191t-191 286t-71 348t71 348t191 286t286.5 191t348.5 71t348.5 -71t286.5 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2D7" unicode="&#xf2d7;" 
+d="M518 1353v-655q103 -1 191.5 1.5t125.5 5.5l37 3q68 2 90.5 24.5t39.5 94.5l33 142h103l-14 -322l7 -319h-103l-29 127q-15 68 -45 93t-84 26q-87 8 -352 8v-556q0 -78 43.5 -115.5t133.5 -37.5h357q35 0 59.5 2t55 7.5t54 18t48.5 32t46 50.5t39 73l93 216h89
+q-6 -37 -31.5 -252t-30.5 -276q-146 5 -263.5 8t-162.5 4h-44h-628l-376 -12v102l127 25q67 13 91.5 37t25.5 79l8 643q3 402 -8 645q-2 61 -25.5 84t-91.5 36l-127 24v102l376 -12h702q139 0 374 27q-6 -68 -14 -194.5t-12 -219.5l-5 -92h-93l-32 124q-31 121 -74 179.5
+t-113 58.5h-548q-28 0 -35.5 -8.5t-7.5 -30.5z" />
+    <glyph glyph-name="uniF2D8" unicode="&#xf2d8;" 
+d="M922 739v-182q0 -4 0.5 -15t0 -15l-1.5 -12t-3.5 -11.5t-6.5 -7.5t-11 -5.5t-16 -1.5v309q9 0 16 -1t11 -5t6.5 -5.5t3.5 -9.5t1 -10.5v-13.5v-14zM1238 643v-121q0 -1 0.5 -12.5t0 -15.5t-2.5 -11.5t-7.5 -10.5t-13.5 -3q-9 0 -14 9q-4 10 -4 165v7v8.5v9t1.5 8.5l3.5 7
+t5 5.5t8 1.5q6 0 10 -1.5t6.5 -4.5t4 -6t2 -8.5t0.5 -8v-9.5v-9zM180 407h122v472h-122v-472zM614 407h106v472h-159l-28 -221q-20 148 -32 221h-158v-472h107v312l45 -312h76l43 319v-319zM1039 712q0 67 -5 90q-3 16 -11 28.5t-17 20.5t-25 14t-26.5 8.5t-31 4t-29 1.5
+h-29.5h-12h-91v-472h56q169 -1 197 24.5t25 180.5q-1 62 -1 100zM1356 515v133q0 29 -2 45t-9.5 33.5t-24.5 25t-46 7.5q-46 0 -77 -34v154h-117v-472h110l7 30q30 -36 77 -36q50 0 66 30.5t16 83.5zM1536 1248v-1216q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113
+v1216q0 66 47 113t113 47h1216q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D9" unicode="&#xf2d9;" horiz-adv-x="2176" 
+d="M1143 -197q-6 1 -11 4q-13 8 -36 23t-86 65t-116.5 104.5t-112 140t-89.5 172.5q-17 3 -175 37q66 -213 235 -362t391 -184zM502 409l168 -28q-25 76 -41 167.5t-19 145.5l-4 53q-84 -82 -121 -224q5 -65 17 -114zM612 1018q-43 -64 -77 -148q44 46 74 68zM2049 584
+q0 161 -62 307t-167.5 252t-250.5 168.5t-304 62.5q-147 0 -281 -52.5t-240 -148.5q-30 -58 -45 -160q60 51 143 83.5t158.5 43t143 13.5t108.5 -1l40 -3q33 -1 53 -15.5t24.5 -33t6.5 -37t-1 -28.5q-126 11 -227.5 0.5t-183 -43.5t-142.5 -71.5t-131 -98.5
+q4 -36 11.5 -92.5t35.5 -178t62 -179.5q123 -6 247.5 14.5t214.5 53.5t162.5 67t109.5 59l37 24q22 16 39.5 20.5t30.5 -5t17 -34.5q14 -97 -39 -121q-208 -97 -467 -134q-135 -20 -317 -16q41 -96 110 -176.5t137 -127t130.5 -79t101.5 -43.5l39 -12q143 -23 263 15
+q195 99 314 289t119 418zM2123 621q-14 -135 -40 -212q-70 -208 -181.5 -346.5t-318.5 -253.5q-48 -33 -82 -44q-72 -26 -163 -16q-36 -3 -73 -3q-283 0 -504.5 173t-295.5 442q-1 0 -4 0.5t-5 0.5q-6 -50 2.5 -112.5t26 -115t36 -98t31.5 -71.5l14 -26q8 -12 54 -82
+q-71 38 -124.5 106.5t-78.5 140t-39.5 137t-17.5 107.5l-2 42q-5 2 -33.5 12.5t-48.5 18t-53 20.5t-57.5 25t-50 25.5t-42.5 27t-25 25.5q19 -10 50.5 -25.5t113 -45.5t145.5 -38l2 32q11 149 94 290q41 202 176 365q28 115 81 214q15 28 32 45t49 32q158 74 303.5 104
+t302 11t306.5 -97q220 -115 333 -336t87 -474z" />
+    <glyph glyph-name="uniF2DA" unicode="&#xf2da;" horiz-adv-x="1792" 
+d="M1341 752q29 44 -6.5 129.5t-121.5 142.5q-58 39 -125.5 53.5t-118 4.5t-68.5 -37q-12 -23 -4.5 -28t42.5 -10q23 -3 38.5 -5t44.5 -9.5t56 -17.5q36 -13 67.5 -31.5t53 -37t40 -38.5t30.5 -38t22 -34.5t16.5 -28.5t12 -18.5t10.5 -6t11 9.5zM1704 178
+q-52 -127 -148.5 -220t-214.5 -141.5t-253 -60.5t-266 13.5t-251 91t-210 161.5t-141.5 235.5t-46.5 303.5q1 41 8.5 84.5t12.5 64t24 80.5t23 73q-51 -208 1 -397t173 -318t291 -206t346 -83t349 74.5t289 244.5q20 27 18 14q0 -4 -4 -14zM1465 627q0 -104 -40.5 -199
+t-108.5 -164t-162 -109.5t-198 -40.5t-198 40.5t-162 109.5t-108.5 164t-40.5 199t40.5 199t108.5 164t162 109.5t198 40.5t198 -40.5t162 -109.5t108.5 -164t40.5 -199zM1752 915q-65 147 -180.5 251t-253 153.5t-292 53.5t-301 -36.5t-275.5 -129t-220 -211.5t-131 -297
+t-10 -373q-49 161 -51.5 311.5t35.5 272.5t109 227t165.5 180.5t207 126t232 71t242.5 9t236 -54t216 -124.5t178 -197q33 -50 62 -121t31 -112zM1690 573q12 244 -136.5 416t-396.5 240q-8 0 -10 5t24 8q125 -4 230 -50t173 -120t116 -168.5t58.5 -199t-1 -208
+t-61.5 -197.5t-122.5 -167t-185 -117.5t-248.5 -46.5q108 30 201.5 80t174 123t129.5 176.5t55 225.5z" />
+    <glyph glyph-name="uniF2DB" unicode="&#xf2db;" 
+d="M192 256v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 512v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 768v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16
+q0 16 16 16h112zM192 1024v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 1280v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM1280 1440v-1472q0 -40 -28 -68t-68 -28h-832q-40 0 -68 28
+t-28 68v1472q0 40 28 68t68 28h832q40 0 68 -28t28 -68zM1536 208v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 464v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 720v-32
+q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 976v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 1232v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16
+h48q16 0 16 -16z" />
+    <glyph glyph-name="uniF2DC" unicode="&#xf2dc;" horiz-adv-x="1664" 
+d="M1566 419l-167 -33l186 -107q23 -13 29.5 -38.5t-6.5 -48.5q-14 -23 -39 -29.5t-48 6.5l-186 106l55 -160q13 -38 -12 -63.5t-60.5 -20.5t-48.5 42l-102 300l-271 156v-313l208 -238q16 -18 17 -39t-11 -36.5t-28.5 -25t-37 -5.5t-36.5 22l-112 128v-214q0 -26 -19 -45
+t-45 -19t-45 19t-19 45v214l-112 -128q-16 -18 -36.5 -22t-37 5.5t-28.5 25t-11 36.5t17 39l208 238v313l-271 -156l-102 -300q-13 -37 -48.5 -42t-60.5 20.5t-12 63.5l55 160l-186 -106q-23 -13 -48 -6.5t-39 29.5q-13 23 -6.5 48.5t29.5 38.5l186 107l-167 33
+q-29 6 -42 29t-8.5 46.5t25.5 40t50 10.5l310 -62l271 157l-271 157l-310 -62q-4 -1 -13 -1q-27 0 -44 18t-19 40t11 43t40 26l167 33l-186 107q-23 13 -29.5 38.5t6.5 48.5t39 30t48 -7l186 -106l-55 160q-13 38 12 63.5t60.5 20.5t48.5 -42l102 -300l271 -156v313
+l-208 238q-16 18 -17 39t11 36.5t28.5 25t37 5.5t36.5 -22l112 -128v214q0 26 19 45t45 19t45 -19t19 -45v-214l112 128q16 18 36.5 22t37 -5.5t28.5 -25t11 -36.5t-17 -39l-208 -238v-313l271 156l102 300q13 37 48.5 42t60.5 -20.5t12 -63.5l-55 -160l186 106
+q23 13 48 6.5t39 -29.5q13 -23 6.5 -48.5t-29.5 -38.5l-186 -107l167 -33q27 -5 40 -26t11 -43t-19 -40t-44 -18q-9 0 -13 1l-310 62l-271 -157l271 -157l310 62q29 6 50 -10.5t25.5 -40t-8.5 -46.5t-42 -29z" />
+    <glyph glyph-name="uniF2DD" unicode="&#xf2dd;" horiz-adv-x="1792" 
+d="M1473 607q7 118 -33 226.5t-113 189t-177 131t-221 57.5q-116 7 -225.5 -32t-192 -110.5t-135 -175t-59.5 -220.5q-7 -118 33 -226.5t113 -189t177.5 -131t221.5 -57.5q155 -9 293 59t224 195.5t94 283.5zM1792 1536l-349 -348q120 -117 180.5 -272t50.5 -321
+q-11 -183 -102 -339t-241 -255.5t-332 -124.5l-999 -132l347 347q-120 116 -180.5 271.5t-50.5 321.5q11 184 102 340t241.5 255.5t332.5 124.5q167 22 500 66t500 66z" />
+    <glyph glyph-name="uniF2DE" unicode="&#xf2de;" horiz-adv-x="1792" 
+d="M948 508l163 -329h-51l-175 350l-171 -350h-49l179 374l-78 33l21 49l240 -102l-21 -50zM563 1100l304 -130l-130 -304l-304 130zM907 915l240 -103l-103 -239l-239 102zM1188 765l191 -81l-82 -190l-190 81zM1680 640q0 159 -62 304t-167.5 250.5t-250.5 167.5t-304 62
+t-304 -62t-250.5 -167.5t-167.5 -250.5t-62 -304t62 -304t167.5 -250.5t250.5 -167.5t304 -62t304 62t250.5 167.5t167.5 250.5t62 304zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71
+t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2E0" unicode="&#xf2e0;" horiz-adv-x="1920" 
+d="M1334 302q-4 24 -27.5 34t-49.5 10.5t-48.5 12.5t-25.5 38q-5 47 33 139.5t75 181t32 127.5q-14 101 -117 103q-45 1 -75 -16l-3 -2l-5 -2.5t-4.5 -2t-5 -2t-5 -0.5t-6 1.5t-6 3.5t-6.5 5q-3 2 -9 8.5t-9 9t-8.5 7.5t-9.5 7.5t-9.5 5.5t-11 4.5t-11.5 2.5q-30 5 -48 -3
+t-45 -31q-1 -1 -9 -8.5t-12.5 -11t-15 -10t-16.5 -5.5t-17 3q-54 27 -84 40q-41 18 -94 -5t-76 -65q-16 -28 -41 -98.5t-43.5 -132.5t-40 -134t-21.5 -73q-22 -69 18.5 -119t110.5 -46q30 2 50.5 15t38.5 46q7 13 79 199.5t77 194.5q6 11 21.5 18t29.5 0q27 -15 21 -53
+q-2 -18 -51 -139.5t-50 -132.5q-6 -38 19.5 -56.5t60.5 -7t55 49.5q4 8 45.5 92t81.5 163.5t46 88.5q20 29 41 28q29 0 25 -38q-2 -16 -65.5 -147.5t-70.5 -159.5q-12 -53 13 -103t74 -74q17 -9 51 -15.5t71.5 -8t62.5 14t20 48.5zM383 86q3 -15 -5 -27.5t-23 -15.5
+q-14 -3 -26.5 5t-15.5 23q-3 14 5 27t22 16t27 -5t16 -23zM953 -177q12 -17 8.5 -37.5t-20.5 -32.5t-37.5 -8t-32.5 21q-11 17 -7.5 37.5t20.5 32.5t37.5 8t31.5 -21zM177 635q-18 -27 -49.5 -33t-57.5 13q-26 18 -32 50t12 58q18 27 49.5 33t57.5 -12q26 -19 32 -50.5
+t-12 -58.5zM1467 -42q19 -28 13 -61.5t-34 -52.5t-60.5 -13t-51.5 34t-13 61t33 53q28 19 60.5 13t52.5 -34zM1579 562q69 -113 42.5 -244.5t-134.5 -207.5q-90 -63 -199 -60q-20 -80 -84.5 -127t-143.5 -44.5t-140 57.5q-12 -9 -13 -10q-103 -71 -225 -48.5t-193 126.5
+q-50 73 -53 164q-83 14 -142.5 70.5t-80.5 128t-2 152t81 138.5q-36 60 -38 128t24.5 125t79.5 98.5t121 50.5q32 85 99 148t146.5 91.5t168 17t159.5 -66.5q72 21 140 17.5t128.5 -36t104.5 -80t67.5 -115t17.5 -140.5q52 -16 87 -57t45.5 -89t-5.5 -99.5t-58 -87.5z
+M455 1222q14 -20 9.5 -44.5t-24.5 -38.5q-19 -14 -43.5 -9.5t-37.5 24.5q-14 20 -9.5 44.5t24.5 38.5q19 14 43.5 9.5t37.5 -24.5zM614 1503q4 -16 -5 -30.5t-26 -18.5t-31 5.5t-18 26.5q-3 17 6.5 31t25.5 18q17 4 31 -5.5t17 -26.5zM1800 555q4 -20 -6.5 -37t-30.5 -21
+q-19 -4 -36 6.5t-21 30.5t6.5 37t30.5 22q20 4 36.5 -7.5t20.5 -30.5zM1136 1448q16 -27 8.5 -58.5t-35.5 -47.5q-27 -16 -57.5 -8.5t-46.5 34.5q-16 28 -8.5 59t34.5 48t58 9t47 -36zM1882 792q4 -15 -4 -27.5t-23 -16.5q-15 -3 -27.5 5.5t-15.5 22.5q-3 15 5 28t23 16
+q14 3 26.5 -5t15.5 -23zM1691 1033q15 -22 10.5 -49t-26.5 -43q-22 -15 -49 -10t-42 27t-10 49t27 43t48.5 11t41.5 -28z" />
+    <glyph glyph-name="uniF2E1" unicode="&#xf2e1;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E2" unicode="&#xf2e2;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E3" unicode="&#xf2e3;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E4" unicode="&#xf2e4;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E5" unicode="&#xf2e5;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E6" unicode="&#xf2e6;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E7" unicode="&#xf2e7;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_698" unicode="&#xf2e8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E9" unicode="&#xf2e9;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EA" unicode="&#xf2ea;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EB" unicode="&#xf2eb;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EC" unicode="&#xf2ec;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2ED" unicode="&#xf2ed;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EE" unicode="&#xf2ee;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="lessequal" unicode="&#xf500;" horiz-adv-x="1792" 
+ />
+  </font>
+</defs></svg>
diff --git a/_static/fonts/fontawesome-webfont.ttf b/_static/fonts/fontawesome-webfont.ttf
new file mode 100644
index 000000000..35acda2fa
Binary files /dev/null and b/_static/fonts/fontawesome-webfont.ttf differ
diff --git a/_static/fonts/fontawesome-webfont.woff b/_static/fonts/fontawesome-webfont.woff
new file mode 100644
index 000000000..400014a4b
Binary files /dev/null and b/_static/fonts/fontawesome-webfont.woff differ
diff --git a/_static/fonts/fontawesome-webfont.woff2 b/_static/fonts/fontawesome-webfont.woff2
new file mode 100644
index 000000000..4d13fc604
Binary files /dev/null and b/_static/fonts/fontawesome-webfont.woff2 differ
diff --git a/_static/jquery.js b/_static/jquery.js
new file mode 100644
index 000000000..624bca829
--- /dev/null
+++ b/_static/jquery.js
@@ -0,0 +1,10879 @@
+/*!
+ * jQuery JavaScript Library v3.6.0
+ * https://jquery.com/
+ *
+ * Includes Sizzle.js
+ * https://sizzlejs.com/
+ *
+ * Copyright OpenJS Foundation and other contributors
+ * Released under the MIT license
+ * https://jquery.org/license
+ */
+( function( global, factory ) {
+
+	"use strict";
+
+	if ( typeof module === "object" && typeof module.exports === "object" ) {
+
+		// For CommonJS and CommonJS-like environments where a proper `window`
+		// is present, execute the factory and get jQuery.
+		// For environments that do not have a `window` with a `document`
+		// (such as Node.js), expose a factory as module.exports.
+		// This accentuates the need for the creation of a real `window`.
+		// e.g. var jQuery = require("jquery")(window);
+		// See ticket #14549 for more info.
+		module.exports = global.document ?
+			factory( global, true ) :
+			function( w ) {
+				if ( !w.document ) {
+					throw new Error( "jQuery requires a window with a document" );
+				}
+				return factory( w );
+			};
+	} else {
+		factory( global );
+	}
+
+// Pass this if window is not defined yet
+} )( typeof window !== "undefined" ? window : this, function( window, noGlobal ) {
+
+// Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1
+// throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode
+// arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common
+// enough that all such attempts are guarded in a try block.
+"use strict";
+
+var arr = [];
+
+var getProto = Object.getPrototypeOf;
+
+var slice = arr.slice;
+
+var flat = arr.flat ? function( array ) {
+	return arr.flat.call( array );
+} : function( array ) {
+	return arr.concat.apply( [], array );
+};
+
+
+var push = arr.push;
+
+var indexOf = arr.indexOf;
+
+var class2type = {};
+
+var toString = class2type.toString;
+
+var hasOwn = class2type.hasOwnProperty;
+
+var fnToString = hasOwn.toString;
+
+var ObjectFunctionString = fnToString.call( Object );
+
+var support = {};
+
+var isFunction = function isFunction( obj ) {
+
+		// Support: Chrome <=57, Firefox <=52
+		// In some browsers, typeof returns "function" for HTML <object> elements
+		// (i.e., `typeof document.createElement( "object" ) === "function"`).
+		// We don't want to classify *any* DOM node as a function.
+		// Support: QtWeb <=3.8.5, WebKit <=534.34, wkhtmltopdf tool <=0.12.5
+		// Plus for old WebKit, typeof returns "function" for HTML collections
+		// (e.g., `typeof document.getElementsByTagName("div") === "function"`). (gh-4756)
+		return typeof obj === "function" && typeof obj.nodeType !== "number" &&
+			typeof obj.item !== "function";
+	};
+
+
+var isWindow = function isWindow( obj ) {
+		return obj != null && obj === obj.window;
+	};
+
+
+var document = window.document;
+
+
+
+	var preservedScriptAttributes = {
+		type: true,
+		src: true,
+		nonce: true,
+		noModule: true
+	};
+
+	function DOMEval( code, node, doc ) {
+		doc = doc || document;
+
+		var i, val,
+			script = doc.createElement( "script" );
+
+		script.text = code;
+		if ( node ) {
+			for ( i in preservedScriptAttributes ) {
+
+				// Support: Firefox 64+, Edge 18+
+				// Some browsers don't support the "nonce" property on scripts.
+				// On the other hand, just using `getAttribute` is not enough as
+				// the `nonce` attribute is reset to an empty string whenever it
+				// becomes browsing-context connected.
+				// See https://github.com/whatwg/html/issues/2369
+				// See https://html.spec.whatwg.org/#nonce-attributes
+				// The `node.getAttribute` check was added for the sake of
+				// `jQuery.globalEval` so that it can fake a nonce-containing node
+				// via an object.
+				val = node[ i ] || node.getAttribute && node.getAttribute( i );
+				if ( val ) {
+					script.setAttribute( i, val );
+				}
+			}
+		}
+		doc.head.appendChild( script ).parentNode.removeChild( script );
+	}
+
+
+function toType( obj ) {
+	if ( obj == null ) {
+		return obj + "";
+	}
+
+	// Support: Android <=2.3 only (functionish RegExp)
+	return typeof obj === "object" || typeof obj === "function" ?
+		class2type[ toString.call( obj ) ] || "object" :
+		typeof obj;
+}
+/* global Symbol */
+// Defining this global in .eslintrc.json would create a danger of using the global
+// unguarded in another place, it seems safer to define global only for this module
+
+
+
+var
+	version = "3.6.0",
+
+	// Define a local copy of jQuery
+	jQuery = function( selector, context ) {
+
+		// The jQuery object is actually just the init constructor 'enhanced'
+		// Need init if jQuery is called (just allow error to be thrown if not included)
+		return new jQuery.fn.init( selector, context );
+	};
+
+jQuery.fn = jQuery.prototype = {
+
+	// The current version of jQuery being used
+	jquery: version,
+
+	constructor: jQuery,
+
+	// The default length of a jQuery object is 0
+	length: 0,
+
+	toArray: function() {
+		return slice.call( this );
+	},
+
+	// Get the Nth element in the matched element set OR
+	// Get the whole matched element set as a clean array
+	get: function( num ) {
+
+		// Return all the elements in a clean array
+		if ( num == null ) {
+			return slice.call( this );
+		}
+
+		// Return just the one element from the set
+		return num < 0 ? this[ num + this.length ] : this[ num ];
+	},
+
+	// Take an array of elements and push it onto the stack
+	// (returning the new matched element set)
+	pushStack: function( elems ) {
+
+		// Build a new jQuery matched element set
+		var ret = jQuery.merge( this.constructor(), elems );
+
+		// Add the old object onto the stack (as a reference)
+		ret.prevObject = this;
+
+		// Return the newly-formed element set
+		return ret;
+	},
+
+	// Execute a callback for every element in the matched set.
+	each: function( callback ) {
+		return jQuery.each( this, callback );
+	},
+
+	map: function( callback ) {
+		return this.pushStack( jQuery.map( this, function( elem, i ) {
+			return callback.call( elem, i, elem );
+		} ) );
+	},
+
+	slice: function() {
+		return this.pushStack( slice.apply( this, arguments ) );
+	},
+
+	first: function() {
+		return this.eq( 0 );
+	},
+
+	last: function() {
+		return this.eq( -1 );
+	},
+
+	even: function() {
+		return this.pushStack( jQuery.grep( this, function( _elem, i ) {
+			return ( i + 1 ) % 2;
+		} ) );
+	},
+
+	odd: function() {
+		return this.pushStack( jQuery.grep( this, function( _elem, i ) {
+			return i % 2;
+		} ) );
+	},
+
+	eq: function( i ) {
+		var len = this.length,
+			j = +i + ( i < 0 ? len : 0 );
+		return this.pushStack( j >= 0 && j < len ? [ this[ j ] ] : [] );
+	},
+
+	end: function() {
+		return this.prevObject || this.constructor();
+	},
+
+	// For internal use only.
+	// Behaves like an Array's method, not like a jQuery method.
+	push: push,
+	sort: arr.sort,
+	splice: arr.splice
+};
+
+jQuery.extend = jQuery.fn.extend = function() {
+	var options, name, src, copy, copyIsArray, clone,
+		target = arguments[ 0 ] || {},
+		i = 1,
+		length = arguments.length,
+		deep = false;
+
+	// Handle a deep copy situation
+	if ( typeof target === "boolean" ) {
+		deep = target;
+
+		// Skip the boolean and the target
+		target = arguments[ i ] || {};
+		i++;
+	}
+
+	// Handle case when target is a string or something (possible in deep copy)
+	if ( typeof target !== "object" && !isFunction( target ) ) {
+		target = {};
+	}
+
+	// Extend jQuery itself if only one argument is passed
+	if ( i === length ) {
+		target = this;
+		i--;
+	}
+
+	for ( ; i < length; i++ ) {
+
+		// Only deal with non-null/undefined values
+		if ( ( options = arguments[ i ] ) != null ) {
+
+			// Extend the base object
+			for ( name in options ) {
+				copy = options[ name ];
+
+				// Prevent Object.prototype pollution
+				// Prevent never-ending loop
+				if ( name === "__proto__" || target === copy ) {
+					continue;
+				}
+
+				// Recurse if we're merging plain objects or arrays
+				if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
+					( copyIsArray = Array.isArray( copy ) ) ) ) {
+					src = target[ name ];
+
+					// Ensure proper type for the source value
+					if ( copyIsArray && !Array.isArray( src ) ) {
+						clone = [];
+					} else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) {
+						clone = {};
+					} else {
+						clone = src;
+					}
+					copyIsArray = false;
+
+					// Never move original objects, clone them
+					target[ name ] = jQuery.extend( deep, clone, copy );
+
+				// Don't bring in undefined values
+				} else if ( copy !== undefined ) {
+					target[ name ] = copy;
+				}
+			}
+		}
+	}
+
+	// Return the modified object
+	return target;
+};
+
+jQuery.extend( {
+
+	// Unique for each copy of jQuery on the page
+	expando: "jQuery" + ( version + Math.random() ).replace( /\D/g, "" ),
+
+	// Assume jQuery is ready without the ready module
+	isReady: true,
+
+	error: function( msg ) {
+		throw new Error( msg );
+	},
+
+	noop: function() {},
+
+	isPlainObject: function( obj ) {
+		var proto, Ctor;
+
+		// Detect obvious negatives
+		// Use toString instead of jQuery.type to catch host objects
+		if ( !obj || toString.call( obj ) !== "[object Object]" ) {
+			return false;
+		}
+
+		proto = getProto( obj );
+
+		// Objects with no prototype (e.g., `Object.create( null )`) are plain
+		if ( !proto ) {
+			return true;
+		}
+
+		// Objects with prototype are plain iff they were constructed by a global Object function
+		Ctor = hasOwn.call( proto, "constructor" ) && proto.constructor;
+		return typeof Ctor === "function" && fnToString.call( Ctor ) === ObjectFunctionString;
+	},
+
+	isEmptyObject: function( obj ) {
+		var name;
+
+		for ( name in obj ) {
+			return false;
+		}
+		return true;
+	},
+
+	// Evaluates a script in a provided context; falls back to the global one
+	// if not specified.
+	globalEval: function( code, options, doc ) {
+		DOMEval( code, { nonce: options && options.nonce }, doc );
+	},
+
+	each: function( obj, callback ) {
+		var length, i = 0;
+
+		if ( isArrayLike( obj ) ) {
+			length = obj.length;
+			for ( ; i < length; i++ ) {
+				if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) {
+					break;
+				}
+			}
+		} else {
+			for ( i in obj ) {
+				if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) {
+					break;
+				}
+			}
+		}
+
+		return obj;
+	},
+
+	// results is for internal usage only
+	makeArray: function( arr, results ) {
+		var ret = results || [];
+
+		if ( arr != null ) {
+			if ( isArrayLike( Object( arr ) ) ) {
+				jQuery.merge( ret,
+					typeof arr === "string" ?
+						[ arr ] : arr
+				);
+			} else {
+				push.call( ret, arr );
+			}
+		}
+
+		return ret;
+	},
+
+	inArray: function( elem, arr, i ) {
+		return arr == null ? -1 : indexOf.call( arr, elem, i );
+	},
+
+	// Support: Android <=4.0 only, PhantomJS 1 only
+	// push.apply(_, arraylike) throws on ancient WebKit
+	merge: function( first, second ) {
+		var len = +second.length,
+			j = 0,
+			i = first.length;
+
+		for ( ; j < len; j++ ) {
+			first[ i++ ] = second[ j ];
+		}
+
+		first.length = i;
+
+		return first;
+	},
+
+	grep: function( elems, callback, invert ) {
+		var callbackInverse,
+			matches = [],
+			i = 0,
+			length = elems.length,
+			callbackExpect = !invert;
+
+		// Go through the array, only saving the items
+		// that pass the validator function
+		for ( ; i < length; i++ ) {
+			callbackInverse = !callback( elems[ i ], i );
+			if ( callbackInverse !== callbackExpect ) {
+				matches.push( elems[ i ] );
+			}
+		}
+
+		return matches;
+	},
+
+	// arg is for internal usage only
+	map: function( elems, callback, arg ) {
+		var length, value,
+			i = 0,
+			ret = [];
+
+		// Go through the array, translating each of the items to their new values
+		if ( isArrayLike( elems ) ) {
+			length = elems.length;
+			for ( ; i < length; i++ ) {
+				value = callback( elems[ i ], i, arg );
+
+				if ( value != null ) {
+					ret.push( value );
+				}
+			}
+
+		// Go through every key on the object,
+		} else {
+			for ( i in elems ) {
+				value = callback( elems[ i ], i, arg );
+
+				if ( value != null ) {
+					ret.push( value );
+				}
+			}
+		}
+
+		// Flatten any nested arrays
+		return flat( ret );
+	},
+
+	// A global GUID counter for objects
+	guid: 1,
+
+	// jQuery.support is not used in Core but other projects attach their
+	// properties to it so it needs to exist.
+	support: support
+} );
+
+if ( typeof Symbol === "function" ) {
+	jQuery.fn[ Symbol.iterator ] = arr[ Symbol.iterator ];
+}
+
+// Populate the class2type map
+jQuery.each( "Boolean Number String Function Array Date RegExp Object Error Symbol".split( " " ),
+	function( _i, name ) {
+		class2type[ "[object " + name + "]" ] = name.toLowerCase();
+	} );
+
+function isArrayLike( obj ) {
+
+	// Support: real iOS 8.2 only (not reproducible in simulator)
+	// `in` check used to prevent JIT error (gh-2145)
+	// hasOwn isn't used here due to false negatives
+	// regarding Nodelist length in IE
+	var length = !!obj && "length" in obj && obj.length,
+		type = toType( obj );
+
+	if ( isFunction( obj ) || isWindow( obj ) ) {
+		return false;
+	}
+
+	return type === "array" || length === 0 ||
+		typeof length === "number" && length > 0 && ( length - 1 ) in obj;
+}
+var Sizzle =
+/*!
+ * Sizzle CSS Selector Engine v2.3.6
+ * https://sizzlejs.com/
+ *
+ * Copyright JS Foundation and other contributors
+ * Released under the MIT license
+ * https://js.foundation/
+ *
+ * Date: 2021-02-16
+ */
+( function( window ) {
+var i,
+	support,
+	Expr,
+	getText,
+	isXML,
+	tokenize,
+	compile,
+	select,
+	outermostContext,
+	sortInput,
+	hasDuplicate,
+
+	// Local document vars
+	setDocument,
+	document,
+	docElem,
+	documentIsHTML,
+	rbuggyQSA,
+	rbuggyMatches,
+	matches,
+	contains,
+
+	// Instance-specific data
+	expando = "sizzle" + 1 * new Date(),
+	preferredDoc = window.document,
+	dirruns = 0,
+	done = 0,
+	classCache = createCache(),
+	tokenCache = createCache(),
+	compilerCache = createCache(),
+	nonnativeSelectorCache = createCache(),
+	sortOrder = function( a, b ) {
+		if ( a === b ) {
+			hasDuplicate = true;
+		}
+		return 0;
+	},
+
+	// Instance methods
+	hasOwn = ( {} ).hasOwnProperty,
+	arr = [],
+	pop = arr.pop,
+	pushNative = arr.push,
+	push = arr.push,
+	slice = arr.slice,
+
+	// Use a stripped-down indexOf as it's faster than native
+	// https://jsperf.com/thor-indexof-vs-for/5
+	indexOf = function( list, elem ) {
+		var i = 0,
+			len = list.length;
+		for ( ; i < len; i++ ) {
+			if ( list[ i ] === elem ) {
+				return i;
+			}
+		}
+		return -1;
+	},
+
+	booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|" +
+		"ismap|loop|multiple|open|readonly|required|scoped",
+
+	// Regular expressions
+
+	// http://www.w3.org/TR/css3-selectors/#whitespace
+	whitespace = "[\\x20\\t\\r\\n\\f]",
+
+	// https://www.w3.org/TR/css-syntax-3/#ident-token-diagram
+	identifier = "(?:\\\\[\\da-fA-F]{1,6}" + whitespace +
+		"?|\\\\[^\\r\\n\\f]|[\\w-]|[^\0-\\x7f])+",
+
+	// Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors
+	attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace +
+
+		// Operator (capture 2)
+		"*([*^$|!~]?=)" + whitespace +
+
+		// "Attribute values must be CSS identifiers [capture 5]
+		// or strings [capture 3 or capture 4]"
+		"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" +
+		whitespace + "*\\]",
+
+	pseudos = ":(" + identifier + ")(?:\\((" +
+
+		// To reduce the number of selectors needing tokenize in the preFilter, prefer arguments:
+		// 1. quoted (capture 3; capture 4 or capture 5)
+		"('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" +
+
+		// 2. simple (capture 6)
+		"((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" +
+
+		// 3. anything else (capture 2)
+		".*" +
+		")\\)|)",
+
+	// Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latter
+	rwhitespace = new RegExp( whitespace + "+", "g" ),
+	rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" +
+		whitespace + "+$", "g" ),
+
+	rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ),
+	rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" + whitespace +
+		"*" ),
+	rdescend = new RegExp( whitespace + "|>" ),
+
+	rpseudo = new RegExp( pseudos ),
+	ridentifier = new RegExp( "^" + identifier + "$" ),
+
+	matchExpr = {
+		"ID": new RegExp( "^#(" + identifier + ")" ),
+		"CLASS": new RegExp( "^\\.(" + identifier + ")" ),
+		"TAG": new RegExp( "^(" + identifier + "|[*])" ),
+		"ATTR": new RegExp( "^" + attributes ),
+		"PSEUDO": new RegExp( "^" + pseudos ),
+		"CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" +
+			whitespace + "*(even|odd|(([+-]|)(\\d*)n|)" + whitespace + "*(?:([+-]|)" +
+			whitespace + "*(\\d+)|))" + whitespace + "*\\)|)", "i" ),
+		"bool": new RegExp( "^(?:" + booleans + ")$", "i" ),
+
+		// For use in libraries implementing .is()
+		// We use this for POS matching in `select`
+		"needsContext": new RegExp( "^" + whitespace +
+			"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" + whitespace +
+			"*((?:-\\d)?\\d*)" + whitespace + "*\\)|)(?=[^-]|$)", "i" )
+	},
+
+	rhtml = /HTML$/i,
+	rinputs = /^(?:input|select|textarea|button)$/i,
+	rheader = /^h\d$/i,
+
+	rnative = /^[^{]+\{\s*\[native \w/,
+
+	// Easily-parseable/retrievable ID or TAG or CLASS selectors
+	rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,
+
+	rsibling = /[+~]/,
+
+	// CSS escapes
+	// http://www.w3.org/TR/CSS21/syndata.html#escaped-characters
+	runescape = new RegExp( "\\\\[\\da-fA-F]{1,6}" + whitespace + "?|\\\\([^\\r\\n\\f])", "g" ),
+	funescape = function( escape, nonHex ) {
+		var high = "0x" + escape.slice( 1 ) - 0x10000;
+
+		return nonHex ?
+
+			// Strip the backslash prefix from a non-hex escape sequence
+			nonHex :
+
+			// Replace a hexadecimal escape sequence with the encoded Unicode code point
+			// Support: IE <=11+
+			// For values outside the Basic Multilingual Plane (BMP), manually construct a
+			// surrogate pair
+			high < 0 ?
+				String.fromCharCode( high + 0x10000 ) :
+				String.fromCharCode( high >> 10 | 0xD800, high & 0x3FF | 0xDC00 );
+	},
+
+	// CSS string/identifier serialization
+	// https://drafts.csswg.org/cssom/#common-serializing-idioms
+	rcssescape = /([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,
+	fcssescape = function( ch, asCodePoint ) {
+		if ( asCodePoint ) {
+
+			// U+0000 NULL becomes U+FFFD REPLACEMENT CHARACTER
+			if ( ch === "\0" ) {
+				return "\uFFFD";
+			}
+
+			// Control characters and (dependent upon position) numbers get escaped as code points
+			return ch.slice( 0, -1 ) + "\\" +
+				ch.charCodeAt( ch.length - 1 ).toString( 16 ) + " ";
+		}
+
+		// Other potentially-special ASCII characters get backslash-escaped
+		return "\\" + ch;
+	},
+
+	// Used for iframes
+	// See setDocument()
+	// Removing the function wrapper causes a "Permission Denied"
+	// error in IE
+	unloadHandler = function() {
+		setDocument();
+	},
+
+	inDisabledFieldset = addCombinator(
+		function( elem ) {
+			return elem.disabled === true && elem.nodeName.toLowerCase() === "fieldset";
+		},
+		{ dir: "parentNode", next: "legend" }
+	);
+
+// Optimize for push.apply( _, NodeList )
+try {
+	push.apply(
+		( arr = slice.call( preferredDoc.childNodes ) ),
+		preferredDoc.childNodes
+	);
+
+	// Support: Android<4.0
+	// Detect silently failing push.apply
+	// eslint-disable-next-line no-unused-expressions
+	arr[ preferredDoc.childNodes.length ].nodeType;
+} catch ( e ) {
+	push = { apply: arr.length ?
+
+		// Leverage slice if possible
+		function( target, els ) {
+			pushNative.apply( target, slice.call( els ) );
+		} :
+
+		// Support: IE<9
+		// Otherwise append directly
+		function( target, els ) {
+			var j = target.length,
+				i = 0;
+
+			// Can't trust NodeList.length
+			while ( ( target[ j++ ] = els[ i++ ] ) ) {}
+			target.length = j - 1;
+		}
+	};
+}
+
+function Sizzle( selector, context, results, seed ) {
+	var m, i, elem, nid, match, groups, newSelector,
+		newContext = context && context.ownerDocument,
+
+		// nodeType defaults to 9, since context defaults to document
+		nodeType = context ? context.nodeType : 9;
+
+	results = results || [];
+
+	// Return early from calls with invalid selector or context
+	if ( typeof selector !== "string" || !selector ||
+		nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) {
+
+		return results;
+	}
+
+	// Try to shortcut find operations (as opposed to filters) in HTML documents
+	if ( !seed ) {
+		setDocument( context );
+		context = context || document;
+
+		if ( documentIsHTML ) {
+
+			// If the selector is sufficiently simple, try using a "get*By*" DOM method
+			// (excepting DocumentFragment context, where the methods don't exist)
+			if ( nodeType !== 11 && ( match = rquickExpr.exec( selector ) ) ) {
+
+				// ID selector
+				if ( ( m = match[ 1 ] ) ) {
+
+					// Document context
+					if ( nodeType === 9 ) {
+						if ( ( elem = context.getElementById( m ) ) ) {
+
+							// Support: IE, Opera, Webkit
+							// TODO: identify versions
+							// getElementById can match elements by name instead of ID
+							if ( elem.id === m ) {
+								results.push( elem );
+								return results;
+							}
+						} else {
+							return results;
+						}
+
+					// Element context
+					} else {
+
+						// Support: IE, Opera, Webkit
+						// TODO: identify versions
+						// getElementById can match elements by name instead of ID
+						if ( newContext && ( elem = newContext.getElementById( m ) ) &&
+							contains( context, elem ) &&
+							elem.id === m ) {
+
+							results.push( elem );
+							return results;
+						}
+					}
+
+				// Type selector
+				} else if ( match[ 2 ] ) {
+					push.apply( results, context.getElementsByTagName( selector ) );
+					return results;
+
+				// Class selector
+				} else if ( ( m = match[ 3 ] ) && support.getElementsByClassName &&
+					context.getElementsByClassName ) {
+
+					push.apply( results, context.getElementsByClassName( m ) );
+					return results;
+				}
+			}
+
+			// Take advantage of querySelectorAll
+			if ( support.qsa &&
+				!nonnativeSelectorCache[ selector + " " ] &&
+				( !rbuggyQSA || !rbuggyQSA.test( selector ) ) &&
+
+				// Support: IE 8 only
+				// Exclude object elements
+				( nodeType !== 1 || context.nodeName.toLowerCase() !== "object" ) ) {
+
+				newSelector = selector;
+				newContext = context;
+
+				// qSA considers elements outside a scoping root when evaluating child or
+				// descendant combinators, which is not what we want.
+				// In such cases, we work around the behavior by prefixing every selector in the
+				// list with an ID selector referencing the scope context.
+				// The technique has to be used as well when a leading combinator is used
+				// as such selectors are not recognized by querySelectorAll.
+				// Thanks to Andrew Dupont for this technique.
+				if ( nodeType === 1 &&
+					( rdescend.test( selector ) || rcombinators.test( selector ) ) ) {
+
+					// Expand context for sibling selectors
+					newContext = rsibling.test( selector ) && testContext( context.parentNode ) ||
+						context;
+
+					// We can use :scope instead of the ID hack if the browser
+					// supports it & if we're not changing the context.
+					if ( newContext !== context || !support.scope ) {
+
+						// Capture the context ID, setting it first if necessary
+						if ( ( nid = context.getAttribute( "id" ) ) ) {
+							nid = nid.replace( rcssescape, fcssescape );
+						} else {
+							context.setAttribute( "id", ( nid = expando ) );
+						}
+					}
+
+					// Prefix every selector in the list
+					groups = tokenize( selector );
+					i = groups.length;
+					while ( i-- ) {
+						groups[ i ] = ( nid ? "#" + nid : ":scope" ) + " " +
+							toSelector( groups[ i ] );
+					}
+					newSelector = groups.join( "," );
+				}
+
+				try {
+					push.apply( results,
+						newContext.querySelectorAll( newSelector )
+					);
+					return results;
+				} catch ( qsaError ) {
+					nonnativeSelectorCache( selector, true );
+				} finally {
+					if ( nid === expando ) {
+						context.removeAttribute( "id" );
+					}
+				}
+			}
+		}
+	}
+
+	// All others
+	return select( selector.replace( rtrim, "$1" ), context, results, seed );
+}
+
+/**
+ * Create key-value caches of limited size
+ * @returns {function(string, object)} Returns the Object data after storing it on itself with
+ *	property name the (space-suffixed) string and (if the cache is larger than Expr.cacheLength)
+ *	deleting the oldest entry
+ */
+function createCache() {
+	var keys = [];
+
+	function cache( key, value ) {
+
+		// Use (key + " ") to avoid collision with native prototype properties (see Issue #157)
+		if ( keys.push( key + " " ) > Expr.cacheLength ) {
+
+			// Only keep the most recent entries
+			delete cache[ keys.shift() ];
+		}
+		return ( cache[ key + " " ] = value );
+	}
+	return cache;
+}
+
+/**
+ * Mark a function for special use by Sizzle
+ * @param {Function} fn The function to mark
+ */
+function markFunction( fn ) {
+	fn[ expando ] = true;
+	return fn;
+}
+
+/**
+ * Support testing using an element
+ * @param {Function} fn Passed the created element and returns a boolean result
+ */
+function assert( fn ) {
+	var el = document.createElement( "fieldset" );
+
+	try {
+		return !!fn( el );
+	} catch ( e ) {
+		return false;
+	} finally {
+
+		// Remove from its parent by default
+		if ( el.parentNode ) {
+			el.parentNode.removeChild( el );
+		}
+
+		// release memory in IE
+		el = null;
+	}
+}
+
+/**
+ * Adds the same handler for all of the specified attrs
+ * @param {String} attrs Pipe-separated list of attributes
+ * @param {Function} handler The method that will be applied
+ */
+function addHandle( attrs, handler ) {
+	var arr = attrs.split( "|" ),
+		i = arr.length;
+
+	while ( i-- ) {
+		Expr.attrHandle[ arr[ i ] ] = handler;
+	}
+}
+
+/**
+ * Checks document order of two siblings
+ * @param {Element} a
+ * @param {Element} b
+ * @returns {Number} Returns less than 0 if a precedes b, greater than 0 if a follows b
+ */
+function siblingCheck( a, b ) {
+	var cur = b && a,
+		diff = cur && a.nodeType === 1 && b.nodeType === 1 &&
+			a.sourceIndex - b.sourceIndex;
+
+	// Use IE sourceIndex if available on both nodes
+	if ( diff ) {
+		return diff;
+	}
+
+	// Check if b follows a
+	if ( cur ) {
+		while ( ( cur = cur.nextSibling ) ) {
+			if ( cur === b ) {
+				return -1;
+			}
+		}
+	}
+
+	return a ? 1 : -1;
+}
+
+/**
+ * Returns a function to use in pseudos for input types
+ * @param {String} type
+ */
+function createInputPseudo( type ) {
+	return function( elem ) {
+		var name = elem.nodeName.toLowerCase();
+		return name === "input" && elem.type === type;
+	};
+}
+
+/**
+ * Returns a function to use in pseudos for buttons
+ * @param {String} type
+ */
+function createButtonPseudo( type ) {
+	return function( elem ) {
+		var name = elem.nodeName.toLowerCase();
+		return ( name === "input" || name === "button" ) && elem.type === type;
+	};
+}
+
+/**
+ * Returns a function to use in pseudos for :enabled/:disabled
+ * @param {Boolean} disabled true for :disabled; false for :enabled
+ */
+function createDisabledPseudo( disabled ) {
+
+	// Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable
+	return function( elem ) {
+
+		// Only certain elements can match :enabled or :disabled
+		// https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
+		// https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
+		if ( "form" in elem ) {
+
+			// Check for inherited disabledness on relevant non-disabled elements:
+			// * listed form-associated elements in a disabled fieldset
+			//   https://html.spec.whatwg.org/multipage/forms.html#category-listed
+			//   https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
+			// * option elements in a disabled optgroup
+			//   https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
+			// All such elements have a "form" property.
+			if ( elem.parentNode && elem.disabled === false ) {
+
+				// Option elements defer to a parent optgroup if present
+				if ( "label" in elem ) {
+					if ( "label" in elem.parentNode ) {
+						return elem.parentNode.disabled === disabled;
+					} else {
+						return elem.disabled === disabled;
+					}
+				}
+
+				// Support: IE 6 - 11
+				// Use the isDisabled shortcut property to check for disabled fieldset ancestors
+				return elem.isDisabled === disabled ||
+
+					// Where there is no isDisabled, check manually
+					/* jshint -W018 */
+					elem.isDisabled !== !disabled &&
+					inDisabledFieldset( elem ) === disabled;
+			}
+
+			return elem.disabled === disabled;
+
+		// Try to winnow out elements that can't be disabled before trusting the disabled property.
+		// Some victims get caught in our net (label, legend, menu, track), but it shouldn't
+		// even exist on them, let alone have a boolean value.
+		} else if ( "label" in elem ) {
+			return elem.disabled === disabled;
+		}
+
+		// Remaining elements are neither :enabled nor :disabled
+		return false;
+	};
+}
+
+/**
+ * Returns a function to use in pseudos for positionals
+ * @param {Function} fn
+ */
+function createPositionalPseudo( fn ) {
+	return markFunction( function( argument ) {
+		argument = +argument;
+		return markFunction( function( seed, matches ) {
+			var j,
+				matchIndexes = fn( [], seed.length, argument ),
+				i = matchIndexes.length;
+
+			// Match elements found at the specified indexes
+			while ( i-- ) {
+				if ( seed[ ( j = matchIndexes[ i ] ) ] ) {
+					seed[ j ] = !( matches[ j ] = seed[ j ] );
+				}
+			}
+		} );
+	} );
+}
+
+/**
+ * Checks a node for validity as a Sizzle context
+ * @param {Element|Object=} context
+ * @returns {Element|Object|Boolean} The input node if acceptable, otherwise a falsy value
+ */
+function testContext( context ) {
+	return context && typeof context.getElementsByTagName !== "undefined" && context;
+}
+
+// Expose support vars for convenience
+support = Sizzle.support = {};
+
+/**
+ * Detects XML nodes
+ * @param {Element|Object} elem An element or a document
+ * @returns {Boolean} True iff elem is a non-HTML XML node
+ */
+isXML = Sizzle.isXML = function( elem ) {
+	var namespace = elem && elem.namespaceURI,
+		docElem = elem && ( elem.ownerDocument || elem ).documentElement;
+
+	// Support: IE <=8
+	// Assume HTML when documentElement doesn't yet exist, such as inside loading iframes
+	// https://bugs.jquery.com/ticket/4833
+	return !rhtml.test( namespace || docElem && docElem.nodeName || "HTML" );
+};
+
+/**
+ * Sets document-related variables once based on the current document
+ * @param {Element|Object} [doc] An element or document object to use to set the document
+ * @returns {Object} Returns the current document
+ */
+setDocument = Sizzle.setDocument = function( node ) {
+	var hasCompare, subWindow,
+		doc = node ? node.ownerDocument || node : preferredDoc;
+
+	// Return early if doc is invalid or already selected
+	// Support: IE 11+, Edge 17 - 18+
+	// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+	// two documents; shallow comparisons work.
+	// eslint-disable-next-line eqeqeq
+	if ( doc == document || doc.nodeType !== 9 || !doc.documentElement ) {
+		return document;
+	}
+
+	// Update global variables
+	document = doc;
+	docElem = document.documentElement;
+	documentIsHTML = !isXML( document );
+
+	// Support: IE 9 - 11+, Edge 12 - 18+
+	// Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936)
+	// Support: IE 11+, Edge 17 - 18+
+	// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+	// two documents; shallow comparisons work.
+	// eslint-disable-next-line eqeqeq
+	if ( preferredDoc != document &&
+		( subWindow = document.defaultView ) && subWindow.top !== subWindow ) {
+
+		// Support: IE 11, Edge
+		if ( subWindow.addEventListener ) {
+			subWindow.addEventListener( "unload", unloadHandler, false );
+
+		// Support: IE 9 - 10 only
+		} else if ( subWindow.attachEvent ) {
+			subWindow.attachEvent( "onunload", unloadHandler );
+		}
+	}
+
+	// Support: IE 8 - 11+, Edge 12 - 18+, Chrome <=16 - 25 only, Firefox <=3.6 - 31 only,
+	// Safari 4 - 5 only, Opera <=11.6 - 12.x only
+	// IE/Edge & older browsers don't support the :scope pseudo-class.
+	// Support: Safari 6.0 only
+	// Safari 6.0 supports :scope but it's an alias of :root there.
+	support.scope = assert( function( el ) {
+		docElem.appendChild( el ).appendChild( document.createElement( "div" ) );
+		return typeof el.querySelectorAll !== "undefined" &&
+			!el.querySelectorAll( ":scope fieldset div" ).length;
+	} );
+
+	/* Attributes
+	---------------------------------------------------------------------- */
+
+	// Support: IE<8
+	// Verify that getAttribute really returns attributes and not properties
+	// (excepting IE8 booleans)
+	support.attributes = assert( function( el ) {
+		el.className = "i";
+		return !el.getAttribute( "className" );
+	} );
+
+	/* getElement(s)By*
+	---------------------------------------------------------------------- */
+
+	// Check if getElementsByTagName("*") returns only elements
+	support.getElementsByTagName = assert( function( el ) {
+		el.appendChild( document.createComment( "" ) );
+		return !el.getElementsByTagName( "*" ).length;
+	} );
+
+	// Support: IE<9
+	support.getElementsByClassName = rnative.test( document.getElementsByClassName );
+
+	// Support: IE<10
+	// Check if getElementById returns elements by name
+	// The broken getElementById methods don't pick up programmatically-set names,
+	// so use a roundabout getElementsByName test
+	support.getById = assert( function( el ) {
+		docElem.appendChild( el ).id = expando;
+		return !document.getElementsByName || !document.getElementsByName( expando ).length;
+	} );
+
+	// ID filter and find
+	if ( support.getById ) {
+		Expr.filter[ "ID" ] = function( id ) {
+			var attrId = id.replace( runescape, funescape );
+			return function( elem ) {
+				return elem.getAttribute( "id" ) === attrId;
+			};
+		};
+		Expr.find[ "ID" ] = function( id, context ) {
+			if ( typeof context.getElementById !== "undefined" && documentIsHTML ) {
+				var elem = context.getElementById( id );
+				return elem ? [ elem ] : [];
+			}
+		};
+	} else {
+		Expr.filter[ "ID" ] =  function( id ) {
+			var attrId = id.replace( runescape, funescape );
+			return function( elem ) {
+				var node = typeof elem.getAttributeNode !== "undefined" &&
+					elem.getAttributeNode( "id" );
+				return node && node.value === attrId;
+			};
+		};
+
+		// Support: IE 6 - 7 only
+		// getElementById is not reliable as a find shortcut
+		Expr.find[ "ID" ] = function( id, context ) {
+			if ( typeof context.getElementById !== "undefined" && documentIsHTML ) {
+				var node, i, elems,
+					elem = context.getElementById( id );
+
+				if ( elem ) {
+
+					// Verify the id attribute
+					node = elem.getAttributeNode( "id" );
+					if ( node && node.value === id ) {
+						return [ elem ];
+					}
+
+					// Fall back on getElementsByName
+					elems = context.getElementsByName( id );
+					i = 0;
+					while ( ( elem = elems[ i++ ] ) ) {
+						node = elem.getAttributeNode( "id" );
+						if ( node && node.value === id ) {
+							return [ elem ];
+						}
+					}
+				}
+
+				return [];
+			}
+		};
+	}
+
+	// Tag
+	Expr.find[ "TAG" ] = support.getElementsByTagName ?
+		function( tag, context ) {
+			if ( typeof context.getElementsByTagName !== "undefined" ) {
+				return context.getElementsByTagName( tag );
+
+			// DocumentFragment nodes don't have gEBTN
+			} else if ( support.qsa ) {
+				return context.querySelectorAll( tag );
+			}
+		} :
+
+		function( tag, context ) {
+			var elem,
+				tmp = [],
+				i = 0,
+
+				// By happy coincidence, a (broken) gEBTN appears on DocumentFragment nodes too
+				results = context.getElementsByTagName( tag );
+
+			// Filter out possible comments
+			if ( tag === "*" ) {
+				while ( ( elem = results[ i++ ] ) ) {
+					if ( elem.nodeType === 1 ) {
+						tmp.push( elem );
+					}
+				}
+
+				return tmp;
+			}
+			return results;
+		};
+
+	// Class
+	Expr.find[ "CLASS" ] = support.getElementsByClassName && function( className, context ) {
+		if ( typeof context.getElementsByClassName !== "undefined" && documentIsHTML ) {
+			return context.getElementsByClassName( className );
+		}
+	};
+
+	/* QSA/matchesSelector
+	---------------------------------------------------------------------- */
+
+	// QSA and matchesSelector support
+
+	// matchesSelector(:active) reports false when true (IE9/Opera 11.5)
+	rbuggyMatches = [];
+
+	// qSa(:focus) reports false when true (Chrome 21)
+	// We allow this because of a bug in IE8/9 that throws an error
+	// whenever `document.activeElement` is accessed on an iframe
+	// So, we allow :focus to pass through QSA all the time to avoid the IE error
+	// See https://bugs.jquery.com/ticket/13378
+	rbuggyQSA = [];
+
+	if ( ( support.qsa = rnative.test( document.querySelectorAll ) ) ) {
+
+		// Build QSA regex
+		// Regex strategy adopted from Diego Perini
+		assert( function( el ) {
+
+			var input;
+
+			// Select is set to empty string on purpose
+			// This is to test IE's treatment of not explicitly
+			// setting a boolean content attribute,
+			// since its presence should be enough
+			// https://bugs.jquery.com/ticket/12359
+			docElem.appendChild( el ).innerHTML = "<a id='" + expando + "'></a>" +
+				"<select id='" + expando + "-\r\\' msallowcapture=''>" +
+				"<option selected=''></option></select>";
+
+			// Support: IE8, Opera 11-12.16
+			// Nothing should be selected when empty strings follow ^= or $= or *=
+			// The test attribute must be unknown in Opera but "safe" for WinRT
+			// https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section
+			if ( el.querySelectorAll( "[msallowcapture^='']" ).length ) {
+				rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" );
+			}
+
+			// Support: IE8
+			// Boolean attributes and "value" are not treated correctly
+			if ( !el.querySelectorAll( "[selected]" ).length ) {
+				rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" );
+			}
+
+			// Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+
+			if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) {
+				rbuggyQSA.push( "~=" );
+			}
+
+			// Support: IE 11+, Edge 15 - 18+
+			// IE 11/Edge don't find elements on a `[name='']` query in some cases.
+			// Adding a temporary attribute to the document before the selection works
+			// around the issue.
+			// Interestingly, IE 10 & older don't seem to have the issue.
+			input = document.createElement( "input" );
+			input.setAttribute( "name", "" );
+			el.appendChild( input );
+			if ( !el.querySelectorAll( "[name='']" ).length ) {
+				rbuggyQSA.push( "\\[" + whitespace + "*name" + whitespace + "*=" +
+					whitespace + "*(?:''|\"\")" );
+			}
+
+			// Webkit/Opera - :checked should return selected option elements
+			// http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked
+			// IE8 throws error here and will not see later tests
+			if ( !el.querySelectorAll( ":checked" ).length ) {
+				rbuggyQSA.push( ":checked" );
+			}
+
+			// Support: Safari 8+, iOS 8+
+			// https://bugs.webkit.org/show_bug.cgi?id=136851
+			// In-page `selector#id sibling-combinator selector` fails
+			if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) {
+				rbuggyQSA.push( ".#.+[+~]" );
+			}
+
+			// Support: Firefox <=3.6 - 5 only
+			// Old Firefox doesn't throw on a badly-escaped identifier.
+			el.querySelectorAll( "\\\f" );
+			rbuggyQSA.push( "[\\r\\n\\f]" );
+		} );
+
+		assert( function( el ) {
+			el.innerHTML = "<a href='' disabled='disabled'></a>" +
+				"<select disabled='disabled'><option/></select>";
+
+			// Support: Windows 8 Native Apps
+			// The type and name attributes are restricted during .innerHTML assignment
+			var input = document.createElement( "input" );
+			input.setAttribute( "type", "hidden" );
+			el.appendChild( input ).setAttribute( "name", "D" );
+
+			// Support: IE8
+			// Enforce case-sensitivity of name attribute
+			if ( el.querySelectorAll( "[name=d]" ).length ) {
+				rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" );
+			}
+
+			// FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled)
+			// IE8 throws error here and will not see later tests
+			if ( el.querySelectorAll( ":enabled" ).length !== 2 ) {
+				rbuggyQSA.push( ":enabled", ":disabled" );
+			}
+
+			// Support: IE9-11+
+			// IE's :disabled selector does not pick up the children of disabled fieldsets
+			docElem.appendChild( el ).disabled = true;
+			if ( el.querySelectorAll( ":disabled" ).length !== 2 ) {
+				rbuggyQSA.push( ":enabled", ":disabled" );
+			}
+
+			// Support: Opera 10 - 11 only
+			// Opera 10-11 does not throw on post-comma invalid pseudos
+			el.querySelectorAll( "*,:x" );
+			rbuggyQSA.push( ",.*:" );
+		} );
+	}
+
+	if ( ( support.matchesSelector = rnative.test( ( matches = docElem.matches ||
+		docElem.webkitMatchesSelector ||
+		docElem.mozMatchesSelector ||
+		docElem.oMatchesSelector ||
+		docElem.msMatchesSelector ) ) ) ) {
+
+		assert( function( el ) {
+
+			// Check to see if it's possible to do matchesSelector
+			// on a disconnected node (IE 9)
+			support.disconnectedMatch = matches.call( el, "*" );
+
+			// This should fail with an exception
+			// Gecko does not error, returns false instead
+			matches.call( el, "[s!='']:x" );
+			rbuggyMatches.push( "!=", pseudos );
+		} );
+	}
+
+	rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join( "|" ) );
+	rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join( "|" ) );
+
+	/* Contains
+	---------------------------------------------------------------------- */
+	hasCompare = rnative.test( docElem.compareDocumentPosition );
+
+	// Element contains another
+	// Purposefully self-exclusive
+	// As in, an element does not contain itself
+	contains = hasCompare || rnative.test( docElem.contains ) ?
+		function( a, b ) {
+			var adown = a.nodeType === 9 ? a.documentElement : a,
+				bup = b && b.parentNode;
+			return a === bup || !!( bup && bup.nodeType === 1 && (
+				adown.contains ?
+					adown.contains( bup ) :
+					a.compareDocumentPosition && a.compareDocumentPosition( bup ) & 16
+			) );
+		} :
+		function( a, b ) {
+			if ( b ) {
+				while ( ( b = b.parentNode ) ) {
+					if ( b === a ) {
+						return true;
+					}
+				}
+			}
+			return false;
+		};
+
+	/* Sorting
+	---------------------------------------------------------------------- */
+
+	// Document order sorting
+	sortOrder = hasCompare ?
+	function( a, b ) {
+
+		// Flag for duplicate removal
+		if ( a === b ) {
+			hasDuplicate = true;
+			return 0;
+		}
+
+		// Sort on method existence if only one input has compareDocumentPosition
+		var compare = !a.compareDocumentPosition - !b.compareDocumentPosition;
+		if ( compare ) {
+			return compare;
+		}
+
+		// Calculate position if both inputs belong to the same document
+		// Support: IE 11+, Edge 17 - 18+
+		// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+		// two documents; shallow comparisons work.
+		// eslint-disable-next-line eqeqeq
+		compare = ( a.ownerDocument || a ) == ( b.ownerDocument || b ) ?
+			a.compareDocumentPosition( b ) :
+
+			// Otherwise we know they are disconnected
+			1;
+
+		// Disconnected nodes
+		if ( compare & 1 ||
+			( !support.sortDetached && b.compareDocumentPosition( a ) === compare ) ) {
+
+			// Choose the first element that is related to our preferred document
+			// Support: IE 11+, Edge 17 - 18+
+			// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+			// two documents; shallow comparisons work.
+			// eslint-disable-next-line eqeqeq
+			if ( a == document || a.ownerDocument == preferredDoc &&
+				contains( preferredDoc, a ) ) {
+				return -1;
+			}
+
+			// Support: IE 11+, Edge 17 - 18+
+			// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+			// two documents; shallow comparisons work.
+			// eslint-disable-next-line eqeqeq
+			if ( b == document || b.ownerDocument == preferredDoc &&
+				contains( preferredDoc, b ) ) {
+				return 1;
+			}
+
+			// Maintain original order
+			return sortInput ?
+				( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) :
+				0;
+		}
+
+		return compare & 4 ? -1 : 1;
+	} :
+	function( a, b ) {
+
+		// Exit early if the nodes are identical
+		if ( a === b ) {
+			hasDuplicate = true;
+			return 0;
+		}
+
+		var cur,
+			i = 0,
+			aup = a.parentNode,
+			bup = b.parentNode,
+			ap = [ a ],
+			bp = [ b ];
+
+		// Parentless nodes are either documents or disconnected
+		if ( !aup || !bup ) {
+
+			// Support: IE 11+, Edge 17 - 18+
+			// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+			// two documents; shallow comparisons work.
+			/* eslint-disable eqeqeq */
+			return a == document ? -1 :
+				b == document ? 1 :
+				/* eslint-enable eqeqeq */
+				aup ? -1 :
+				bup ? 1 :
+				sortInput ?
+				( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) :
+				0;
+
+		// If the nodes are siblings, we can do a quick check
+		} else if ( aup === bup ) {
+			return siblingCheck( a, b );
+		}
+
+		// Otherwise we need full lists of their ancestors for comparison
+		cur = a;
+		while ( ( cur = cur.parentNode ) ) {
+			ap.unshift( cur );
+		}
+		cur = b;
+		while ( ( cur = cur.parentNode ) ) {
+			bp.unshift( cur );
+		}
+
+		// Walk down the tree looking for a discrepancy
+		while ( ap[ i ] === bp[ i ] ) {
+			i++;
+		}
+
+		return i ?
+
+			// Do a sibling check if the nodes have a common ancestor
+			siblingCheck( ap[ i ], bp[ i ] ) :
+
+			// Otherwise nodes in our document sort first
+			// Support: IE 11+, Edge 17 - 18+
+			// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+			// two documents; shallow comparisons work.
+			/* eslint-disable eqeqeq */
+			ap[ i ] == preferredDoc ? -1 :
+			bp[ i ] == preferredDoc ? 1 :
+			/* eslint-enable eqeqeq */
+			0;
+	};
+
+	return document;
+};
+
+Sizzle.matches = function( expr, elements ) {
+	return Sizzle( expr, null, null, elements );
+};
+
+Sizzle.matchesSelector = function( elem, expr ) {
+	setDocument( elem );
+
+	if ( support.matchesSelector && documentIsHTML &&
+		!nonnativeSelectorCache[ expr + " " ] &&
+		( !rbuggyMatches || !rbuggyMatches.test( expr ) ) &&
+		( !rbuggyQSA     || !rbuggyQSA.test( expr ) ) ) {
+
+		try {
+			var ret = matches.call( elem, expr );
+
+			// IE 9's matchesSelector returns false on disconnected nodes
+			if ( ret || support.disconnectedMatch ||
+
+				// As well, disconnected nodes are said to be in a document
+				// fragment in IE 9
+				elem.document && elem.document.nodeType !== 11 ) {
+				return ret;
+			}
+		} catch ( e ) {
+			nonnativeSelectorCache( expr, true );
+		}
+	}
+
+	return Sizzle( expr, document, null, [ elem ] ).length > 0;
+};
+
+Sizzle.contains = function( context, elem ) {
+
+	// Set document vars if needed
+	// Support: IE 11+, Edge 17 - 18+
+	// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+	// two documents; shallow comparisons work.
+	// eslint-disable-next-line eqeqeq
+	if ( ( context.ownerDocument || context ) != document ) {
+		setDocument( context );
+	}
+	return contains( context, elem );
+};
+
+Sizzle.attr = function( elem, name ) {
+
+	// Set document vars if needed
+	// Support: IE 11+, Edge 17 - 18+
+	// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+	// two documents; shallow comparisons work.
+	// eslint-disable-next-line eqeqeq
+	if ( ( elem.ownerDocument || elem ) != document ) {
+		setDocument( elem );
+	}
+
+	var fn = Expr.attrHandle[ name.toLowerCase() ],
+
+		// Don't get fooled by Object.prototype properties (jQuery #13807)
+		val = fn && hasOwn.call( Expr.attrHandle, name.toLowerCase() ) ?
+			fn( elem, name, !documentIsHTML ) :
+			undefined;
+
+	return val !== undefined ?
+		val :
+		support.attributes || !documentIsHTML ?
+			elem.getAttribute( name ) :
+			( val = elem.getAttributeNode( name ) ) && val.specified ?
+				val.value :
+				null;
+};
+
+Sizzle.escape = function( sel ) {
+	return ( sel + "" ).replace( rcssescape, fcssescape );
+};
+
+Sizzle.error = function( msg ) {
+	throw new Error( "Syntax error, unrecognized expression: " + msg );
+};
+
+/**
+ * Document sorting and removing duplicates
+ * @param {ArrayLike} results
+ */
+Sizzle.uniqueSort = function( results ) {
+	var elem,
+		duplicates = [],
+		j = 0,
+		i = 0;
+
+	// Unless we *know* we can detect duplicates, assume their presence
+	hasDuplicate = !support.detectDuplicates;
+	sortInput = !support.sortStable && results.slice( 0 );
+	results.sort( sortOrder );
+
+	if ( hasDuplicate ) {
+		while ( ( elem = results[ i++ ] ) ) {
+			if ( elem === results[ i ] ) {
+				j = duplicates.push( i );
+			}
+		}
+		while ( j-- ) {
+			results.splice( duplicates[ j ], 1 );
+		}
+	}
+
+	// Clear input after sorting to release objects
+	// See https://github.com/jquery/sizzle/pull/225
+	sortInput = null;
+
+	return results;
+};
+
+/**
+ * Utility function for retrieving the text value of an array of DOM nodes
+ * @param {Array|Element} elem
+ */
+getText = Sizzle.getText = function( elem ) {
+	var node,
+		ret = "",
+		i = 0,
+		nodeType = elem.nodeType;
+
+	if ( !nodeType ) {
+
+		// If no nodeType, this is expected to be an array
+		while ( ( node = elem[ i++ ] ) ) {
+
+			// Do not traverse comment nodes
+			ret += getText( node );
+		}
+	} else if ( nodeType === 1 || nodeType === 9 || nodeType === 11 ) {
+
+		// Use textContent for elements
+		// innerText usage removed for consistency of new lines (jQuery #11153)
+		if ( typeof elem.textContent === "string" ) {
+			return elem.textContent;
+		} else {
+
+			// Traverse its children
+			for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) {
+				ret += getText( elem );
+			}
+		}
+	} else if ( nodeType === 3 || nodeType === 4 ) {
+		return elem.nodeValue;
+	}
+
+	// Do not include comment or processing instruction nodes
+
+	return ret;
+};
+
+Expr = Sizzle.selectors = {
+
+	// Can be adjusted by the user
+	cacheLength: 50,
+
+	createPseudo: markFunction,
+
+	match: matchExpr,
+
+	attrHandle: {},
+
+	find: {},
+
+	relative: {
+		">": { dir: "parentNode", first: true },
+		" ": { dir: "parentNode" },
+		"+": { dir: "previousSibling", first: true },
+		"~": { dir: "previousSibling" }
+	},
+
+	preFilter: {
+		"ATTR": function( match ) {
+			match[ 1 ] = match[ 1 ].replace( runescape, funescape );
+
+			// Move the given value to match[3] whether quoted or unquoted
+			match[ 3 ] = ( match[ 3 ] || match[ 4 ] ||
+				match[ 5 ] || "" ).replace( runescape, funescape );
+
+			if ( match[ 2 ] === "~=" ) {
+				match[ 3 ] = " " + match[ 3 ] + " ";
+			}
+
+			return match.slice( 0, 4 );
+		},
+
+		"CHILD": function( match ) {
+
+			/* matches from matchExpr["CHILD"]
+				1 type (only|nth|...)
+				2 what (child|of-type)
+				3 argument (even|odd|\d*|\d*n([+-]\d+)?|...)
+				4 xn-component of xn+y argument ([+-]?\d*n|)
+				5 sign of xn-component
+				6 x of xn-component
+				7 sign of y-component
+				8 y of y-component
+			*/
+			match[ 1 ] = match[ 1 ].toLowerCase();
+
+			if ( match[ 1 ].slice( 0, 3 ) === "nth" ) {
+
+				// nth-* requires argument
+				if ( !match[ 3 ] ) {
+					Sizzle.error( match[ 0 ] );
+				}
+
+				// numeric x and y parameters for Expr.filter.CHILD
+				// remember that false/true cast respectively to 0/1
+				match[ 4 ] = +( match[ 4 ] ?
+					match[ 5 ] + ( match[ 6 ] || 1 ) :
+					2 * ( match[ 3 ] === "even" || match[ 3 ] === "odd" ) );
+				match[ 5 ] = +( ( match[ 7 ] + match[ 8 ] ) || match[ 3 ] === "odd" );
+
+				// other types prohibit arguments
+			} else if ( match[ 3 ] ) {
+				Sizzle.error( match[ 0 ] );
+			}
+
+			return match;
+		},
+
+		"PSEUDO": function( match ) {
+			var excess,
+				unquoted = !match[ 6 ] && match[ 2 ];
+
+			if ( matchExpr[ "CHILD" ].test( match[ 0 ] ) ) {
+				return null;
+			}
+
+			// Accept quoted arguments as-is
+			if ( match[ 3 ] ) {
+				match[ 2 ] = match[ 4 ] || match[ 5 ] || "";
+
+			// Strip excess characters from unquoted arguments
+			} else if ( unquoted && rpseudo.test( unquoted ) &&
+
+				// Get excess from tokenize (recursively)
+				( excess = tokenize( unquoted, true ) ) &&
+
+				// advance to the next closing parenthesis
+				( excess = unquoted.indexOf( ")", unquoted.length - excess ) - unquoted.length ) ) {
+
+				// excess is a negative index
+				match[ 0 ] = match[ 0 ].slice( 0, excess );
+				match[ 2 ] = unquoted.slice( 0, excess );
+			}
+
+			// Return only captures needed by the pseudo filter method (type and argument)
+			return match.slice( 0, 3 );
+		}
+	},
+
+	filter: {
+
+		"TAG": function( nodeNameSelector ) {
+			var nodeName = nodeNameSelector.replace( runescape, funescape ).toLowerCase();
+			return nodeNameSelector === "*" ?
+				function() {
+					return true;
+				} :
+				function( elem ) {
+					return elem.nodeName && elem.nodeName.toLowerCase() === nodeName;
+				};
+		},
+
+		"CLASS": function( className ) {
+			var pattern = classCache[ className + " " ];
+
+			return pattern ||
+				( pattern = new RegExp( "(^|" + whitespace +
+					")" + className + "(" + whitespace + "|$)" ) ) && classCache(
+						className, function( elem ) {
+							return pattern.test(
+								typeof elem.className === "string" && elem.className ||
+								typeof elem.getAttribute !== "undefined" &&
+									elem.getAttribute( "class" ) ||
+								""
+							);
+				} );
+		},
+
+		"ATTR": function( name, operator, check ) {
+			return function( elem ) {
+				var result = Sizzle.attr( elem, name );
+
+				if ( result == null ) {
+					return operator === "!=";
+				}
+				if ( !operator ) {
+					return true;
+				}
+
+				result += "";
+
+				/* eslint-disable max-len */
+
+				return operator === "=" ? result === check :
+					operator === "!=" ? result !== check :
+					operator === "^=" ? check && result.indexOf( check ) === 0 :
+					operator === "*=" ? check && result.indexOf( check ) > -1 :
+					operator === "$=" ? check && result.slice( -check.length ) === check :
+					operator === "~=" ? ( " " + result.replace( rwhitespace, " " ) + " " ).indexOf( check ) > -1 :
+					operator === "|=" ? result === check || result.slice( 0, check.length + 1 ) === check + "-" :
+					false;
+				/* eslint-enable max-len */
+
+			};
+		},
+
+		"CHILD": function( type, what, _argument, first, last ) {
+			var simple = type.slice( 0, 3 ) !== "nth",
+				forward = type.slice( -4 ) !== "last",
+				ofType = what === "of-type";
+
+			return first === 1 && last === 0 ?
+
+				// Shortcut for :nth-*(n)
+				function( elem ) {
+					return !!elem.parentNode;
+				} :
+
+				function( elem, _context, xml ) {
+					var cache, uniqueCache, outerCache, node, nodeIndex, start,
+						dir = simple !== forward ? "nextSibling" : "previousSibling",
+						parent = elem.parentNode,
+						name = ofType && elem.nodeName.toLowerCase(),
+						useCache = !xml && !ofType,
+						diff = false;
+
+					if ( parent ) {
+
+						// :(first|last|only)-(child|of-type)
+						if ( simple ) {
+							while ( dir ) {
+								node = elem;
+								while ( ( node = node[ dir ] ) ) {
+									if ( ofType ?
+										node.nodeName.toLowerCase() === name :
+										node.nodeType === 1 ) {
+
+										return false;
+									}
+								}
+
+								// Reverse direction for :only-* (if we haven't yet done so)
+								start = dir = type === "only" && !start && "nextSibling";
+							}
+							return true;
+						}
+
+						start = [ forward ? parent.firstChild : parent.lastChild ];
+
+						// non-xml :nth-child(...) stores cache data on `parent`
+						if ( forward && useCache ) {
+
+							// Seek `elem` from a previously-cached index
+
+							// ...in a gzip-friendly way
+							node = parent;
+							outerCache = node[ expando ] || ( node[ expando ] = {} );
+
+							// Support: IE <9 only
+							// Defend against cloned attroperties (jQuery gh-1709)
+							uniqueCache = outerCache[ node.uniqueID ] ||
+								( outerCache[ node.uniqueID ] = {} );
+
+							cache = uniqueCache[ type ] || [];
+							nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ];
+							diff = nodeIndex && cache[ 2 ];
+							node = nodeIndex && parent.childNodes[ nodeIndex ];
+
+							while ( ( node = ++nodeIndex && node && node[ dir ] ||
+
+								// Fallback to seeking `elem` from the start
+								( diff = nodeIndex = 0 ) || start.pop() ) ) {
+
+								// When found, cache indexes on `parent` and break
+								if ( node.nodeType === 1 && ++diff && node === elem ) {
+									uniqueCache[ type ] = [ dirruns, nodeIndex, diff ];
+									break;
+								}
+							}
+
+						} else {
+
+							// Use previously-cached element index if available
+							if ( useCache ) {
+
+								// ...in a gzip-friendly way
+								node = elem;
+								outerCache = node[ expando ] || ( node[ expando ] = {} );
+
+								// Support: IE <9 only
+								// Defend against cloned attroperties (jQuery gh-1709)
+								uniqueCache = outerCache[ node.uniqueID ] ||
+									( outerCache[ node.uniqueID ] = {} );
+
+								cache = uniqueCache[ type ] || [];
+								nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ];
+								diff = nodeIndex;
+							}
+
+							// xml :nth-child(...)
+							// or :nth-last-child(...) or :nth(-last)?-of-type(...)
+							if ( diff === false ) {
+
+								// Use the same loop as above to seek `elem` from the start
+								while ( ( node = ++nodeIndex && node && node[ dir ] ||
+									( diff = nodeIndex = 0 ) || start.pop() ) ) {
+
+									if ( ( ofType ?
+										node.nodeName.toLowerCase() === name :
+										node.nodeType === 1 ) &&
+										++diff ) {
+
+										// Cache the index of each encountered element
+										if ( useCache ) {
+											outerCache = node[ expando ] ||
+												( node[ expando ] = {} );
+
+											// Support: IE <9 only
+											// Defend against cloned attroperties (jQuery gh-1709)
+											uniqueCache = outerCache[ node.uniqueID ] ||
+												( outerCache[ node.uniqueID ] = {} );
+
+											uniqueCache[ type ] = [ dirruns, diff ];
+										}
+
+										if ( node === elem ) {
+											break;
+										}
+									}
+								}
+							}
+						}
+
+						// Incorporate the offset, then check against cycle size
+						diff -= last;
+						return diff === first || ( diff % first === 0 && diff / first >= 0 );
+					}
+				};
+		},
+
+		"PSEUDO": function( pseudo, argument ) {
+
+			// pseudo-class names are case-insensitive
+			// http://www.w3.org/TR/selectors/#pseudo-classes
+			// Prioritize by case sensitivity in case custom pseudos are added with uppercase letters
+			// Remember that setFilters inherits from pseudos
+			var args,
+				fn = Expr.pseudos[ pseudo ] || Expr.setFilters[ pseudo.toLowerCase() ] ||
+					Sizzle.error( "unsupported pseudo: " + pseudo );
+
+			// The user may use createPseudo to indicate that
+			// arguments are needed to create the filter function
+			// just as Sizzle does
+			if ( fn[ expando ] ) {
+				return fn( argument );
+			}
+
+			// But maintain support for old signatures
+			if ( fn.length > 1 ) {
+				args = [ pseudo, pseudo, "", argument ];
+				return Expr.setFilters.hasOwnProperty( pseudo.toLowerCase() ) ?
+					markFunction( function( seed, matches ) {
+						var idx,
+							matched = fn( seed, argument ),
+							i = matched.length;
+						while ( i-- ) {
+							idx = indexOf( seed, matched[ i ] );
+							seed[ idx ] = !( matches[ idx ] = matched[ i ] );
+						}
+					} ) :
+					function( elem ) {
+						return fn( elem, 0, args );
+					};
+			}
+
+			return fn;
+		}
+	},
+
+	pseudos: {
+
+		// Potentially complex pseudos
+		"not": markFunction( function( selector ) {
+
+			// Trim the selector passed to compile
+			// to avoid treating leading and trailing
+			// spaces as combinators
+			var input = [],
+				results = [],
+				matcher = compile( selector.replace( rtrim, "$1" ) );
+
+			return matcher[ expando ] ?
+				markFunction( function( seed, matches, _context, xml ) {
+					var elem,
+						unmatched = matcher( seed, null, xml, [] ),
+						i = seed.length;
+
+					// Match elements unmatched by `matcher`
+					while ( i-- ) {
+						if ( ( elem = unmatched[ i ] ) ) {
+							seed[ i ] = !( matches[ i ] = elem );
+						}
+					}
+				} ) :
+				function( elem, _context, xml ) {
+					input[ 0 ] = elem;
+					matcher( input, null, xml, results );
+
+					// Don't keep the element (issue #299)
+					input[ 0 ] = null;
+					return !results.pop();
+				};
+		} ),
+
+		"has": markFunction( function( selector ) {
+			return function( elem ) {
+				return Sizzle( selector, elem ).length > 0;
+			};
+		} ),
+
+		"contains": markFunction( function( text ) {
+			text = text.replace( runescape, funescape );
+			return function( elem ) {
+				return ( elem.textContent || getText( elem ) ).indexOf( text ) > -1;
+			};
+		} ),
+
+		// "Whether an element is represented by a :lang() selector
+		// is based solely on the element's language value
+		// being equal to the identifier C,
+		// or beginning with the identifier C immediately followed by "-".
+		// The matching of C against the element's language value is performed case-insensitively.
+		// The identifier C does not have to be a valid language name."
+		// http://www.w3.org/TR/selectors/#lang-pseudo
+		"lang": markFunction( function( lang ) {
+
+			// lang value must be a valid identifier
+			if ( !ridentifier.test( lang || "" ) ) {
+				Sizzle.error( "unsupported lang: " + lang );
+			}
+			lang = lang.replace( runescape, funescape ).toLowerCase();
+			return function( elem ) {
+				var elemLang;
+				do {
+					if ( ( elemLang = documentIsHTML ?
+						elem.lang :
+						elem.getAttribute( "xml:lang" ) || elem.getAttribute( "lang" ) ) ) {
+
+						elemLang = elemLang.toLowerCase();
+						return elemLang === lang || elemLang.indexOf( lang + "-" ) === 0;
+					}
+				} while ( ( elem = elem.parentNode ) && elem.nodeType === 1 );
+				return false;
+			};
+		} ),
+
+		// Miscellaneous
+		"target": function( elem ) {
+			var hash = window.location && window.location.hash;
+			return hash && hash.slice( 1 ) === elem.id;
+		},
+
+		"root": function( elem ) {
+			return elem === docElem;
+		},
+
+		"focus": function( elem ) {
+			return elem === document.activeElement &&
+				( !document.hasFocus || document.hasFocus() ) &&
+				!!( elem.type || elem.href || ~elem.tabIndex );
+		},
+
+		// Boolean properties
+		"enabled": createDisabledPseudo( false ),
+		"disabled": createDisabledPseudo( true ),
+
+		"checked": function( elem ) {
+
+			// In CSS3, :checked should return both checked and selected elements
+			// http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked
+			var nodeName = elem.nodeName.toLowerCase();
+			return ( nodeName === "input" && !!elem.checked ) ||
+				( nodeName === "option" && !!elem.selected );
+		},
+
+		"selected": function( elem ) {
+
+			// Accessing this property makes selected-by-default
+			// options in Safari work properly
+			if ( elem.parentNode ) {
+				// eslint-disable-next-line no-unused-expressions
+				elem.parentNode.selectedIndex;
+			}
+
+			return elem.selected === true;
+		},
+
+		// Contents
+		"empty": function( elem ) {
+
+			// http://www.w3.org/TR/selectors/#empty-pseudo
+			// :empty is negated by element (1) or content nodes (text: 3; cdata: 4; entity ref: 5),
+			//   but not by others (comment: 8; processing instruction: 7; etc.)
+			// nodeType < 6 works because attributes (2) do not appear as children
+			for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) {
+				if ( elem.nodeType < 6 ) {
+					return false;
+				}
+			}
+			return true;
+		},
+
+		"parent": function( elem ) {
+			return !Expr.pseudos[ "empty" ]( elem );
+		},
+
+		// Element/input types
+		"header": function( elem ) {
+			return rheader.test( elem.nodeName );
+		},
+
+		"input": function( elem ) {
+			return rinputs.test( elem.nodeName );
+		},
+
+		"button": function( elem ) {
+			var name = elem.nodeName.toLowerCase();
+			return name === "input" && elem.type === "button" || name === "button";
+		},
+
+		"text": function( elem ) {
+			var attr;
+			return elem.nodeName.toLowerCase() === "input" &&
+				elem.type === "text" &&
+
+				// Support: IE<8
+				// New HTML5 attribute values (e.g., "search") appear with elem.type === "text"
+				( ( attr = elem.getAttribute( "type" ) ) == null ||
+					attr.toLowerCase() === "text" );
+		},
+
+		// Position-in-collection
+		"first": createPositionalPseudo( function() {
+			return [ 0 ];
+		} ),
+
+		"last": createPositionalPseudo( function( _matchIndexes, length ) {
+			return [ length - 1 ];
+		} ),
+
+		"eq": createPositionalPseudo( function( _matchIndexes, length, argument ) {
+			return [ argument < 0 ? argument + length : argument ];
+		} ),
+
+		"even": createPositionalPseudo( function( matchIndexes, length ) {
+			var i = 0;
+			for ( ; i < length; i += 2 ) {
+				matchIndexes.push( i );
+			}
+			return matchIndexes;
+		} ),
+
+		"odd": createPositionalPseudo( function( matchIndexes, length ) {
+			var i = 1;
+			for ( ; i < length; i += 2 ) {
+				matchIndexes.push( i );
+			}
+			return matchIndexes;
+		} ),
+
+		"lt": createPositionalPseudo( function( matchIndexes, length, argument ) {
+			var i = argument < 0 ?
+				argument + length :
+				argument > length ?
+					length :
+					argument;
+			for ( ; --i >= 0; ) {
+				matchIndexes.push( i );
+			}
+			return matchIndexes;
+		} ),
+
+		"gt": createPositionalPseudo( function( matchIndexes, length, argument ) {
+			var i = argument < 0 ? argument + length : argument;
+			for ( ; ++i < length; ) {
+				matchIndexes.push( i );
+			}
+			return matchIndexes;
+		} )
+	}
+};
+
+Expr.pseudos[ "nth" ] = Expr.pseudos[ "eq" ];
+
+// Add button/input type pseudos
+for ( i in { radio: true, checkbox: true, file: true, password: true, image: true } ) {
+	Expr.pseudos[ i ] = createInputPseudo( i );
+}
+for ( i in { submit: true, reset: true } ) {
+	Expr.pseudos[ i ] = createButtonPseudo( i );
+}
+
+// Easy API for creating new setFilters
+function setFilters() {}
+setFilters.prototype = Expr.filters = Expr.pseudos;
+Expr.setFilters = new setFilters();
+
+tokenize = Sizzle.tokenize = function( selector, parseOnly ) {
+	var matched, match, tokens, type,
+		soFar, groups, preFilters,
+		cached = tokenCache[ selector + " " ];
+
+	if ( cached ) {
+		return parseOnly ? 0 : cached.slice( 0 );
+	}
+
+	soFar = selector;
+	groups = [];
+	preFilters = Expr.preFilter;
+
+	while ( soFar ) {
+
+		// Comma and first run
+		if ( !matched || ( match = rcomma.exec( soFar ) ) ) {
+			if ( match ) {
+
+				// Don't consume trailing commas as valid
+				soFar = soFar.slice( match[ 0 ].length ) || soFar;
+			}
+			groups.push( ( tokens = [] ) );
+		}
+
+		matched = false;
+
+		// Combinators
+		if ( ( match = rcombinators.exec( soFar ) ) ) {
+			matched = match.shift();
+			tokens.push( {
+				value: matched,
+
+				// Cast descendant combinators to space
+				type: match[ 0 ].replace( rtrim, " " )
+			} );
+			soFar = soFar.slice( matched.length );
+		}
+
+		// Filters
+		for ( type in Expr.filter ) {
+			if ( ( match = matchExpr[ type ].exec( soFar ) ) && ( !preFilters[ type ] ||
+				( match = preFilters[ type ]( match ) ) ) ) {
+				matched = match.shift();
+				tokens.push( {
+					value: matched,
+					type: type,
+					matches: match
+				} );
+				soFar = soFar.slice( matched.length );
+			}
+		}
+
+		if ( !matched ) {
+			break;
+		}
+	}
+
+	// Return the length of the invalid excess
+	// if we're just parsing
+	// Otherwise, throw an error or return tokens
+	return parseOnly ?
+		soFar.length :
+		soFar ?
+			Sizzle.error( selector ) :
+
+			// Cache the tokens
+			tokenCache( selector, groups ).slice( 0 );
+};
+
+function toSelector( tokens ) {
+	var i = 0,
+		len = tokens.length,
+		selector = "";
+	for ( ; i < len; i++ ) {
+		selector += tokens[ i ].value;
+	}
+	return selector;
+}
+
+function addCombinator( matcher, combinator, base ) {
+	var dir = combinator.dir,
+		skip = combinator.next,
+		key = skip || dir,
+		checkNonElements = base && key === "parentNode",
+		doneName = done++;
+
+	return combinator.first ?
+
+		// Check against closest ancestor/preceding element
+		function( elem, context, xml ) {
+			while ( ( elem = elem[ dir ] ) ) {
+				if ( elem.nodeType === 1 || checkNonElements ) {
+					return matcher( elem, context, xml );
+				}
+			}
+			return false;
+		} :
+
+		// Check against all ancestor/preceding elements
+		function( elem, context, xml ) {
+			var oldCache, uniqueCache, outerCache,
+				newCache = [ dirruns, doneName ];
+
+			// We can't set arbitrary data on XML nodes, so they don't benefit from combinator caching
+			if ( xml ) {
+				while ( ( elem = elem[ dir ] ) ) {
+					if ( elem.nodeType === 1 || checkNonElements ) {
+						if ( matcher( elem, context, xml ) ) {
+							return true;
+						}
+					}
+				}
+			} else {
+				while ( ( elem = elem[ dir ] ) ) {
+					if ( elem.nodeType === 1 || checkNonElements ) {
+						outerCache = elem[ expando ] || ( elem[ expando ] = {} );
+
+						// Support: IE <9 only
+						// Defend against cloned attroperties (jQuery gh-1709)
+						uniqueCache = outerCache[ elem.uniqueID ] ||
+							( outerCache[ elem.uniqueID ] = {} );
+
+						if ( skip && skip === elem.nodeName.toLowerCase() ) {
+							elem = elem[ dir ] || elem;
+						} else if ( ( oldCache = uniqueCache[ key ] ) &&
+							oldCache[ 0 ] === dirruns && oldCache[ 1 ] === doneName ) {
+
+							// Assign to newCache so results back-propagate to previous elements
+							return ( newCache[ 2 ] = oldCache[ 2 ] );
+						} else {
+
+							// Reuse newcache so results back-propagate to previous elements
+							uniqueCache[ key ] = newCache;
+
+							// A match means we're done; a fail means we have to keep checking
+							if ( ( newCache[ 2 ] = matcher( elem, context, xml ) ) ) {
+								return true;
+							}
+						}
+					}
+				}
+			}
+			return false;
+		};
+}
+
+function elementMatcher( matchers ) {
+	return matchers.length > 1 ?
+		function( elem, context, xml ) {
+			var i = matchers.length;
+			while ( i-- ) {
+				if ( !matchers[ i ]( elem, context, xml ) ) {
+					return false;
+				}
+			}
+			return true;
+		} :
+		matchers[ 0 ];
+}
+
+function multipleContexts( selector, contexts, results ) {
+	var i = 0,
+		len = contexts.length;
+	for ( ; i < len; i++ ) {
+		Sizzle( selector, contexts[ i ], results );
+	}
+	return results;
+}
+
+function condense( unmatched, map, filter, context, xml ) {
+	var elem,
+		newUnmatched = [],
+		i = 0,
+		len = unmatched.length,
+		mapped = map != null;
+
+	for ( ; i < len; i++ ) {
+		if ( ( elem = unmatched[ i ] ) ) {
+			if ( !filter || filter( elem, context, xml ) ) {
+				newUnmatched.push( elem );
+				if ( mapped ) {
+					map.push( i );
+				}
+			}
+		}
+	}
+
+	return newUnmatched;
+}
+
+function setMatcher( preFilter, selector, matcher, postFilter, postFinder, postSelector ) {
+	if ( postFilter && !postFilter[ expando ] ) {
+		postFilter = setMatcher( postFilter );
+	}
+	if ( postFinder && !postFinder[ expando ] ) {
+		postFinder = setMatcher( postFinder, postSelector );
+	}
+	return markFunction( function( seed, results, context, xml ) {
+		var temp, i, elem,
+			preMap = [],
+			postMap = [],
+			preexisting = results.length,
+
+			// Get initial elements from seed or context
+			elems = seed || multipleContexts(
+				selector || "*",
+				context.nodeType ? [ context ] : context,
+				[]
+			),
+
+			// Prefilter to get matcher input, preserving a map for seed-results synchronization
+			matcherIn = preFilter && ( seed || !selector ) ?
+				condense( elems, preMap, preFilter, context, xml ) :
+				elems,
+
+			matcherOut = matcher ?
+
+				// If we have a postFinder, or filtered seed, or non-seed postFilter or preexisting results,
+				postFinder || ( seed ? preFilter : preexisting || postFilter ) ?
+
+					// ...intermediate processing is necessary
+					[] :
+
+					// ...otherwise use results directly
+					results :
+				matcherIn;
+
+		// Find primary matches
+		if ( matcher ) {
+			matcher( matcherIn, matcherOut, context, xml );
+		}
+
+		// Apply postFilter
+		if ( postFilter ) {
+			temp = condense( matcherOut, postMap );
+			postFilter( temp, [], context, xml );
+
+			// Un-match failing elements by moving them back to matcherIn
+			i = temp.length;
+			while ( i-- ) {
+				if ( ( elem = temp[ i ] ) ) {
+					matcherOut[ postMap[ i ] ] = !( matcherIn[ postMap[ i ] ] = elem );
+				}
+			}
+		}
+
+		if ( seed ) {
+			if ( postFinder || preFilter ) {
+				if ( postFinder ) {
+
+					// Get the final matcherOut by condensing this intermediate into postFinder contexts
+					temp = [];
+					i = matcherOut.length;
+					while ( i-- ) {
+						if ( ( elem = matcherOut[ i ] ) ) {
+
+							// Restore matcherIn since elem is not yet a final match
+							temp.push( ( matcherIn[ i ] = elem ) );
+						}
+					}
+					postFinder( null, ( matcherOut = [] ), temp, xml );
+				}
+
+				// Move matched elements from seed to results to keep them synchronized
+				i = matcherOut.length;
+				while ( i-- ) {
+					if ( ( elem = matcherOut[ i ] ) &&
+						( temp = postFinder ? indexOf( seed, elem ) : preMap[ i ] ) > -1 ) {
+
+						seed[ temp ] = !( results[ temp ] = elem );
+					}
+				}
+			}
+
+		// Add elements to results, through postFinder if defined
+		} else {
+			matcherOut = condense(
+				matcherOut === results ?
+					matcherOut.splice( preexisting, matcherOut.length ) :
+					matcherOut
+			);
+			if ( postFinder ) {
+				postFinder( null, results, matcherOut, xml );
+			} else {
+				push.apply( results, matcherOut );
+			}
+		}
+	} );
+}
+
+function matcherFromTokens( tokens ) {
+	var checkContext, matcher, j,
+		len = tokens.length,
+		leadingRelative = Expr.relative[ tokens[ 0 ].type ],
+		implicitRelative = leadingRelative || Expr.relative[ " " ],
+		i = leadingRelative ? 1 : 0,
+
+		// The foundational matcher ensures that elements are reachable from top-level context(s)
+		matchContext = addCombinator( function( elem ) {
+			return elem === checkContext;
+		}, implicitRelative, true ),
+		matchAnyContext = addCombinator( function( elem ) {
+			return indexOf( checkContext, elem ) > -1;
+		}, implicitRelative, true ),
+		matchers = [ function( elem, context, xml ) {
+			var ret = ( !leadingRelative && ( xml || context !== outermostContext ) ) || (
+				( checkContext = context ).nodeType ?
+					matchContext( elem, context, xml ) :
+					matchAnyContext( elem, context, xml ) );
+
+			// Avoid hanging onto element (issue #299)
+			checkContext = null;
+			return ret;
+		} ];
+
+	for ( ; i < len; i++ ) {
+		if ( ( matcher = Expr.relative[ tokens[ i ].type ] ) ) {
+			matchers = [ addCombinator( elementMatcher( matchers ), matcher ) ];
+		} else {
+			matcher = Expr.filter[ tokens[ i ].type ].apply( null, tokens[ i ].matches );
+
+			// Return special upon seeing a positional matcher
+			if ( matcher[ expando ] ) {
+
+				// Find the next relative operator (if any) for proper handling
+				j = ++i;
+				for ( ; j < len; j++ ) {
+					if ( Expr.relative[ tokens[ j ].type ] ) {
+						break;
+					}
+				}
+				return setMatcher(
+					i > 1 && elementMatcher( matchers ),
+					i > 1 && toSelector(
+
+					// If the preceding token was a descendant combinator, insert an implicit any-element `*`
+					tokens
+						.slice( 0, i - 1 )
+						.concat( { value: tokens[ i - 2 ].type === " " ? "*" : "" } )
+					).replace( rtrim, "$1" ),
+					matcher,
+					i < j && matcherFromTokens( tokens.slice( i, j ) ),
+					j < len && matcherFromTokens( ( tokens = tokens.slice( j ) ) ),
+					j < len && toSelector( tokens )
+				);
+			}
+			matchers.push( matcher );
+		}
+	}
+
+	return elementMatcher( matchers );
+}
+
+function matcherFromGroupMatchers( elementMatchers, setMatchers ) {
+	var bySet = setMatchers.length > 0,
+		byElement = elementMatchers.length > 0,
+		superMatcher = function( seed, context, xml, results, outermost ) {
+			var elem, j, matcher,
+				matchedCount = 0,
+				i = "0",
+				unmatched = seed && [],
+				setMatched = [],
+				contextBackup = outermostContext,
+
+				// We must always have either seed elements or outermost context
+				elems = seed || byElement && Expr.find[ "TAG" ]( "*", outermost ),
+
+				// Use integer dirruns iff this is the outermost matcher
+				dirrunsUnique = ( dirruns += contextBackup == null ? 1 : Math.random() || 0.1 ),
+				len = elems.length;
+
+			if ( outermost ) {
+
+				// Support: IE 11+, Edge 17 - 18+
+				// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+				// two documents; shallow comparisons work.
+				// eslint-disable-next-line eqeqeq
+				outermostContext = context == document || context || outermost;
+			}
+
+			// Add elements passing elementMatchers directly to results
+			// Support: IE<9, Safari
+			// Tolerate NodeList properties (IE: "length"; Safari: <number>) matching elements by id
+			for ( ; i !== len && ( elem = elems[ i ] ) != null; i++ ) {
+				if ( byElement && elem ) {
+					j = 0;
+
+					// Support: IE 11+, Edge 17 - 18+
+					// IE/Edge sometimes throw a "Permission denied" error when strict-comparing
+					// two documents; shallow comparisons work.
+					// eslint-disable-next-line eqeqeq
+					if ( !context && elem.ownerDocument != document ) {
+						setDocument( elem );
+						xml = !documentIsHTML;
+					}
+					while ( ( matcher = elementMatchers[ j++ ] ) ) {
+						if ( matcher( elem, context || document, xml ) ) {
+							results.push( elem );
+							break;
+						}
+					}
+					if ( outermost ) {
+						dirruns = dirrunsUnique;
+					}
+				}
+
+				// Track unmatched elements for set filters
+				if ( bySet ) {
+
+					// They will have gone through all possible matchers
+					if ( ( elem = !matcher && elem ) ) {
+						matchedCount--;
+					}
+
+					// Lengthen the array for every element, matched or not
+					if ( seed ) {
+						unmatched.push( elem );
+					}
+				}
+			}
+
+			// `i` is now the count of elements visited above, and adding it to `matchedCount`
+			// makes the latter nonnegative.
+			matchedCount += i;
+
+			// Apply set filters to unmatched elements
+			// NOTE: This can be skipped if there are no unmatched elements (i.e., `matchedCount`
+			// equals `i`), unless we didn't visit _any_ elements in the above loop because we have
+			// no element matchers and no seed.
+			// Incrementing an initially-string "0" `i` allows `i` to remain a string only in that
+			// case, which will result in a "00" `matchedCount` that differs from `i` but is also
+			// numerically zero.
+			if ( bySet && i !== matchedCount ) {
+				j = 0;
+				while ( ( matcher = setMatchers[ j++ ] ) ) {
+					matcher( unmatched, setMatched, context, xml );
+				}
+
+				if ( seed ) {
+
+					// Reintegrate element matches to eliminate the need for sorting
+					if ( matchedCount > 0 ) {
+						while ( i-- ) {
+							if ( !( unmatched[ i ] || setMatched[ i ] ) ) {
+								setMatched[ i ] = pop.call( results );
+							}
+						}
+					}
+
+					// Discard index placeholder values to get only actual matches
+					setMatched = condense( setMatched );
+				}
+
+				// Add matches to results
+				push.apply( results, setMatched );
+
+				// Seedless set matches succeeding multiple successful matchers stipulate sorting
+				if ( outermost && !seed && setMatched.length > 0 &&
+					( matchedCount + setMatchers.length ) > 1 ) {
+
+					Sizzle.uniqueSort( results );
+				}
+			}
+
+			// Override manipulation of globals by nested matchers
+			if ( outermost ) {
+				dirruns = dirrunsUnique;
+				outermostContext = contextBackup;
+			}
+
+			return unmatched;
+		};
+
+	return bySet ?
+		markFunction( superMatcher ) :
+		superMatcher;
+}
+
+compile = Sizzle.compile = function( selector, match /* Internal Use Only */ ) {
+	var i,
+		setMatchers = [],
+		elementMatchers = [],
+		cached = compilerCache[ selector + " " ];
+
+	if ( !cached ) {
+
+		// Generate a function of recursive functions that can be used to check each element
+		if ( !match ) {
+			match = tokenize( selector );
+		}
+		i = match.length;
+		while ( i-- ) {
+			cached = matcherFromTokens( match[ i ] );
+			if ( cached[ expando ] ) {
+				setMatchers.push( cached );
+			} else {
+				elementMatchers.push( cached );
+			}
+		}
+
+		// Cache the compiled function
+		cached = compilerCache(
+			selector,
+			matcherFromGroupMatchers( elementMatchers, setMatchers )
+		);
+
+		// Save selector and tokenization
+		cached.selector = selector;
+	}
+	return cached;
+};
+
+/**
+ * A low-level selection function that works with Sizzle's compiled
+ *  selector functions
+ * @param {String|Function} selector A selector or a pre-compiled
+ *  selector function built with Sizzle.compile
+ * @param {Element} context
+ * @param {Array} [results]
+ * @param {Array} [seed] A set of elements to match against
+ */
+select = Sizzle.select = function( selector, context, results, seed ) {
+	var i, tokens, token, type, find,
+		compiled = typeof selector === "function" && selector,
+		match = !seed && tokenize( ( selector = compiled.selector || selector ) );
+
+	results = results || [];
+
+	// Try to minimize operations if there is only one selector in the list and no seed
+	// (the latter of which guarantees us context)
+	if ( match.length === 1 ) {
+
+		// Reduce context if the leading compound selector is an ID
+		tokens = match[ 0 ] = match[ 0 ].slice( 0 );
+		if ( tokens.length > 2 && ( token = tokens[ 0 ] ).type === "ID" &&
+			context.nodeType === 9 && documentIsHTML && Expr.relative[ tokens[ 1 ].type ] ) {
+
+			context = ( Expr.find[ "ID" ]( token.matches[ 0 ]
+				.replace( runescape, funescape ), context ) || [] )[ 0 ];
+			if ( !context ) {
+				return results;
+
+			// Precompiled matchers will still verify ancestry, so step up a level
+			} else if ( compiled ) {
+				context = context.parentNode;
+			}
+
+			selector = selector.slice( tokens.shift().value.length );
+		}
+
+		// Fetch a seed set for right-to-left matching
+		i = matchExpr[ "needsContext" ].test( selector ) ? 0 : tokens.length;
+		while ( i-- ) {
+			token = tokens[ i ];
+
+			// Abort if we hit a combinator
+			if ( Expr.relative[ ( type = token.type ) ] ) {
+				break;
+			}
+			if ( ( find = Expr.find[ type ] ) ) {
+
+				// Search, expanding context for leading sibling combinators
+				if ( ( seed = find(
+					token.matches[ 0 ].replace( runescape, funescape ),
+					rsibling.test( tokens[ 0 ].type ) && testContext( context.parentNode ) ||
+						context
+				) ) ) {
+
+					// If seed is empty or no tokens remain, we can return early
+					tokens.splice( i, 1 );
+					selector = seed.length && toSelector( tokens );
+					if ( !selector ) {
+						push.apply( results, seed );
+						return results;
+					}
+
+					break;
+				}
+			}
+		}
+	}
+
+	// Compile and execute a filtering function if one is not provided
+	// Provide `match` to avoid retokenization if we modified the selector above
+	( compiled || compile( selector, match ) )(
+		seed,
+		context,
+		!documentIsHTML,
+		results,
+		!context || rsibling.test( selector ) && testContext( context.parentNode ) || context
+	);
+	return results;
+};
+
+// One-time assignments
+
+// Sort stability
+support.sortStable = expando.split( "" ).sort( sortOrder ).join( "" ) === expando;
+
+// Support: Chrome 14-35+
+// Always assume duplicates if they aren't passed to the comparison function
+support.detectDuplicates = !!hasDuplicate;
+
+// Initialize against the default document
+setDocument();
+
+// Support: Webkit<537.32 - Safari 6.0.3/Chrome 25 (fixed in Chrome 27)
+// Detached nodes confoundingly follow *each other*
+support.sortDetached = assert( function( el ) {
+
+	// Should return 1, but returns 4 (following)
+	return el.compareDocumentPosition( document.createElement( "fieldset" ) ) & 1;
+} );
+
+// Support: IE<8
+// Prevent attribute/property "interpolation"
+// https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx
+if ( !assert( function( el ) {
+	el.innerHTML = "<a href='#'></a>";
+	return el.firstChild.getAttribute( "href" ) === "#";
+} ) ) {
+	addHandle( "type|href|height|width", function( elem, name, isXML ) {
+		if ( !isXML ) {
+			return elem.getAttribute( name, name.toLowerCase() === "type" ? 1 : 2 );
+		}
+	} );
+}
+
+// Support: IE<9
+// Use defaultValue in place of getAttribute("value")
+if ( !support.attributes || !assert( function( el ) {
+	el.innerHTML = "<input/>";
+	el.firstChild.setAttribute( "value", "" );
+	return el.firstChild.getAttribute( "value" ) === "";
+} ) ) {
+	addHandle( "value", function( elem, _name, isXML ) {
+		if ( !isXML && elem.nodeName.toLowerCase() === "input" ) {
+			return elem.defaultValue;
+		}
+	} );
+}
+
+// Support: IE<9
+// Use getAttributeNode to fetch booleans when getAttribute lies
+if ( !assert( function( el ) {
+	return el.getAttribute( "disabled" ) == null;
+} ) ) {
+	addHandle( booleans, function( elem, name, isXML ) {
+		var val;
+		if ( !isXML ) {
+			return elem[ name ] === true ? name.toLowerCase() :
+				( val = elem.getAttributeNode( name ) ) && val.specified ?
+					val.value :
+					null;
+		}
+	} );
+}
+
+return Sizzle;
+
+} )( window );
+
+
+
+jQuery.find = Sizzle;
+jQuery.expr = Sizzle.selectors;
+
+// Deprecated
+jQuery.expr[ ":" ] = jQuery.expr.pseudos;
+jQuery.uniqueSort = jQuery.unique = Sizzle.uniqueSort;
+jQuery.text = Sizzle.getText;
+jQuery.isXMLDoc = Sizzle.isXML;
+jQuery.contains = Sizzle.contains;
+jQuery.escapeSelector = Sizzle.escape;
+
+
+
+
+var dir = function( elem, dir, until ) {
+	var matched = [],
+		truncate = until !== undefined;
+
+	while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) {
+		if ( elem.nodeType === 1 ) {
+			if ( truncate && jQuery( elem ).is( until ) ) {
+				break;
+			}
+			matched.push( elem );
+		}
+	}
+	return matched;
+};
+
+
+var siblings = function( n, elem ) {
+	var matched = [];
+
+	for ( ; n; n = n.nextSibling ) {
+		if ( n.nodeType === 1 && n !== elem ) {
+			matched.push( n );
+		}
+	}
+
+	return matched;
+};
+
+
+var rneedsContext = jQuery.expr.match.needsContext;
+
+
+
+function nodeName( elem, name ) {
+
+	return elem.nodeName && elem.nodeName.toLowerCase() === name.toLowerCase();
+
+}
+var rsingleTag = ( /^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i );
+
+
+
+// Implement the identical functionality for filter and not
+function winnow( elements, qualifier, not ) {
+	if ( isFunction( qualifier ) ) {
+		return jQuery.grep( elements, function( elem, i ) {
+			return !!qualifier.call( elem, i, elem ) !== not;
+		} );
+	}
+
+	// Single element
+	if ( qualifier.nodeType ) {
+		return jQuery.grep( elements, function( elem ) {
+			return ( elem === qualifier ) !== not;
+		} );
+	}
+
+	// Arraylike of elements (jQuery, arguments, Array)
+	if ( typeof qualifier !== "string" ) {
+		return jQuery.grep( elements, function( elem ) {
+			return ( indexOf.call( qualifier, elem ) > -1 ) !== not;
+		} );
+	}
+
+	// Filtered directly for both simple and complex selectors
+	return jQuery.filter( qualifier, elements, not );
+}
+
+jQuery.filter = function( expr, elems, not ) {
+	var elem = elems[ 0 ];
+
+	if ( not ) {
+		expr = ":not(" + expr + ")";
+	}
+
+	if ( elems.length === 1 && elem.nodeType === 1 ) {
+		return jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : [];
+	}
+
+	return jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) {
+		return elem.nodeType === 1;
+	} ) );
+};
+
+jQuery.fn.extend( {
+	find: function( selector ) {
+		var i, ret,
+			len = this.length,
+			self = this;
+
+		if ( typeof selector !== "string" ) {
+			return this.pushStack( jQuery( selector ).filter( function() {
+				for ( i = 0; i < len; i++ ) {
+					if ( jQuery.contains( self[ i ], this ) ) {
+						return true;
+					}
+				}
+			} ) );
+		}
+
+		ret = this.pushStack( [] );
+
+		for ( i = 0; i < len; i++ ) {
+			jQuery.find( selector, self[ i ], ret );
+		}
+
+		return len > 1 ? jQuery.uniqueSort( ret ) : ret;
+	},
+	filter: function( selector ) {
+		return this.pushStack( winnow( this, selector || [], false ) );
+	},
+	not: function( selector ) {
+		return this.pushStack( winnow( this, selector || [], true ) );
+	},
+	is: function( selector ) {
+		return !!winnow(
+			this,
+
+			// If this is a positional/relative selector, check membership in the returned set
+			// so $("p:first").is("p:last") won't return true for a doc with two "p".
+			typeof selector === "string" && rneedsContext.test( selector ) ?
+				jQuery( selector ) :
+				selector || [],
+			false
+		).length;
+	}
+} );
+
+
+// Initialize a jQuery object
+
+
+// A central reference to the root jQuery(document)
+var rootjQuery,
+
+	// A simple way to check for HTML strings
+	// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
+	// Strict HTML recognition (#11290: must start with <)
+	// Shortcut simple #id case for speed
+	rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/,
+
+	init = jQuery.fn.init = function( selector, context, root ) {
+		var match, elem;
+
+		// HANDLE: $(""), $(null), $(undefined), $(false)
+		if ( !selector ) {
+			return this;
+		}
+
+		// Method init() accepts an alternate rootjQuery
+		// so migrate can support jQuery.sub (gh-2101)
+		root = root || rootjQuery;
+
+		// Handle HTML strings
+		if ( typeof selector === "string" ) {
+			if ( selector[ 0 ] === "<" &&
+				selector[ selector.length - 1 ] === ">" &&
+				selector.length >= 3 ) {
+
+				// Assume that strings that start and end with <> are HTML and skip the regex check
+				match = [ null, selector, null ];
+
+			} else {
+				match = rquickExpr.exec( selector );
+			}
+
+			// Match html or make sure no context is specified for #id
+			if ( match && ( match[ 1 ] || !context ) ) {
+
+				// HANDLE: $(html) -> $(array)
+				if ( match[ 1 ] ) {
+					context = context instanceof jQuery ? context[ 0 ] : context;
+
+					// Option to run scripts is true for back-compat
+					// Intentionally let the error be thrown if parseHTML is not present
+					jQuery.merge( this, jQuery.parseHTML(
+						match[ 1 ],
+						context && context.nodeType ? context.ownerDocument || context : document,
+						true
+					) );
+
+					// HANDLE: $(html, props)
+					if ( rsingleTag.test( match[ 1 ] ) && jQuery.isPlainObject( context ) ) {
+						for ( match in context ) {
+
+							// Properties of context are called as methods if possible
+							if ( isFunction( this[ match ] ) ) {
+								this[ match ]( context[ match ] );
+
+							// ...and otherwise set as attributes
+							} else {
+								this.attr( match, context[ match ] );
+							}
+						}
+					}
+
+					return this;
+
+				// HANDLE: $(#id)
+				} else {
+					elem = document.getElementById( match[ 2 ] );
+
+					if ( elem ) {
+
+						// Inject the element directly into the jQuery object
+						this[ 0 ] = elem;
+						this.length = 1;
+					}
+					return this;
+				}
+
+			// HANDLE: $(expr, $(...))
+			} else if ( !context || context.jquery ) {
+				return ( context || root ).find( selector );
+
+			// HANDLE: $(expr, context)
+			// (which is just equivalent to: $(context).find(expr)
+			} else {
+				return this.constructor( context ).find( selector );
+			}
+
+		// HANDLE: $(DOMElement)
+		} else if ( selector.nodeType ) {
+			this[ 0 ] = selector;
+			this.length = 1;
+			return this;
+
+		// HANDLE: $(function)
+		// Shortcut for document ready
+		} else if ( isFunction( selector ) ) {
+			return root.ready !== undefined ?
+				root.ready( selector ) :
+
+				// Execute immediately if ready is not present
+				selector( jQuery );
+		}
+
+		return jQuery.makeArray( selector, this );
+	};
+
+// Give the init function the jQuery prototype for later instantiation
+init.prototype = jQuery.fn;
+
+// Initialize central reference
+rootjQuery = jQuery( document );
+
+
+var rparentsprev = /^(?:parents|prev(?:Until|All))/,
+
+	// Methods guaranteed to produce a unique set when starting from a unique set
+	guaranteedUnique = {
+		children: true,
+		contents: true,
+		next: true,
+		prev: true
+	};
+
+jQuery.fn.extend( {
+	has: function( target ) {
+		var targets = jQuery( target, this ),
+			l = targets.length;
+
+		return this.filter( function() {
+			var i = 0;
+			for ( ; i < l; i++ ) {
+				if ( jQuery.contains( this, targets[ i ] ) ) {
+					return true;
+				}
+			}
+		} );
+	},
+
+	closest: function( selectors, context ) {
+		var cur,
+			i = 0,
+			l = this.length,
+			matched = [],
+			targets = typeof selectors !== "string" && jQuery( selectors );
+
+		// Positional selectors never match, since there's no _selection_ context
+		if ( !rneedsContext.test( selectors ) ) {
+			for ( ; i < l; i++ ) {
+				for ( cur = this[ i ]; cur && cur !== context; cur = cur.parentNode ) {
+
+					// Always skip document fragments
+					if ( cur.nodeType < 11 && ( targets ?
+						targets.index( cur ) > -1 :
+
+						// Don't pass non-elements to Sizzle
+						cur.nodeType === 1 &&
+							jQuery.find.matchesSelector( cur, selectors ) ) ) {
+
+						matched.push( cur );
+						break;
+					}
+				}
+			}
+		}
+
+		return this.pushStack( matched.length > 1 ? jQuery.uniqueSort( matched ) : matched );
+	},
+
+	// Determine the position of an element within the set
+	index: function( elem ) {
+
+		// No argument, return index in parent
+		if ( !elem ) {
+			return ( this[ 0 ] && this[ 0 ].parentNode ) ? this.first().prevAll().length : -1;
+		}
+
+		// Index in selector
+		if ( typeof elem === "string" ) {
+			return indexOf.call( jQuery( elem ), this[ 0 ] );
+		}
+
+		// Locate the position of the desired element
+		return indexOf.call( this,
+
+			// If it receives a jQuery object, the first element is used
+			elem.jquery ? elem[ 0 ] : elem
+		);
+	},
+
+	add: function( selector, context ) {
+		return this.pushStack(
+			jQuery.uniqueSort(
+				jQuery.merge( this.get(), jQuery( selector, context ) )
+			)
+		);
+	},
+
+	addBack: function( selector ) {
+		return this.add( selector == null ?
+			this.prevObject : this.prevObject.filter( selector )
+		);
+	}
+} );
+
+function sibling( cur, dir ) {
+	while ( ( cur = cur[ dir ] ) && cur.nodeType !== 1 ) {}
+	return cur;
+}
+
+jQuery.each( {
+	parent: function( elem ) {
+		var parent = elem.parentNode;
+		return parent && parent.nodeType !== 11 ? parent : null;
+	},
+	parents: function( elem ) {
+		return dir( elem, "parentNode" );
+	},
+	parentsUntil: function( elem, _i, until ) {
+		return dir( elem, "parentNode", until );
+	},
+	next: function( elem ) {
+		return sibling( elem, "nextSibling" );
+	},
+	prev: function( elem ) {
+		return sibling( elem, "previousSibling" );
+	},
+	nextAll: function( elem ) {
+		return dir( elem, "nextSibling" );
+	},
+	prevAll: function( elem ) {
+		return dir( elem, "previousSibling" );
+	},
+	nextUntil: function( elem, _i, until ) {
+		return dir( elem, "nextSibling", until );
+	},
+	prevUntil: function( elem, _i, until ) {
+		return dir( elem, "previousSibling", until );
+	},
+	siblings: function( elem ) {
+		return siblings( ( elem.parentNode || {} ).firstChild, elem );
+	},
+	children: function( elem ) {
+		return siblings( elem.firstChild );
+	},
+	contents: function( elem ) {
+		if ( elem.contentDocument != null &&
+
+			// Support: IE 11+
+			// <object> elements with no `data` attribute has an object
+			// `contentDocument` with a `null` prototype.
+			getProto( elem.contentDocument ) ) {
+
+			return elem.contentDocument;
+		}
+
+		// Support: IE 9 - 11 only, iOS 7 only, Android Browser <=4.3 only
+		// Treat the template element as a regular one in browsers that
+		// don't support it.
+		if ( nodeName( elem, "template" ) ) {
+			elem = elem.content || elem;
+		}
+
+		return jQuery.merge( [], elem.childNodes );
+	}
+}, function( name, fn ) {
+	jQuery.fn[ name ] = function( until, selector ) {
+		var matched = jQuery.map( this, fn, until );
+
+		if ( name.slice( -5 ) !== "Until" ) {
+			selector = until;
+		}
+
+		if ( selector && typeof selector === "string" ) {
+			matched = jQuery.filter( selector, matched );
+		}
+
+		if ( this.length > 1 ) {
+
+			// Remove duplicates
+			if ( !guaranteedUnique[ name ] ) {
+				jQuery.uniqueSort( matched );
+			}
+
+			// Reverse order for parents* and prev-derivatives
+			if ( rparentsprev.test( name ) ) {
+				matched.reverse();
+			}
+		}
+
+		return this.pushStack( matched );
+	};
+} );
+var rnothtmlwhite = ( /[^\x20\t\r\n\f]+/g );
+
+
+
+// Convert String-formatted options into Object-formatted ones
+function createOptions( options ) {
+	var object = {};
+	jQuery.each( options.match( rnothtmlwhite ) || [], function( _, flag ) {
+		object[ flag ] = true;
+	} );
+	return object;
+}
+
+/*
+ * Create a callback list using the following parameters:
+ *
+ *	options: an optional list of space-separated options that will change how
+ *			the callback list behaves or a more traditional option object
+ *
+ * By default a callback list will act like an event callback list and can be
+ * "fired" multiple times.
+ *
+ * Possible options:
+ *
+ *	once:			will ensure the callback list can only be fired once (like a Deferred)
+ *
+ *	memory:			will keep track of previous values and will call any callback added
+ *					after the list has been fired right away with the latest "memorized"
+ *					values (like a Deferred)
+ *
+ *	unique:			will ensure a callback can only be added once (no duplicate in the list)
+ *
+ *	stopOnFalse:	interrupt callings when a callback returns false
+ *
+ */
+jQuery.Callbacks = function( options ) {
+
+	// Convert options from String-formatted to Object-formatted if needed
+	// (we check in cache first)
+	options = typeof options === "string" ?
+		createOptions( options ) :
+		jQuery.extend( {}, options );
+
+	var // Flag to know if list is currently firing
+		firing,
+
+		// Last fire value for non-forgettable lists
+		memory,
+
+		// Flag to know if list was already fired
+		fired,
+
+		// Flag to prevent firing
+		locked,
+
+		// Actual callback list
+		list = [],
+
+		// Queue of execution data for repeatable lists
+		queue = [],
+
+		// Index of currently firing callback (modified by add/remove as needed)
+		firingIndex = -1,
+
+		// Fire callbacks
+		fire = function() {
+
+			// Enforce single-firing
+			locked = locked || options.once;
+
+			// Execute callbacks for all pending executions,
+			// respecting firingIndex overrides and runtime changes
+			fired = firing = true;
+			for ( ; queue.length; firingIndex = -1 ) {
+				memory = queue.shift();
+				while ( ++firingIndex < list.length ) {
+
+					// Run callback and check for early termination
+					if ( list[ firingIndex ].apply( memory[ 0 ], memory[ 1 ] ) === false &&
+						options.stopOnFalse ) {
+
+						// Jump to end and forget the data so .add doesn't re-fire
+						firingIndex = list.length;
+						memory = false;
+					}
+				}
+			}
+
+			// Forget the data if we're done with it
+			if ( !options.memory ) {
+				memory = false;
+			}
+
+			firing = false;
+
+			// Clean up if we're done firing for good
+			if ( locked ) {
+
+				// Keep an empty list if we have data for future add calls
+				if ( memory ) {
+					list = [];
+
+				// Otherwise, this object is spent
+				} else {
+					list = "";
+				}
+			}
+		},
+
+		// Actual Callbacks object
+		self = {
+
+			// Add a callback or a collection of callbacks to the list
+			add: function() {
+				if ( list ) {
+
+					// If we have memory from a past run, we should fire after adding
+					if ( memory && !firing ) {
+						firingIndex = list.length - 1;
+						queue.push( memory );
+					}
+
+					( function add( args ) {
+						jQuery.each( args, function( _, arg ) {
+							if ( isFunction( arg ) ) {
+								if ( !options.unique || !self.has( arg ) ) {
+									list.push( arg );
+								}
+							} else if ( arg && arg.length && toType( arg ) !== "string" ) {
+
+								// Inspect recursively
+								add( arg );
+							}
+						} );
+					} )( arguments );
+
+					if ( memory && !firing ) {
+						fire();
+					}
+				}
+				return this;
+			},
+
+			// Remove a callback from the list
+			remove: function() {
+				jQuery.each( arguments, function( _, arg ) {
+					var index;
+					while ( ( index = jQuery.inArray( arg, list, index ) ) > -1 ) {
+						list.splice( index, 1 );
+
+						// Handle firing indexes
+						if ( index <= firingIndex ) {
+							firingIndex--;
+						}
+					}
+				} );
+				return this;
+			},
+
+			// Check if a given callback is in the list.
+			// If no argument is given, return whether or not list has callbacks attached.
+			has: function( fn ) {
+				return fn ?
+					jQuery.inArray( fn, list ) > -1 :
+					list.length > 0;
+			},
+
+			// Remove all callbacks from the list
+			empty: function() {
+				if ( list ) {
+					list = [];
+				}
+				return this;
+			},
+
+			// Disable .fire and .add
+			// Abort any current/pending executions
+			// Clear all callbacks and values
+			disable: function() {
+				locked = queue = [];
+				list = memory = "";
+				return this;
+			},
+			disabled: function() {
+				return !list;
+			},
+
+			// Disable .fire
+			// Also disable .add unless we have memory (since it would have no effect)
+			// Abort any pending executions
+			lock: function() {
+				locked = queue = [];
+				if ( !memory && !firing ) {
+					list = memory = "";
+				}
+				return this;
+			},
+			locked: function() {
+				return !!locked;
+			},
+
+			// Call all callbacks with the given context and arguments
+			fireWith: function( context, args ) {
+				if ( !locked ) {
+					args = args || [];
+					args = [ context, args.slice ? args.slice() : args ];
+					queue.push( args );
+					if ( !firing ) {
+						fire();
+					}
+				}
+				return this;
+			},
+
+			// Call all the callbacks with the given arguments
+			fire: function() {
+				self.fireWith( this, arguments );
+				return this;
+			},
+
+			// To know if the callbacks have already been called at least once
+			fired: function() {
+				return !!fired;
+			}
+		};
+
+	return self;
+};
+
+
+function Identity( v ) {
+	return v;
+}
+function Thrower( ex ) {
+	throw ex;
+}
+
+function adoptValue( value, resolve, reject, noValue ) {
+	var method;
+
+	try {
+
+		// Check for promise aspect first to privilege synchronous behavior
+		if ( value && isFunction( ( method = value.promise ) ) ) {
+			method.call( value ).done( resolve ).fail( reject );
+
+		// Other thenables
+		} else if ( value && isFunction( ( method = value.then ) ) ) {
+			method.call( value, resolve, reject );
+
+		// Other non-thenables
+		} else {
+
+			// Control `resolve` arguments by letting Array#slice cast boolean `noValue` to integer:
+			// * false: [ value ].slice( 0 ) => resolve( value )
+			// * true: [ value ].slice( 1 ) => resolve()
+			resolve.apply( undefined, [ value ].slice( noValue ) );
+		}
+
+	// For Promises/A+, convert exceptions into rejections
+	// Since jQuery.when doesn't unwrap thenables, we can skip the extra checks appearing in
+	// Deferred#then to conditionally suppress rejection.
+	} catch ( value ) {
+
+		// Support: Android 4.0 only
+		// Strict mode functions invoked without .call/.apply get global-object context
+		reject.apply( undefined, [ value ] );
+	}
+}
+
+jQuery.extend( {
+
+	Deferred: function( func ) {
+		var tuples = [
+
+				// action, add listener, callbacks,
+				// ... .then handlers, argument index, [final state]
+				[ "notify", "progress", jQuery.Callbacks( "memory" ),
+					jQuery.Callbacks( "memory" ), 2 ],
+				[ "resolve", "done", jQuery.Callbacks( "once memory" ),
+					jQuery.Callbacks( "once memory" ), 0, "resolved" ],
+				[ "reject", "fail", jQuery.Callbacks( "once memory" ),
+					jQuery.Callbacks( "once memory" ), 1, "rejected" ]
+			],
+			state = "pending",
+			promise = {
+				state: function() {
+					return state;
+				},
+				always: function() {
+					deferred.done( arguments ).fail( arguments );
+					return this;
+				},
+				"catch": function( fn ) {
+					return promise.then( null, fn );
+				},
+
+				// Keep pipe for back-compat
+				pipe: function( /* fnDone, fnFail, fnProgress */ ) {
+					var fns = arguments;
+
+					return jQuery.Deferred( function( newDefer ) {
+						jQuery.each( tuples, function( _i, tuple ) {
+
+							// Map tuples (progress, done, fail) to arguments (done, fail, progress)
+							var fn = isFunction( fns[ tuple[ 4 ] ] ) && fns[ tuple[ 4 ] ];
+
+							// deferred.progress(function() { bind to newDefer or newDefer.notify })
+							// deferred.done(function() { bind to newDefer or newDefer.resolve })
+							// deferred.fail(function() { bind to newDefer or newDefer.reject })
+							deferred[ tuple[ 1 ] ]( function() {
+								var returned = fn && fn.apply( this, arguments );
+								if ( returned && isFunction( returned.promise ) ) {
+									returned.promise()
+										.progress( newDefer.notify )
+										.done( newDefer.resolve )
+										.fail( newDefer.reject );
+								} else {
+									newDefer[ tuple[ 0 ] + "With" ](
+										this,
+										fn ? [ returned ] : arguments
+									);
+								}
+							} );
+						} );
+						fns = null;
+					} ).promise();
+				},
+				then: function( onFulfilled, onRejected, onProgress ) {
+					var maxDepth = 0;
+					function resolve( depth, deferred, handler, special ) {
+						return function() {
+							var that = this,
+								args = arguments,
+								mightThrow = function() {
+									var returned, then;
+
+									// Support: Promises/A+ section 2.3.3.3.3
+									// https://promisesaplus.com/#point-59
+									// Ignore double-resolution attempts
+									if ( depth < maxDepth ) {
+										return;
+									}
+
+									returned = handler.apply( that, args );
+
+									// Support: Promises/A+ section 2.3.1
+									// https://promisesaplus.com/#point-48
+									if ( returned === deferred.promise() ) {
+										throw new TypeError( "Thenable self-resolution" );
+									}
+
+									// Support: Promises/A+ sections 2.3.3.1, 3.5
+									// https://promisesaplus.com/#point-54
+									// https://promisesaplus.com/#point-75
+									// Retrieve `then` only once
+									then = returned &&
+
+										// Support: Promises/A+ section 2.3.4
+										// https://promisesaplus.com/#point-64
+										// Only check objects and functions for thenability
+										( typeof returned === "object" ||
+											typeof returned === "function" ) &&
+										returned.then;
+
+									// Handle a returned thenable
+									if ( isFunction( then ) ) {
+
+										// Special processors (notify) just wait for resolution
+										if ( special ) {
+											then.call(
+												returned,
+												resolve( maxDepth, deferred, Identity, special ),
+												resolve( maxDepth, deferred, Thrower, special )
+											);
+
+										// Normal processors (resolve) also hook into progress
+										} else {
+
+											// ...and disregard older resolution values
+											maxDepth++;
+
+											then.call(
+												returned,
+												resolve( maxDepth, deferred, Identity, special ),
+												resolve( maxDepth, deferred, Thrower, special ),
+												resolve( maxDepth, deferred, Identity,
+													deferred.notifyWith )
+											);
+										}
+
+									// Handle all other returned values
+									} else {
+
+										// Only substitute handlers pass on context
+										// and multiple values (non-spec behavior)
+										if ( handler !== Identity ) {
+											that = undefined;
+											args = [ returned ];
+										}
+
+										// Process the value(s)
+										// Default process is resolve
+										( special || deferred.resolveWith )( that, args );
+									}
+								},
+
+								// Only normal processors (resolve) catch and reject exceptions
+								process = special ?
+									mightThrow :
+									function() {
+										try {
+											mightThrow();
+										} catch ( e ) {
+
+											if ( jQuery.Deferred.exceptionHook ) {
+												jQuery.Deferred.exceptionHook( e,
+													process.stackTrace );
+											}
+
+											// Support: Promises/A+ section 2.3.3.3.4.1
+											// https://promisesaplus.com/#point-61
+											// Ignore post-resolution exceptions
+											if ( depth + 1 >= maxDepth ) {
+
+												// Only substitute handlers pass on context
+												// and multiple values (non-spec behavior)
+												if ( handler !== Thrower ) {
+													that = undefined;
+													args = [ e ];
+												}
+
+												deferred.rejectWith( that, args );
+											}
+										}
+									};
+
+							// Support: Promises/A+ section 2.3.3.3.1
+							// https://promisesaplus.com/#point-57
+							// Re-resolve promises immediately to dodge false rejection from
+							// subsequent errors
+							if ( depth ) {
+								process();
+							} else {
+
+								// Call an optional hook to record the stack, in case of exception
+								// since it's otherwise lost when execution goes async
+								if ( jQuery.Deferred.getStackHook ) {
+									process.stackTrace = jQuery.Deferred.getStackHook();
+								}
+								window.setTimeout( process );
+							}
+						};
+					}
+
+					return jQuery.Deferred( function( newDefer ) {
+
+						// progress_handlers.add( ... )
+						tuples[ 0 ][ 3 ].add(
+							resolve(
+								0,
+								newDefer,
+								isFunction( onProgress ) ?
+									onProgress :
+									Identity,
+								newDefer.notifyWith
+							)
+						);
+
+						// fulfilled_handlers.add( ... )
+						tuples[ 1 ][ 3 ].add(
+							resolve(
+								0,
+								newDefer,
+								isFunction( onFulfilled ) ?
+									onFulfilled :
+									Identity
+							)
+						);
+
+						// rejected_handlers.add( ... )
+						tuples[ 2 ][ 3 ].add(
+							resolve(
+								0,
+								newDefer,
+								isFunction( onRejected ) ?
+									onRejected :
+									Thrower
+							)
+						);
+					} ).promise();
+				},
+
+				// Get a promise for this deferred
+				// If obj is provided, the promise aspect is added to the object
+				promise: function( obj ) {
+					return obj != null ? jQuery.extend( obj, promise ) : promise;
+				}
+			},
+			deferred = {};
+
+		// Add list-specific methods
+		jQuery.each( tuples, function( i, tuple ) {
+			var list = tuple[ 2 ],
+				stateString = tuple[ 5 ];
+
+			// promise.progress = list.add
+			// promise.done = list.add
+			// promise.fail = list.add
+			promise[ tuple[ 1 ] ] = list.add;
+
+			// Handle state
+			if ( stateString ) {
+				list.add(
+					function() {
+
+						// state = "resolved" (i.e., fulfilled)
+						// state = "rejected"
+						state = stateString;
+					},
+
+					// rejected_callbacks.disable
+					// fulfilled_callbacks.disable
+					tuples[ 3 - i ][ 2 ].disable,
+
+					// rejected_handlers.disable
+					// fulfilled_handlers.disable
+					tuples[ 3 - i ][ 3 ].disable,
+
+					// progress_callbacks.lock
+					tuples[ 0 ][ 2 ].lock,
+
+					// progress_handlers.lock
+					tuples[ 0 ][ 3 ].lock
+				);
+			}
+
+			// progress_handlers.fire
+			// fulfilled_handlers.fire
+			// rejected_handlers.fire
+			list.add( tuple[ 3 ].fire );
+
+			// deferred.notify = function() { deferred.notifyWith(...) }
+			// deferred.resolve = function() { deferred.resolveWith(...) }
+			// deferred.reject = function() { deferred.rejectWith(...) }
+			deferred[ tuple[ 0 ] ] = function() {
+				deferred[ tuple[ 0 ] + "With" ]( this === deferred ? undefined : this, arguments );
+				return this;
+			};
+
+			// deferred.notifyWith = list.fireWith
+			// deferred.resolveWith = list.fireWith
+			// deferred.rejectWith = list.fireWith
+			deferred[ tuple[ 0 ] + "With" ] = list.fireWith;
+		} );
+
+		// Make the deferred a promise
+		promise.promise( deferred );
+
+		// Call given func if any
+		if ( func ) {
+			func.call( deferred, deferred );
+		}
+
+		// All done!
+		return deferred;
+	},
+
+	// Deferred helper
+	when: function( singleValue ) {
+		var
+
+			// count of uncompleted subordinates
+			remaining = arguments.length,
+
+			// count of unprocessed arguments
+			i = remaining,
+
+			// subordinate fulfillment data
+			resolveContexts = Array( i ),
+			resolveValues = slice.call( arguments ),
+
+			// the primary Deferred
+			primary = jQuery.Deferred(),
+
+			// subordinate callback factory
+			updateFunc = function( i ) {
+				return function( value ) {
+					resolveContexts[ i ] = this;
+					resolveValues[ i ] = arguments.length > 1 ? slice.call( arguments ) : value;
+					if ( !( --remaining ) ) {
+						primary.resolveWith( resolveContexts, resolveValues );
+					}
+				};
+			};
+
+		// Single- and empty arguments are adopted like Promise.resolve
+		if ( remaining <= 1 ) {
+			adoptValue( singleValue, primary.done( updateFunc( i ) ).resolve, primary.reject,
+				!remaining );
+
+			// Use .then() to unwrap secondary thenables (cf. gh-3000)
+			if ( primary.state() === "pending" ||
+				isFunction( resolveValues[ i ] && resolveValues[ i ].then ) ) {
+
+				return primary.then();
+			}
+		}
+
+		// Multiple arguments are aggregated like Promise.all array elements
+		while ( i-- ) {
+			adoptValue( resolveValues[ i ], updateFunc( i ), primary.reject );
+		}
+
+		return primary.promise();
+	}
+} );
+
+
+// These usually indicate a programmer mistake during development,
+// warn about them ASAP rather than swallowing them by default.
+var rerrorNames = /^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;
+
+jQuery.Deferred.exceptionHook = function( error, stack ) {
+
+	// Support: IE 8 - 9 only
+	// Console exists when dev tools are open, which can happen at any time
+	if ( window.console && window.console.warn && error && rerrorNames.test( error.name ) ) {
+		window.console.warn( "jQuery.Deferred exception: " + error.message, error.stack, stack );
+	}
+};
+
+
+
+
+jQuery.readyException = function( error ) {
+	window.setTimeout( function() {
+		throw error;
+	} );
+};
+
+
+
+
+// The deferred used on DOM ready
+var readyList = jQuery.Deferred();
+
+jQuery.fn.ready = function( fn ) {
+
+	readyList
+		.then( fn )
+
+		// Wrap jQuery.readyException in a function so that the lookup
+		// happens at the time of error handling instead of callback
+		// registration.
+		.catch( function( error ) {
+			jQuery.readyException( error );
+		} );
+
+	return this;
+};
+
+jQuery.extend( {
+
+	// Is the DOM ready to be used? Set to true once it occurs.
+	isReady: false,
+
+	// A counter to track how many items to wait for before
+	// the ready event fires. See #6781
+	readyWait: 1,
+
+	// Handle when the DOM is ready
+	ready: function( wait ) {
+
+		// Abort if there are pending holds or we're already ready
+		if ( wait === true ? --jQuery.readyWait : jQuery.isReady ) {
+			return;
+		}
+
+		// Remember that the DOM is ready
+		jQuery.isReady = true;
+
+		// If a normal DOM Ready event fired, decrement, and wait if need be
+		if ( wait !== true && --jQuery.readyWait > 0 ) {
+			return;
+		}
+
+		// If there are functions bound, to execute
+		readyList.resolveWith( document, [ jQuery ] );
+	}
+} );
+
+jQuery.ready.then = readyList.then;
+
+// The ready event handler and self cleanup method
+function completed() {
+	document.removeEventListener( "DOMContentLoaded", completed );
+	window.removeEventListener( "load", completed );
+	jQuery.ready();
+}
+
+// Catch cases where $(document).ready() is called
+// after the browser event has already occurred.
+// Support: IE <=9 - 10 only
+// Older IE sometimes signals "interactive" too soon
+if ( document.readyState === "complete" ||
+	( document.readyState !== "loading" && !document.documentElement.doScroll ) ) {
+
+	// Handle it asynchronously to allow scripts the opportunity to delay ready
+	window.setTimeout( jQuery.ready );
+
+} else {
+
+	// Use the handy event callback
+	document.addEventListener( "DOMContentLoaded", completed );
+
+	// A fallback to window.onload, that will always work
+	window.addEventListener( "load", completed );
+}
+
+
+
+
+// Multifunctional method to get and set values of a collection
+// The value/s can optionally be executed if it's a function
+var access = function( elems, fn, key, value, chainable, emptyGet, raw ) {
+	var i = 0,
+		len = elems.length,
+		bulk = key == null;
+
+	// Sets many values
+	if ( toType( key ) === "object" ) {
+		chainable = true;
+		for ( i in key ) {
+			access( elems, fn, i, key[ i ], true, emptyGet, raw );
+		}
+
+	// Sets one value
+	} else if ( value !== undefined ) {
+		chainable = true;
+
+		if ( !isFunction( value ) ) {
+			raw = true;
+		}
+
+		if ( bulk ) {
+
+			// Bulk operations run against the entire set
+			if ( raw ) {
+				fn.call( elems, value );
+				fn = null;
+
+			// ...except when executing function values
+			} else {
+				bulk = fn;
+				fn = function( elem, _key, value ) {
+					return bulk.call( jQuery( elem ), value );
+				};
+			}
+		}
+
+		if ( fn ) {
+			for ( ; i < len; i++ ) {
+				fn(
+					elems[ i ], key, raw ?
+						value :
+						value.call( elems[ i ], i, fn( elems[ i ], key ) )
+				);
+			}
+		}
+	}
+
+	if ( chainable ) {
+		return elems;
+	}
+
+	// Gets
+	if ( bulk ) {
+		return fn.call( elems );
+	}
+
+	return len ? fn( elems[ 0 ], key ) : emptyGet;
+};
+
+
+// Matches dashed string for camelizing
+var rmsPrefix = /^-ms-/,
+	rdashAlpha = /-([a-z])/g;
+
+// Used by camelCase as callback to replace()
+function fcamelCase( _all, letter ) {
+	return letter.toUpperCase();
+}
+
+// Convert dashed to camelCase; used by the css and data modules
+// Support: IE <=9 - 11, Edge 12 - 15
+// Microsoft forgot to hump their vendor prefix (#9572)
+function camelCase( string ) {
+	return string.replace( rmsPrefix, "ms-" ).replace( rdashAlpha, fcamelCase );
+}
+var acceptData = function( owner ) {
+
+	// Accepts only:
+	//  - Node
+	//    - Node.ELEMENT_NODE
+	//    - Node.DOCUMENT_NODE
+	//  - Object
+	//    - Any
+	return owner.nodeType === 1 || owner.nodeType === 9 || !( +owner.nodeType );
+};
+
+
+
+
+function Data() {
+	this.expando = jQuery.expando + Data.uid++;
+}
+
+Data.uid = 1;
+
+Data.prototype = {
+
+	cache: function( owner ) {
+
+		// Check if the owner object already has a cache
+		var value = owner[ this.expando ];
+
+		// If not, create one
+		if ( !value ) {
+			value = {};
+
+			// We can accept data for non-element nodes in modern browsers,
+			// but we should not, see #8335.
+			// Always return an empty object.
+			if ( acceptData( owner ) ) {
+
+				// If it is a node unlikely to be stringify-ed or looped over
+				// use plain assignment
+				if ( owner.nodeType ) {
+					owner[ this.expando ] = value;
+
+				// Otherwise secure it in a non-enumerable property
+				// configurable must be true to allow the property to be
+				// deleted when data is removed
+				} else {
+					Object.defineProperty( owner, this.expando, {
+						value: value,
+						configurable: true
+					} );
+				}
+			}
+		}
+
+		return value;
+	},
+	set: function( owner, data, value ) {
+		var prop,
+			cache = this.cache( owner );
+
+		// Handle: [ owner, key, value ] args
+		// Always use camelCase key (gh-2257)
+		if ( typeof data === "string" ) {
+			cache[ camelCase( data ) ] = value;
+
+		// Handle: [ owner, { properties } ] args
+		} else {
+
+			// Copy the properties one-by-one to the cache object
+			for ( prop in data ) {
+				cache[ camelCase( prop ) ] = data[ prop ];
+			}
+		}
+		return cache;
+	},
+	get: function( owner, key ) {
+		return key === undefined ?
+			this.cache( owner ) :
+
+			// Always use camelCase key (gh-2257)
+			owner[ this.expando ] && owner[ this.expando ][ camelCase( key ) ];
+	},
+	access: function( owner, key, value ) {
+
+		// In cases where either:
+		//
+		//   1. No key was specified
+		//   2. A string key was specified, but no value provided
+		//
+		// Take the "read" path and allow the get method to determine
+		// which value to return, respectively either:
+		//
+		//   1. The entire cache object
+		//   2. The data stored at the key
+		//
+		if ( key === undefined ||
+				( ( key && typeof key === "string" ) && value === undefined ) ) {
+
+			return this.get( owner, key );
+		}
+
+		// When the key is not a string, or both a key and value
+		// are specified, set or extend (existing objects) with either:
+		//
+		//   1. An object of properties
+		//   2. A key and value
+		//
+		this.set( owner, key, value );
+
+		// Since the "set" path can have two possible entry points
+		// return the expected data based on which path was taken[*]
+		return value !== undefined ? value : key;
+	},
+	remove: function( owner, key ) {
+		var i,
+			cache = owner[ this.expando ];
+
+		if ( cache === undefined ) {
+			return;
+		}
+
+		if ( key !== undefined ) {
+
+			// Support array or space separated string of keys
+			if ( Array.isArray( key ) ) {
+
+				// If key is an array of keys...
+				// We always set camelCase keys, so remove that.
+				key = key.map( camelCase );
+			} else {
+				key = camelCase( key );
+
+				// If a key with the spaces exists, use it.
+				// Otherwise, create an array by matching non-whitespace
+				key = key in cache ?
+					[ key ] :
+					( key.match( rnothtmlwhite ) || [] );
+			}
+
+			i = key.length;
+
+			while ( i-- ) {
+				delete cache[ key[ i ] ];
+			}
+		}
+
+		// Remove the expando if there's no more data
+		if ( key === undefined || jQuery.isEmptyObject( cache ) ) {
+
+			// Support: Chrome <=35 - 45
+			// Webkit & Blink performance suffers when deleting properties
+			// from DOM nodes, so set to undefined instead
+			// https://bugs.chromium.org/p/chromium/issues/detail?id=378607 (bug restricted)
+			if ( owner.nodeType ) {
+				owner[ this.expando ] = undefined;
+			} else {
+				delete owner[ this.expando ];
+			}
+		}
+	},
+	hasData: function( owner ) {
+		var cache = owner[ this.expando ];
+		return cache !== undefined && !jQuery.isEmptyObject( cache );
+	}
+};
+var dataPriv = new Data();
+
+var dataUser = new Data();
+
+
+
+//	Implementation Summary
+//
+//	1. Enforce API surface and semantic compatibility with 1.9.x branch
+//	2. Improve the module's maintainability by reducing the storage
+//		paths to a single mechanism.
+//	3. Use the same single mechanism to support "private" and "user" data.
+//	4. _Never_ expose "private" data to user code (TODO: Drop _data, _removeData)
+//	5. Avoid exposing implementation details on user objects (eg. expando properties)
+//	6. Provide a clear path for implementation upgrade to WeakMap in 2014
+
+var rbrace = /^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,
+	rmultiDash = /[A-Z]/g;
+
+function getData( data ) {
+	if ( data === "true" ) {
+		return true;
+	}
+
+	if ( data === "false" ) {
+		return false;
+	}
+
+	if ( data === "null" ) {
+		return null;
+	}
+
+	// Only convert to a number if it doesn't change the string
+	if ( data === +data + "" ) {
+		return +data;
+	}
+
+	if ( rbrace.test( data ) ) {
+		return JSON.parse( data );
+	}
+
+	return data;
+}
+
+function dataAttr( elem, key, data ) {
+	var name;
+
+	// If nothing was found internally, try to fetch any
+	// data from the HTML5 data-* attribute
+	if ( data === undefined && elem.nodeType === 1 ) {
+		name = "data-" + key.replace( rmultiDash, "-$&" ).toLowerCase();
+		data = elem.getAttribute( name );
+
+		if ( typeof data === "string" ) {
+			try {
+				data = getData( data );
+			} catch ( e ) {}
+
+			// Make sure we set the data so it isn't changed later
+			dataUser.set( elem, key, data );
+		} else {
+			data = undefined;
+		}
+	}
+	return data;
+}
+
+jQuery.extend( {
+	hasData: function( elem ) {
+		return dataUser.hasData( elem ) || dataPriv.hasData( elem );
+	},
+
+	data: function( elem, name, data ) {
+		return dataUser.access( elem, name, data );
+	},
+
+	removeData: function( elem, name ) {
+		dataUser.remove( elem, name );
+	},
+
+	// TODO: Now that all calls to _data and _removeData have been replaced
+	// with direct calls to dataPriv methods, these can be deprecated.
+	_data: function( elem, name, data ) {
+		return dataPriv.access( elem, name, data );
+	},
+
+	_removeData: function( elem, name ) {
+		dataPriv.remove( elem, name );
+	}
+} );
+
+jQuery.fn.extend( {
+	data: function( key, value ) {
+		var i, name, data,
+			elem = this[ 0 ],
+			attrs = elem && elem.attributes;
+
+		// Gets all values
+		if ( key === undefined ) {
+			if ( this.length ) {
+				data = dataUser.get( elem );
+
+				if ( elem.nodeType === 1 && !dataPriv.get( elem, "hasDataAttrs" ) ) {
+					i = attrs.length;
+					while ( i-- ) {
+
+						// Support: IE 11 only
+						// The attrs elements can be null (#14894)
+						if ( attrs[ i ] ) {
+							name = attrs[ i ].name;
+							if ( name.indexOf( "data-" ) === 0 ) {
+								name = camelCase( name.slice( 5 ) );
+								dataAttr( elem, name, data[ name ] );
+							}
+						}
+					}
+					dataPriv.set( elem, "hasDataAttrs", true );
+				}
+			}
+
+			return data;
+		}
+
+		// Sets multiple values
+		if ( typeof key === "object" ) {
+			return this.each( function() {
+				dataUser.set( this, key );
+			} );
+		}
+
+		return access( this, function( value ) {
+			var data;
+
+			// The calling jQuery object (element matches) is not empty
+			// (and therefore has an element appears at this[ 0 ]) and the
+			// `value` parameter was not undefined. An empty jQuery object
+			// will result in `undefined` for elem = this[ 0 ] which will
+			// throw an exception if an attempt to read a data cache is made.
+			if ( elem && value === undefined ) {
+
+				// Attempt to get data from the cache
+				// The key will always be camelCased in Data
+				data = dataUser.get( elem, key );
+				if ( data !== undefined ) {
+					return data;
+				}
+
+				// Attempt to "discover" the data in
+				// HTML5 custom data-* attrs
+				data = dataAttr( elem, key );
+				if ( data !== undefined ) {
+					return data;
+				}
+
+				// We tried really hard, but the data doesn't exist.
+				return;
+			}
+
+			// Set the data...
+			this.each( function() {
+
+				// We always store the camelCased key
+				dataUser.set( this, key, value );
+			} );
+		}, null, value, arguments.length > 1, null, true );
+	},
+
+	removeData: function( key ) {
+		return this.each( function() {
+			dataUser.remove( this, key );
+		} );
+	}
+} );
+
+
+jQuery.extend( {
+	queue: function( elem, type, data ) {
+		var queue;
+
+		if ( elem ) {
+			type = ( type || "fx" ) + "queue";
+			queue = dataPriv.get( elem, type );
+
+			// Speed up dequeue by getting out quickly if this is just a lookup
+			if ( data ) {
+				if ( !queue || Array.isArray( data ) ) {
+					queue = dataPriv.access( elem, type, jQuery.makeArray( data ) );
+				} else {
+					queue.push( data );
+				}
+			}
+			return queue || [];
+		}
+	},
+
+	dequeue: function( elem, type ) {
+		type = type || "fx";
+
+		var queue = jQuery.queue( elem, type ),
+			startLength = queue.length,
+			fn = queue.shift(),
+			hooks = jQuery._queueHooks( elem, type ),
+			next = function() {
+				jQuery.dequeue( elem, type );
+			};
+
+		// If the fx queue is dequeued, always remove the progress sentinel
+		if ( fn === "inprogress" ) {
+			fn = queue.shift();
+			startLength--;
+		}
+
+		if ( fn ) {
+
+			// Add a progress sentinel to prevent the fx queue from being
+			// automatically dequeued
+			if ( type === "fx" ) {
+				queue.unshift( "inprogress" );
+			}
+
+			// Clear up the last queue stop function
+			delete hooks.stop;
+			fn.call( elem, next, hooks );
+		}
+
+		if ( !startLength && hooks ) {
+			hooks.empty.fire();
+		}
+	},
+
+	// Not public - generate a queueHooks object, or return the current one
+	_queueHooks: function( elem, type ) {
+		var key = type + "queueHooks";
+		return dataPriv.get( elem, key ) || dataPriv.access( elem, key, {
+			empty: jQuery.Callbacks( "once memory" ).add( function() {
+				dataPriv.remove( elem, [ type + "queue", key ] );
+			} )
+		} );
+	}
+} );
+
+jQuery.fn.extend( {
+	queue: function( type, data ) {
+		var setter = 2;
+
+		if ( typeof type !== "string" ) {
+			data = type;
+			type = "fx";
+			setter--;
+		}
+
+		if ( arguments.length < setter ) {
+			return jQuery.queue( this[ 0 ], type );
+		}
+
+		return data === undefined ?
+			this :
+			this.each( function() {
+				var queue = jQuery.queue( this, type, data );
+
+				// Ensure a hooks for this queue
+				jQuery._queueHooks( this, type );
+
+				if ( type === "fx" && queue[ 0 ] !== "inprogress" ) {
+					jQuery.dequeue( this, type );
+				}
+			} );
+	},
+	dequeue: function( type ) {
+		return this.each( function() {
+			jQuery.dequeue( this, type );
+		} );
+	},
+	clearQueue: function( type ) {
+		return this.queue( type || "fx", [] );
+	},
+
+	// Get a promise resolved when queues of a certain type
+	// are emptied (fx is the type by default)
+	promise: function( type, obj ) {
+		var tmp,
+			count = 1,
+			defer = jQuery.Deferred(),
+			elements = this,
+			i = this.length,
+			resolve = function() {
+				if ( !( --count ) ) {
+					defer.resolveWith( elements, [ elements ] );
+				}
+			};
+
+		if ( typeof type !== "string" ) {
+			obj = type;
+			type = undefined;
+		}
+		type = type || "fx";
+
+		while ( i-- ) {
+			tmp = dataPriv.get( elements[ i ], type + "queueHooks" );
+			if ( tmp && tmp.empty ) {
+				count++;
+				tmp.empty.add( resolve );
+			}
+		}
+		resolve();
+		return defer.promise( obj );
+	}
+} );
+var pnum = ( /[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/ ).source;
+
+var rcssNum = new RegExp( "^(?:([+-])=|)(" + pnum + ")([a-z%]*)$", "i" );
+
+
+var cssExpand = [ "Top", "Right", "Bottom", "Left" ];
+
+var documentElement = document.documentElement;
+
+
+
+	var isAttached = function( elem ) {
+			return jQuery.contains( elem.ownerDocument, elem );
+		},
+		composed = { composed: true };
+
+	// Support: IE 9 - 11+, Edge 12 - 18+, iOS 10.0 - 10.2 only
+	// Check attachment across shadow DOM boundaries when possible (gh-3504)
+	// Support: iOS 10.0-10.2 only
+	// Early iOS 10 versions support `attachShadow` but not `getRootNode`,
+	// leading to errors. We need to check for `getRootNode`.
+	if ( documentElement.getRootNode ) {
+		isAttached = function( elem ) {
+			return jQuery.contains( elem.ownerDocument, elem ) ||
+				elem.getRootNode( composed ) === elem.ownerDocument;
+		};
+	}
+var isHiddenWithinTree = function( elem, el ) {
+
+		// isHiddenWithinTree might be called from jQuery#filter function;
+		// in that case, element will be second argument
+		elem = el || elem;
+
+		// Inline style trumps all
+		return elem.style.display === "none" ||
+			elem.style.display === "" &&
+
+			// Otherwise, check computed style
+			// Support: Firefox <=43 - 45
+			// Disconnected elements can have computed display: none, so first confirm that elem is
+			// in the document.
+			isAttached( elem ) &&
+
+			jQuery.css( elem, "display" ) === "none";
+	};
+
+
+
+function adjustCSS( elem, prop, valueParts, tween ) {
+	var adjusted, scale,
+		maxIterations = 20,
+		currentValue = tween ?
+			function() {
+				return tween.cur();
+			} :
+			function() {
+				return jQuery.css( elem, prop, "" );
+			},
+		initial = currentValue(),
+		unit = valueParts && valueParts[ 3 ] || ( jQuery.cssNumber[ prop ] ? "" : "px" ),
+
+		// Starting value computation is required for potential unit mismatches
+		initialInUnit = elem.nodeType &&
+			( jQuery.cssNumber[ prop ] || unit !== "px" && +initial ) &&
+			rcssNum.exec( jQuery.css( elem, prop ) );
+
+	if ( initialInUnit && initialInUnit[ 3 ] !== unit ) {
+
+		// Support: Firefox <=54
+		// Halve the iteration target value to prevent interference from CSS upper bounds (gh-2144)
+		initial = initial / 2;
+
+		// Trust units reported by jQuery.css
+		unit = unit || initialInUnit[ 3 ];
+
+		// Iteratively approximate from a nonzero starting point
+		initialInUnit = +initial || 1;
+
+		while ( maxIterations-- ) {
+
+			// Evaluate and update our best guess (doubling guesses that zero out).
+			// Finish if the scale equals or crosses 1 (making the old*new product non-positive).
+			jQuery.style( elem, prop, initialInUnit + unit );
+			if ( ( 1 - scale ) * ( 1 - ( scale = currentValue() / initial || 0.5 ) ) <= 0 ) {
+				maxIterations = 0;
+			}
+			initialInUnit = initialInUnit / scale;
+
+		}
+
+		initialInUnit = initialInUnit * 2;
+		jQuery.style( elem, prop, initialInUnit + unit );
+
+		// Make sure we update the tween properties later on
+		valueParts = valueParts || [];
+	}
+
+	if ( valueParts ) {
+		initialInUnit = +initialInUnit || +initial || 0;
+
+		// Apply relative offset (+=/-=) if specified
+		adjusted = valueParts[ 1 ] ?
+			initialInUnit + ( valueParts[ 1 ] + 1 ) * valueParts[ 2 ] :
+			+valueParts[ 2 ];
+		if ( tween ) {
+			tween.unit = unit;
+			tween.start = initialInUnit;
+			tween.end = adjusted;
+		}
+	}
+	return adjusted;
+}
+
+
+var defaultDisplayMap = {};
+
+function getDefaultDisplay( elem ) {
+	var temp,
+		doc = elem.ownerDocument,
+		nodeName = elem.nodeName,
+		display = defaultDisplayMap[ nodeName ];
+
+	if ( display ) {
+		return display;
+	}
+
+	temp = doc.body.appendChild( doc.createElement( nodeName ) );
+	display = jQuery.css( temp, "display" );
+
+	temp.parentNode.removeChild( temp );
+
+	if ( display === "none" ) {
+		display = "block";
+	}
+	defaultDisplayMap[ nodeName ] = display;
+
+	return display;
+}
+
+function showHide( elements, show ) {
+	var display, elem,
+		values = [],
+		index = 0,
+		length = elements.length;
+
+	// Determine new display value for elements that need to change
+	for ( ; index < length; index++ ) {
+		elem = elements[ index ];
+		if ( !elem.style ) {
+			continue;
+		}
+
+		display = elem.style.display;
+		if ( show ) {
+
+			// Since we force visibility upon cascade-hidden elements, an immediate (and slow)
+			// check is required in this first loop unless we have a nonempty display value (either
+			// inline or about-to-be-restored)
+			if ( display === "none" ) {
+				values[ index ] = dataPriv.get( elem, "display" ) || null;
+				if ( !values[ index ] ) {
+					elem.style.display = "";
+				}
+			}
+			if ( elem.style.display === "" && isHiddenWithinTree( elem ) ) {
+				values[ index ] = getDefaultDisplay( elem );
+			}
+		} else {
+			if ( display !== "none" ) {
+				values[ index ] = "none";
+
+				// Remember what we're overwriting
+				dataPriv.set( elem, "display", display );
+			}
+		}
+	}
+
+	// Set the display of the elements in a second loop to avoid constant reflow
+	for ( index = 0; index < length; index++ ) {
+		if ( values[ index ] != null ) {
+			elements[ index ].style.display = values[ index ];
+		}
+	}
+
+	return elements;
+}
+
+jQuery.fn.extend( {
+	show: function() {
+		return showHide( this, true );
+	},
+	hide: function() {
+		return showHide( this );
+	},
+	toggle: function( state ) {
+		if ( typeof state === "boolean" ) {
+			return state ? this.show() : this.hide();
+		}
+
+		return this.each( function() {
+			if ( isHiddenWithinTree( this ) ) {
+				jQuery( this ).show();
+			} else {
+				jQuery( this ).hide();
+			}
+		} );
+	}
+} );
+var rcheckableType = ( /^(?:checkbox|radio)$/i );
+
+var rtagName = ( /<([a-z][^\/\0>\x20\t\r\n\f]*)/i );
+
+var rscriptType = ( /^$|^module$|\/(?:java|ecma)script/i );
+
+
+
+( function() {
+	var fragment = document.createDocumentFragment(),
+		div = fragment.appendChild( document.createElement( "div" ) ),
+		input = document.createElement( "input" );
+
+	// Support: Android 4.0 - 4.3 only
+	// Check state lost if the name is set (#11217)
+	// Support: Windows Web Apps (WWA)
+	// `name` and `type` must use .setAttribute for WWA (#14901)
+	input.setAttribute( "type", "radio" );
+	input.setAttribute( "checked", "checked" );
+	input.setAttribute( "name", "t" );
+
+	div.appendChild( input );
+
+	// Support: Android <=4.1 only
+	// Older WebKit doesn't clone checked state correctly in fragments
+	support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked;
+
+	// Support: IE <=11 only
+	// Make sure textarea (and checkbox) defaultValue is properly cloned
+	div.innerHTML = "<textarea>x</textarea>";
+	support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue;
+
+	// Support: IE <=9 only
+	// IE <=9 replaces <option> tags with their contents when inserted outside of
+	// the select element.
+	div.innerHTML = "<option></option>";
+	support.option = !!div.lastChild;
+} )();
+
+
+// We have to close these tags to support XHTML (#13200)
+var wrapMap = {
+
+	// XHTML parsers do not magically insert elements in the
+	// same way that tag soup parsers do. So we cannot shorten
+	// this by omitting <tbody> or other required elements.
+	thead: [ 1, "<table>", "</table>" ],
+	col: [ 2, "<table><colgroup>", "</colgroup></table>" ],
+	tr: [ 2, "<table><tbody>", "</tbody></table>" ],
+	td: [ 3, "<table><tbody><tr>", "</tr></tbody></table>" ],
+
+	_default: [ 0, "", "" ]
+};
+
+wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
+wrapMap.th = wrapMap.td;
+
+// Support: IE <=9 only
+if ( !support.option ) {
+	wrapMap.optgroup = wrapMap.option = [ 1, "<select multiple='multiple'>", "</select>" ];
+}
+
+
+function getAll( context, tag ) {
+
+	// Support: IE <=9 - 11 only
+	// Use typeof to avoid zero-argument method invocation on host objects (#15151)
+	var ret;
+
+	if ( typeof context.getElementsByTagName !== "undefined" ) {
+		ret = context.getElementsByTagName( tag || "*" );
+
+	} else if ( typeof context.querySelectorAll !== "undefined" ) {
+		ret = context.querySelectorAll( tag || "*" );
+
+	} else {
+		ret = [];
+	}
+
+	if ( tag === undefined || tag && nodeName( context, tag ) ) {
+		return jQuery.merge( [ context ], ret );
+	}
+
+	return ret;
+}
+
+
+// Mark scripts as having already been evaluated
+function setGlobalEval( elems, refElements ) {
+	var i = 0,
+		l = elems.length;
+
+	for ( ; i < l; i++ ) {
+		dataPriv.set(
+			elems[ i ],
+			"globalEval",
+			!refElements || dataPriv.get( refElements[ i ], "globalEval" )
+		);
+	}
+}
+
+
+var rhtml = /<|&#?\w+;/;
+
+function buildFragment( elems, context, scripts, selection, ignored ) {
+	var elem, tmp, tag, wrap, attached, j,
+		fragment = context.createDocumentFragment(),
+		nodes = [],
+		i = 0,
+		l = elems.length;
+
+	for ( ; i < l; i++ ) {
+		elem = elems[ i ];
+
+		if ( elem || elem === 0 ) {
+
+			// Add nodes directly
+			if ( toType( elem ) === "object" ) {
+
+				// Support: Android <=4.0 only, PhantomJS 1 only
+				// push.apply(_, arraylike) throws on ancient WebKit
+				jQuery.merge( nodes, elem.nodeType ? [ elem ] : elem );
+
+			// Convert non-html into a text node
+			} else if ( !rhtml.test( elem ) ) {
+				nodes.push( context.createTextNode( elem ) );
+
+			// Convert html into DOM nodes
+			} else {
+				tmp = tmp || fragment.appendChild( context.createElement( "div" ) );
+
+				// Deserialize a standard representation
+				tag = ( rtagName.exec( elem ) || [ "", "" ] )[ 1 ].toLowerCase();
+				wrap = wrapMap[ tag ] || wrapMap._default;
+				tmp.innerHTML = wrap[ 1 ] + jQuery.htmlPrefilter( elem ) + wrap[ 2 ];
+
+				// Descend through wrappers to the right content
+				j = wrap[ 0 ];
+				while ( j-- ) {
+					tmp = tmp.lastChild;
+				}
+
+				// Support: Android <=4.0 only, PhantomJS 1 only
+				// push.apply(_, arraylike) throws on ancient WebKit
+				jQuery.merge( nodes, tmp.childNodes );
+
+				// Remember the top-level container
+				tmp = fragment.firstChild;
+
+				// Ensure the created nodes are orphaned (#12392)
+				tmp.textContent = "";
+			}
+		}
+	}
+
+	// Remove wrapper from fragment
+	fragment.textContent = "";
+
+	i = 0;
+	while ( ( elem = nodes[ i++ ] ) ) {
+
+		// Skip elements already in the context collection (trac-4087)
+		if ( selection && jQuery.inArray( elem, selection ) > -1 ) {
+			if ( ignored ) {
+				ignored.push( elem );
+			}
+			continue;
+		}
+
+		attached = isAttached( elem );
+
+		// Append to fragment
+		tmp = getAll( fragment.appendChild( elem ), "script" );
+
+		// Preserve script evaluation history
+		if ( attached ) {
+			setGlobalEval( tmp );
+		}
+
+		// Capture executables
+		if ( scripts ) {
+			j = 0;
+			while ( ( elem = tmp[ j++ ] ) ) {
+				if ( rscriptType.test( elem.type || "" ) ) {
+					scripts.push( elem );
+				}
+			}
+		}
+	}
+
+	return fragment;
+}
+
+
+var rtypenamespace = /^([^.]*)(?:\.(.+)|)/;
+
+function returnTrue() {
+	return true;
+}
+
+function returnFalse() {
+	return false;
+}
+
+// Support: IE <=9 - 11+
+// focus() and blur() are asynchronous, except when they are no-op.
+// So expect focus to be synchronous when the element is already active,
+// and blur to be synchronous when the element is not already active.
+// (focus and blur are always synchronous in other supported browsers,
+// this just defines when we can count on it).
+function expectSync( elem, type ) {
+	return ( elem === safeActiveElement() ) === ( type === "focus" );
+}
+
+// Support: IE <=9 only
+// Accessing document.activeElement can throw unexpectedly
+// https://bugs.jquery.com/ticket/13393
+function safeActiveElement() {
+	try {
+		return document.activeElement;
+	} catch ( err ) { }
+}
+
+function on( elem, types, selector, data, fn, one ) {
+	var origFn, type;
+
+	// Types can be a map of types/handlers
+	if ( typeof types === "object" ) {
+
+		// ( types-Object, selector, data )
+		if ( typeof selector !== "string" ) {
+
+			// ( types-Object, data )
+			data = data || selector;
+			selector = undefined;
+		}
+		for ( type in types ) {
+			on( elem, type, selector, data, types[ type ], one );
+		}
+		return elem;
+	}
+
+	if ( data == null && fn == null ) {
+
+		// ( types, fn )
+		fn = selector;
+		data = selector = undefined;
+	} else if ( fn == null ) {
+		if ( typeof selector === "string" ) {
+
+			// ( types, selector, fn )
+			fn = data;
+			data = undefined;
+		} else {
+
+			// ( types, data, fn )
+			fn = data;
+			data = selector;
+			selector = undefined;
+		}
+	}
+	if ( fn === false ) {
+		fn = returnFalse;
+	} else if ( !fn ) {
+		return elem;
+	}
+
+	if ( one === 1 ) {
+		origFn = fn;
+		fn = function( event ) {
+
+			// Can use an empty set, since event contains the info
+			jQuery().off( event );
+			return origFn.apply( this, arguments );
+		};
+
+		// Use same guid so caller can remove using origFn
+		fn.guid = origFn.guid || ( origFn.guid = jQuery.guid++ );
+	}
+	return elem.each( function() {
+		jQuery.event.add( this, types, fn, data, selector );
+	} );
+}
+
+/*
+ * Helper functions for managing events -- not part of the public interface.
+ * Props to Dean Edwards' addEvent library for many of the ideas.
+ */
+jQuery.event = {
+
+	global: {},
+
+	add: function( elem, types, handler, data, selector ) {
+
+		var handleObjIn, eventHandle, tmp,
+			events, t, handleObj,
+			special, handlers, type, namespaces, origType,
+			elemData = dataPriv.get( elem );
+
+		// Only attach events to objects that accept data
+		if ( !acceptData( elem ) ) {
+			return;
+		}
+
+		// Caller can pass in an object of custom data in lieu of the handler
+		if ( handler.handler ) {
+			handleObjIn = handler;
+			handler = handleObjIn.handler;
+			selector = handleObjIn.selector;
+		}
+
+		// Ensure that invalid selectors throw exceptions at attach time
+		// Evaluate against documentElement in case elem is a non-element node (e.g., document)
+		if ( selector ) {
+			jQuery.find.matchesSelector( documentElement, selector );
+		}
+
+		// Make sure that the handler has a unique ID, used to find/remove it later
+		if ( !handler.guid ) {
+			handler.guid = jQuery.guid++;
+		}
+
+		// Init the element's event structure and main handler, if this is the first
+		if ( !( events = elemData.events ) ) {
+			events = elemData.events = Object.create( null );
+		}
+		if ( !( eventHandle = elemData.handle ) ) {
+			eventHandle = elemData.handle = function( e ) {
+
+				// Discard the second event of a jQuery.event.trigger() and
+				// when an event is called after a page has unloaded
+				return typeof jQuery !== "undefined" && jQuery.event.triggered !== e.type ?
+					jQuery.event.dispatch.apply( elem, arguments ) : undefined;
+			};
+		}
+
+		// Handle multiple events separated by a space
+		types = ( types || "" ).match( rnothtmlwhite ) || [ "" ];
+		t = types.length;
+		while ( t-- ) {
+			tmp = rtypenamespace.exec( types[ t ] ) || [];
+			type = origType = tmp[ 1 ];
+			namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort();
+
+			// There *must* be a type, no attaching namespace-only handlers
+			if ( !type ) {
+				continue;
+			}
+
+			// If event changes its type, use the special event handlers for the changed type
+			special = jQuery.event.special[ type ] || {};
+
+			// If selector defined, determine special event api type, otherwise given type
+			type = ( selector ? special.delegateType : special.bindType ) || type;
+
+			// Update special based on newly reset type
+			special = jQuery.event.special[ type ] || {};
+
+			// handleObj is passed to all event handlers
+			handleObj = jQuery.extend( {
+				type: type,
+				origType: origType,
+				data: data,
+				handler: handler,
+				guid: handler.guid,
+				selector: selector,
+				needsContext: selector && jQuery.expr.match.needsContext.test( selector ),
+				namespace: namespaces.join( "." )
+			}, handleObjIn );
+
+			// Init the event handler queue if we're the first
+			if ( !( handlers = events[ type ] ) ) {
+				handlers = events[ type ] = [];
+				handlers.delegateCount = 0;
+
+				// Only use addEventListener if the special events handler returns false
+				if ( !special.setup ||
+					special.setup.call( elem, data, namespaces, eventHandle ) === false ) {
+
+					if ( elem.addEventListener ) {
+						elem.addEventListener( type, eventHandle );
+					}
+				}
+			}
+
+			if ( special.add ) {
+				special.add.call( elem, handleObj );
+
+				if ( !handleObj.handler.guid ) {
+					handleObj.handler.guid = handler.guid;
+				}
+			}
+
+			// Add to the element's handler list, delegates in front
+			if ( selector ) {
+				handlers.splice( handlers.delegateCount++, 0, handleObj );
+			} else {
+				handlers.push( handleObj );
+			}
+
+			// Keep track of which events have ever been used, for event optimization
+			jQuery.event.global[ type ] = true;
+		}
+
+	},
+
+	// Detach an event or set of events from an element
+	remove: function( elem, types, handler, selector, mappedTypes ) {
+
+		var j, origCount, tmp,
+			events, t, handleObj,
+			special, handlers, type, namespaces, origType,
+			elemData = dataPriv.hasData( elem ) && dataPriv.get( elem );
+
+		if ( !elemData || !( events = elemData.events ) ) {
+			return;
+		}
+
+		// Once for each type.namespace in types; type may be omitted
+		types = ( types || "" ).match( rnothtmlwhite ) || [ "" ];
+		t = types.length;
+		while ( t-- ) {
+			tmp = rtypenamespace.exec( types[ t ] ) || [];
+			type = origType = tmp[ 1 ];
+			namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort();
+
+			// Unbind all events (on this namespace, if provided) for the element
+			if ( !type ) {
+				for ( type in events ) {
+					jQuery.event.remove( elem, type + types[ t ], handler, selector, true );
+				}
+				continue;
+			}
+
+			special = jQuery.event.special[ type ] || {};
+			type = ( selector ? special.delegateType : special.bindType ) || type;
+			handlers = events[ type ] || [];
+			tmp = tmp[ 2 ] &&
+				new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" );
+
+			// Remove matching events
+			origCount = j = handlers.length;
+			while ( j-- ) {
+				handleObj = handlers[ j ];
+
+				if ( ( mappedTypes || origType === handleObj.origType ) &&
+					( !handler || handler.guid === handleObj.guid ) &&
+					( !tmp || tmp.test( handleObj.namespace ) ) &&
+					( !selector || selector === handleObj.selector ||
+						selector === "**" && handleObj.selector ) ) {
+					handlers.splice( j, 1 );
+
+					if ( handleObj.selector ) {
+						handlers.delegateCount--;
+					}
+					if ( special.remove ) {
+						special.remove.call( elem, handleObj );
+					}
+				}
+			}
+
+			// Remove generic event handler if we removed something and no more handlers exist
+			// (avoids potential for endless recursion during removal of special event handlers)
+			if ( origCount && !handlers.length ) {
+				if ( !special.teardown ||
+					special.teardown.call( elem, namespaces, elemData.handle ) === false ) {
+
+					jQuery.removeEvent( elem, type, elemData.handle );
+				}
+
+				delete events[ type ];
+			}
+		}
+
+		// Remove data and the expando if it's no longer used
+		if ( jQuery.isEmptyObject( events ) ) {
+			dataPriv.remove( elem, "handle events" );
+		}
+	},
+
+	dispatch: function( nativeEvent ) {
+
+		var i, j, ret, matched, handleObj, handlerQueue,
+			args = new Array( arguments.length ),
+
+			// Make a writable jQuery.Event from the native event object
+			event = jQuery.event.fix( nativeEvent ),
+
+			handlers = (
+				dataPriv.get( this, "events" ) || Object.create( null )
+			)[ event.type ] || [],
+			special = jQuery.event.special[ event.type ] || {};
+
+		// Use the fix-ed jQuery.Event rather than the (read-only) native event
+		args[ 0 ] = event;
+
+		for ( i = 1; i < arguments.length; i++ ) {
+			args[ i ] = arguments[ i ];
+		}
+
+		event.delegateTarget = this;
+
+		// Call the preDispatch hook for the mapped type, and let it bail if desired
+		if ( special.preDispatch && special.preDispatch.call( this, event ) === false ) {
+			return;
+		}
+
+		// Determine handlers
+		handlerQueue = jQuery.event.handlers.call( this, event, handlers );
+
+		// Run delegates first; they may want to stop propagation beneath us
+		i = 0;
+		while ( ( matched = handlerQueue[ i++ ] ) && !event.isPropagationStopped() ) {
+			event.currentTarget = matched.elem;
+
+			j = 0;
+			while ( ( handleObj = matched.handlers[ j++ ] ) &&
+				!event.isImmediatePropagationStopped() ) {
+
+				// If the event is namespaced, then each handler is only invoked if it is
+				// specially universal or its namespaces are a superset of the event's.
+				if ( !event.rnamespace || handleObj.namespace === false ||
+					event.rnamespace.test( handleObj.namespace ) ) {
+
+					event.handleObj = handleObj;
+					event.data = handleObj.data;
+
+					ret = ( ( jQuery.event.special[ handleObj.origType ] || {} ).handle ||
+						handleObj.handler ).apply( matched.elem, args );
+
+					if ( ret !== undefined ) {
+						if ( ( event.result = ret ) === false ) {
+							event.preventDefault();
+							event.stopPropagation();
+						}
+					}
+				}
+			}
+		}
+
+		// Call the postDispatch hook for the mapped type
+		if ( special.postDispatch ) {
+			special.postDispatch.call( this, event );
+		}
+
+		return event.result;
+	},
+
+	handlers: function( event, handlers ) {
+		var i, handleObj, sel, matchedHandlers, matchedSelectors,
+			handlerQueue = [],
+			delegateCount = handlers.delegateCount,
+			cur = event.target;
+
+		// Find delegate handlers
+		if ( delegateCount &&
+
+			// Support: IE <=9
+			// Black-hole SVG <use> instance trees (trac-13180)
+			cur.nodeType &&
+
+			// Support: Firefox <=42
+			// Suppress spec-violating clicks indicating a non-primary pointer button (trac-3861)
+			// https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click
+			// Support: IE 11 only
+			// ...but not arrow key "clicks" of radio inputs, which can have `button` -1 (gh-2343)
+			!( event.type === "click" && event.button >= 1 ) ) {
+
+			for ( ; cur !== this; cur = cur.parentNode || this ) {
+
+				// Don't check non-elements (#13208)
+				// Don't process clicks on disabled elements (#6911, #8165, #11382, #11764)
+				if ( cur.nodeType === 1 && !( event.type === "click" && cur.disabled === true ) ) {
+					matchedHandlers = [];
+					matchedSelectors = {};
+					for ( i = 0; i < delegateCount; i++ ) {
+						handleObj = handlers[ i ];
+
+						// Don't conflict with Object.prototype properties (#13203)
+						sel = handleObj.selector + " ";
+
+						if ( matchedSelectors[ sel ] === undefined ) {
+							matchedSelectors[ sel ] = handleObj.needsContext ?
+								jQuery( sel, this ).index( cur ) > -1 :
+								jQuery.find( sel, this, null, [ cur ] ).length;
+						}
+						if ( matchedSelectors[ sel ] ) {
+							matchedHandlers.push( handleObj );
+						}
+					}
+					if ( matchedHandlers.length ) {
+						handlerQueue.push( { elem: cur, handlers: matchedHandlers } );
+					}
+				}
+			}
+		}
+
+		// Add the remaining (directly-bound) handlers
+		cur = this;
+		if ( delegateCount < handlers.length ) {
+			handlerQueue.push( { elem: cur, handlers: handlers.slice( delegateCount ) } );
+		}
+
+		return handlerQueue;
+	},
+
+	addProp: function( name, hook ) {
+		Object.defineProperty( jQuery.Event.prototype, name, {
+			enumerable: true,
+			configurable: true,
+
+			get: isFunction( hook ) ?
+				function() {
+					if ( this.originalEvent ) {
+						return hook( this.originalEvent );
+					}
+				} :
+				function() {
+					if ( this.originalEvent ) {
+						return this.originalEvent[ name ];
+					}
+				},
+
+			set: function( value ) {
+				Object.defineProperty( this, name, {
+					enumerable: true,
+					configurable: true,
+					writable: true,
+					value: value
+				} );
+			}
+		} );
+	},
+
+	fix: function( originalEvent ) {
+		return originalEvent[ jQuery.expando ] ?
+			originalEvent :
+			new jQuery.Event( originalEvent );
+	},
+
+	special: {
+		load: {
+
+			// Prevent triggered image.load events from bubbling to window.load
+			noBubble: true
+		},
+		click: {
+
+			// Utilize native event to ensure correct state for checkable inputs
+			setup: function( data ) {
+
+				// For mutual compressibility with _default, replace `this` access with a local var.
+				// `|| data` is dead code meant only to preserve the variable through minification.
+				var el = this || data;
+
+				// Claim the first handler
+				if ( rcheckableType.test( el.type ) &&
+					el.click && nodeName( el, "input" ) ) {
+
+					// dataPriv.set( el, "click", ... )
+					leverageNative( el, "click", returnTrue );
+				}
+
+				// Return false to allow normal processing in the caller
+				return false;
+			},
+			trigger: function( data ) {
+
+				// For mutual compressibility with _default, replace `this` access with a local var.
+				// `|| data` is dead code meant only to preserve the variable through minification.
+				var el = this || data;
+
+				// Force setup before triggering a click
+				if ( rcheckableType.test( el.type ) &&
+					el.click && nodeName( el, "input" ) ) {
+
+					leverageNative( el, "click" );
+				}
+
+				// Return non-false to allow normal event-path propagation
+				return true;
+			},
+
+			// For cross-browser consistency, suppress native .click() on links
+			// Also prevent it if we're currently inside a leveraged native-event stack
+			_default: function( event ) {
+				var target = event.target;
+				return rcheckableType.test( target.type ) &&
+					target.click && nodeName( target, "input" ) &&
+					dataPriv.get( target, "click" ) ||
+					nodeName( target, "a" );
+			}
+		},
+
+		beforeunload: {
+			postDispatch: function( event ) {
+
+				// Support: Firefox 20+
+				// Firefox doesn't alert if the returnValue field is not set.
+				if ( event.result !== undefined && event.originalEvent ) {
+					event.originalEvent.returnValue = event.result;
+				}
+			}
+		}
+	}
+};
+
+// Ensure the presence of an event listener that handles manually-triggered
+// synthetic events by interrupting progress until reinvoked in response to
+// *native* events that it fires directly, ensuring that state changes have
+// already occurred before other listeners are invoked.
+function leverageNative( el, type, expectSync ) {
+
+	// Missing expectSync indicates a trigger call, which must force setup through jQuery.event.add
+	if ( !expectSync ) {
+		if ( dataPriv.get( el, type ) === undefined ) {
+			jQuery.event.add( el, type, returnTrue );
+		}
+		return;
+	}
+
+	// Register the controller as a special universal handler for all event namespaces
+	dataPriv.set( el, type, false );
+	jQuery.event.add( el, type, {
+		namespace: false,
+		handler: function( event ) {
+			var notAsync, result,
+				saved = dataPriv.get( this, type );
+
+			if ( ( event.isTrigger & 1 ) && this[ type ] ) {
+
+				// Interrupt processing of the outer synthetic .trigger()ed event
+				// Saved data should be false in such cases, but might be a leftover capture object
+				// from an async native handler (gh-4350)
+				if ( !saved.length ) {
+
+					// Store arguments for use when handling the inner native event
+					// There will always be at least one argument (an event object), so this array
+					// will not be confused with a leftover capture object.
+					saved = slice.call( arguments );
+					dataPriv.set( this, type, saved );
+
+					// Trigger the native event and capture its result
+					// Support: IE <=9 - 11+
+					// focus() and blur() are asynchronous
+					notAsync = expectSync( this, type );
+					this[ type ]();
+					result = dataPriv.get( this, type );
+					if ( saved !== result || notAsync ) {
+						dataPriv.set( this, type, false );
+					} else {
+						result = {};
+					}
+					if ( saved !== result ) {
+
+						// Cancel the outer synthetic event
+						event.stopImmediatePropagation();
+						event.preventDefault();
+
+						// Support: Chrome 86+
+						// In Chrome, if an element having a focusout handler is blurred by
+						// clicking outside of it, it invokes the handler synchronously. If
+						// that handler calls `.remove()` on the element, the data is cleared,
+						// leaving `result` undefined. We need to guard against this.
+						return result && result.value;
+					}
+
+				// If this is an inner synthetic event for an event with a bubbling surrogate
+				// (focus or blur), assume that the surrogate already propagated from triggering the
+				// native event and prevent that from happening again here.
+				// This technically gets the ordering wrong w.r.t. to `.trigger()` (in which the
+				// bubbling surrogate propagates *after* the non-bubbling base), but that seems
+				// less bad than duplication.
+				} else if ( ( jQuery.event.special[ type ] || {} ).delegateType ) {
+					event.stopPropagation();
+				}
+
+			// If this is a native event triggered above, everything is now in order
+			// Fire an inner synthetic event with the original arguments
+			} else if ( saved.length ) {
+
+				// ...and capture the result
+				dataPriv.set( this, type, {
+					value: jQuery.event.trigger(
+
+						// Support: IE <=9 - 11+
+						// Extend with the prototype to reset the above stopImmediatePropagation()
+						jQuery.extend( saved[ 0 ], jQuery.Event.prototype ),
+						saved.slice( 1 ),
+						this
+					)
+				} );
+
+				// Abort handling of the native event
+				event.stopImmediatePropagation();
+			}
+		}
+	} );
+}
+
+jQuery.removeEvent = function( elem, type, handle ) {
+
+	// This "if" is needed for plain objects
+	if ( elem.removeEventListener ) {
+		elem.removeEventListener( type, handle );
+	}
+};
+
+jQuery.Event = function( src, props ) {
+
+	// Allow instantiation without the 'new' keyword
+	if ( !( this instanceof jQuery.Event ) ) {
+		return new jQuery.Event( src, props );
+	}
+
+	// Event object
+	if ( src && src.type ) {
+		this.originalEvent = src;
+		this.type = src.type;
+
+		// Events bubbling up the document may have been marked as prevented
+		// by a handler lower down the tree; reflect the correct value.
+		this.isDefaultPrevented = src.defaultPrevented ||
+				src.defaultPrevented === undefined &&
+
+				// Support: Android <=2.3 only
+				src.returnValue === false ?
+			returnTrue :
+			returnFalse;
+
+		// Create target properties
+		// Support: Safari <=6 - 7 only
+		// Target should not be a text node (#504, #13143)
+		this.target = ( src.target && src.target.nodeType === 3 ) ?
+			src.target.parentNode :
+			src.target;
+
+		this.currentTarget = src.currentTarget;
+		this.relatedTarget = src.relatedTarget;
+
+	// Event type
+	} else {
+		this.type = src;
+	}
+
+	// Put explicitly provided properties onto the event object
+	if ( props ) {
+		jQuery.extend( this, props );
+	}
+
+	// Create a timestamp if incoming event doesn't have one
+	this.timeStamp = src && src.timeStamp || Date.now();
+
+	// Mark it as fixed
+	this[ jQuery.expando ] = true;
+};
+
+// jQuery.Event is based on DOM3 Events as specified by the ECMAScript Language Binding
+// https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html
+jQuery.Event.prototype = {
+	constructor: jQuery.Event,
+	isDefaultPrevented: returnFalse,
+	isPropagationStopped: returnFalse,
+	isImmediatePropagationStopped: returnFalse,
+	isSimulated: false,
+
+	preventDefault: function() {
+		var e = this.originalEvent;
+
+		this.isDefaultPrevented = returnTrue;
+
+		if ( e && !this.isSimulated ) {
+			e.preventDefault();
+		}
+	},
+	stopPropagation: function() {
+		var e = this.originalEvent;
+
+		this.isPropagationStopped = returnTrue;
+
+		if ( e && !this.isSimulated ) {
+			e.stopPropagation();
+		}
+	},
+	stopImmediatePropagation: function() {
+		var e = this.originalEvent;
+
+		this.isImmediatePropagationStopped = returnTrue;
+
+		if ( e && !this.isSimulated ) {
+			e.stopImmediatePropagation();
+		}
+
+		this.stopPropagation();
+	}
+};
+
+// Includes all common event props including KeyEvent and MouseEvent specific props
+jQuery.each( {
+	altKey: true,
+	bubbles: true,
+	cancelable: true,
+	changedTouches: true,
+	ctrlKey: true,
+	detail: true,
+	eventPhase: true,
+	metaKey: true,
+	pageX: true,
+	pageY: true,
+	shiftKey: true,
+	view: true,
+	"char": true,
+	code: true,
+	charCode: true,
+	key: true,
+	keyCode: true,
+	button: true,
+	buttons: true,
+	clientX: true,
+	clientY: true,
+	offsetX: true,
+	offsetY: true,
+	pointerId: true,
+	pointerType: true,
+	screenX: true,
+	screenY: true,
+	targetTouches: true,
+	toElement: true,
+	touches: true,
+	which: true
+}, jQuery.event.addProp );
+
+jQuery.each( { focus: "focusin", blur: "focusout" }, function( type, delegateType ) {
+	jQuery.event.special[ type ] = {
+
+		// Utilize native event if possible so blur/focus sequence is correct
+		setup: function() {
+
+			// Claim the first handler
+			// dataPriv.set( this, "focus", ... )
+			// dataPriv.set( this, "blur", ... )
+			leverageNative( this, type, expectSync );
+
+			// Return false to allow normal processing in the caller
+			return false;
+		},
+		trigger: function() {
+
+			// Force setup before trigger
+			leverageNative( this, type );
+
+			// Return non-false to allow normal event-path propagation
+			return true;
+		},
+
+		// Suppress native focus or blur as it's already being fired
+		// in leverageNative.
+		_default: function() {
+			return true;
+		},
+
+		delegateType: delegateType
+	};
+} );
+
+// Create mouseenter/leave events using mouseover/out and event-time checks
+// so that event delegation works in jQuery.
+// Do the same for pointerenter/pointerleave and pointerover/pointerout
+//
+// Support: Safari 7 only
+// Safari sends mouseenter too often; see:
+// https://bugs.chromium.org/p/chromium/issues/detail?id=470258
+// for the description of the bug (it existed in older Chrome versions as well).
+jQuery.each( {
+	mouseenter: "mouseover",
+	mouseleave: "mouseout",
+	pointerenter: "pointerover",
+	pointerleave: "pointerout"
+}, function( orig, fix ) {
+	jQuery.event.special[ orig ] = {
+		delegateType: fix,
+		bindType: fix,
+
+		handle: function( event ) {
+			var ret,
+				target = this,
+				related = event.relatedTarget,
+				handleObj = event.handleObj;
+
+			// For mouseenter/leave call the handler if related is outside the target.
+			// NB: No relatedTarget if the mouse left/entered the browser window
+			if ( !related || ( related !== target && !jQuery.contains( target, related ) ) ) {
+				event.type = handleObj.origType;
+				ret = handleObj.handler.apply( this, arguments );
+				event.type = fix;
+			}
+			return ret;
+		}
+	};
+} );
+
+jQuery.fn.extend( {
+
+	on: function( types, selector, data, fn ) {
+		return on( this, types, selector, data, fn );
+	},
+	one: function( types, selector, data, fn ) {
+		return on( this, types, selector, data, fn, 1 );
+	},
+	off: function( types, selector, fn ) {
+		var handleObj, type;
+		if ( types && types.preventDefault && types.handleObj ) {
+
+			// ( event )  dispatched jQuery.Event
+			handleObj = types.handleObj;
+			jQuery( types.delegateTarget ).off(
+				handleObj.namespace ?
+					handleObj.origType + "." + handleObj.namespace :
+					handleObj.origType,
+				handleObj.selector,
+				handleObj.handler
+			);
+			return this;
+		}
+		if ( typeof types === "object" ) {
+
+			// ( types-object [, selector] )
+			for ( type in types ) {
+				this.off( type, selector, types[ type ] );
+			}
+			return this;
+		}
+		if ( selector === false || typeof selector === "function" ) {
+
+			// ( types [, fn] )
+			fn = selector;
+			selector = undefined;
+		}
+		if ( fn === false ) {
+			fn = returnFalse;
+		}
+		return this.each( function() {
+			jQuery.event.remove( this, types, fn, selector );
+		} );
+	}
+} );
+
+
+var
+
+	// Support: IE <=10 - 11, Edge 12 - 13 only
+	// In IE/Edge using regex groups here causes severe slowdowns.
+	// See https://connect.microsoft.com/IE/feedback/details/1736512/
+	rnoInnerhtml = /<script|<style|<link/i,
+
+	// checked="checked" or checked
+	rchecked = /checked\s*(?:[^=]|=\s*.checked.)/i,
+	rcleanScript = /^\s*<!(?:\[CDATA\[|--)|(?:\]\]|--)>\s*$/g;
+
+// Prefer a tbody over its parent table for containing new rows
+function manipulationTarget( elem, content ) {
+	if ( nodeName( elem, "table" ) &&
+		nodeName( content.nodeType !== 11 ? content : content.firstChild, "tr" ) ) {
+
+		return jQuery( elem ).children( "tbody" )[ 0 ] || elem;
+	}
+
+	return elem;
+}
+
+// Replace/restore the type attribute of script elements for safe DOM manipulation
+function disableScript( elem ) {
+	elem.type = ( elem.getAttribute( "type" ) !== null ) + "/" + elem.type;
+	return elem;
+}
+function restoreScript( elem ) {
+	if ( ( elem.type || "" ).slice( 0, 5 ) === "true/" ) {
+		elem.type = elem.type.slice( 5 );
+	} else {
+		elem.removeAttribute( "type" );
+	}
+
+	return elem;
+}
+
+function cloneCopyEvent( src, dest ) {
+	var i, l, type, pdataOld, udataOld, udataCur, events;
+
+	if ( dest.nodeType !== 1 ) {
+		return;
+	}
+
+	// 1. Copy private data: events, handlers, etc.
+	if ( dataPriv.hasData( src ) ) {
+		pdataOld = dataPriv.get( src );
+		events = pdataOld.events;
+
+		if ( events ) {
+			dataPriv.remove( dest, "handle events" );
+
+			for ( type in events ) {
+				for ( i = 0, l = events[ type ].length; i < l; i++ ) {
+					jQuery.event.add( dest, type, events[ type ][ i ] );
+				}
+			}
+		}
+	}
+
+	// 2. Copy user data
+	if ( dataUser.hasData( src ) ) {
+		udataOld = dataUser.access( src );
+		udataCur = jQuery.extend( {}, udataOld );
+
+		dataUser.set( dest, udataCur );
+	}
+}
+
+// Fix IE bugs, see support tests
+function fixInput( src, dest ) {
+	var nodeName = dest.nodeName.toLowerCase();
+
+	// Fails to persist the checked state of a cloned checkbox or radio button.
+	if ( nodeName === "input" && rcheckableType.test( src.type ) ) {
+		dest.checked = src.checked;
+
+	// Fails to return the selected option to the default selected state when cloning options
+	} else if ( nodeName === "input" || nodeName === "textarea" ) {
+		dest.defaultValue = src.defaultValue;
+	}
+}
+
+function domManip( collection, args, callback, ignored ) {
+
+	// Flatten any nested arrays
+	args = flat( args );
+
+	var fragment, first, scripts, hasScripts, node, doc,
+		i = 0,
+		l = collection.length,
+		iNoClone = l - 1,
+		value = args[ 0 ],
+		valueIsFunction = isFunction( value );
+
+	// We can't cloneNode fragments that contain checked, in WebKit
+	if ( valueIsFunction ||
+			( l > 1 && typeof value === "string" &&
+				!support.checkClone && rchecked.test( value ) ) ) {
+		return collection.each( function( index ) {
+			var self = collection.eq( index );
+			if ( valueIsFunction ) {
+				args[ 0 ] = value.call( this, index, self.html() );
+			}
+			domManip( self, args, callback, ignored );
+		} );
+	}
+
+	if ( l ) {
+		fragment = buildFragment( args, collection[ 0 ].ownerDocument, false, collection, ignored );
+		first = fragment.firstChild;
+
+		if ( fragment.childNodes.length === 1 ) {
+			fragment = first;
+		}
+
+		// Require either new content or an interest in ignored elements to invoke the callback
+		if ( first || ignored ) {
+			scripts = jQuery.map( getAll( fragment, "script" ), disableScript );
+			hasScripts = scripts.length;
+
+			// Use the original fragment for the last item
+			// instead of the first because it can end up
+			// being emptied incorrectly in certain situations (#8070).
+			for ( ; i < l; i++ ) {
+				node = fragment;
+
+				if ( i !== iNoClone ) {
+					node = jQuery.clone( node, true, true );
+
+					// Keep references to cloned scripts for later restoration
+					if ( hasScripts ) {
+
+						// Support: Android <=4.0 only, PhantomJS 1 only
+						// push.apply(_, arraylike) throws on ancient WebKit
+						jQuery.merge( scripts, getAll( node, "script" ) );
+					}
+				}
+
+				callback.call( collection[ i ], node, i );
+			}
+
+			if ( hasScripts ) {
+				doc = scripts[ scripts.length - 1 ].ownerDocument;
+
+				// Reenable scripts
+				jQuery.map( scripts, restoreScript );
+
+				// Evaluate executable scripts on first document insertion
+				for ( i = 0; i < hasScripts; i++ ) {
+					node = scripts[ i ];
+					if ( rscriptType.test( node.type || "" ) &&
+						!dataPriv.access( node, "globalEval" ) &&
+						jQuery.contains( doc, node ) ) {
+
+						if ( node.src && ( node.type || "" ).toLowerCase()  !== "module" ) {
+
+							// Optional AJAX dependency, but won't run scripts if not present
+							if ( jQuery._evalUrl && !node.noModule ) {
+								jQuery._evalUrl( node.src, {
+									nonce: node.nonce || node.getAttribute( "nonce" )
+								}, doc );
+							}
+						} else {
+							DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc );
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return collection;
+}
+
+function remove( elem, selector, keepData ) {
+	var node,
+		nodes = selector ? jQuery.filter( selector, elem ) : elem,
+		i = 0;
+
+	for ( ; ( node = nodes[ i ] ) != null; i++ ) {
+		if ( !keepData && node.nodeType === 1 ) {
+			jQuery.cleanData( getAll( node ) );
+		}
+
+		if ( node.parentNode ) {
+			if ( keepData && isAttached( node ) ) {
+				setGlobalEval( getAll( node, "script" ) );
+			}
+			node.parentNode.removeChild( node );
+		}
+	}
+
+	return elem;
+}
+
+jQuery.extend( {
+	htmlPrefilter: function( html ) {
+		return html;
+	},
+
+	clone: function( elem, dataAndEvents, deepDataAndEvents ) {
+		var i, l, srcElements, destElements,
+			clone = elem.cloneNode( true ),
+			inPage = isAttached( elem );
+
+		// Fix IE cloning issues
+		if ( !support.noCloneChecked && ( elem.nodeType === 1 || elem.nodeType === 11 ) &&
+				!jQuery.isXMLDoc( elem ) ) {
+
+			// We eschew Sizzle here for performance reasons: https://jsperf.com/getall-vs-sizzle/2
+			destElements = getAll( clone );
+			srcElements = getAll( elem );
+
+			for ( i = 0, l = srcElements.length; i < l; i++ ) {
+				fixInput( srcElements[ i ], destElements[ i ] );
+			}
+		}
+
+		// Copy the events from the original to the clone
+		if ( dataAndEvents ) {
+			if ( deepDataAndEvents ) {
+				srcElements = srcElements || getAll( elem );
+				destElements = destElements || getAll( clone );
+
+				for ( i = 0, l = srcElements.length; i < l; i++ ) {
+					cloneCopyEvent( srcElements[ i ], destElements[ i ] );
+				}
+			} else {
+				cloneCopyEvent( elem, clone );
+			}
+		}
+
+		// Preserve script evaluation history
+		destElements = getAll( clone, "script" );
+		if ( destElements.length > 0 ) {
+			setGlobalEval( destElements, !inPage && getAll( elem, "script" ) );
+		}
+
+		// Return the cloned set
+		return clone;
+	},
+
+	cleanData: function( elems ) {
+		var data, elem, type,
+			special = jQuery.event.special,
+			i = 0;
+
+		for ( ; ( elem = elems[ i ] ) !== undefined; i++ ) {
+			if ( acceptData( elem ) ) {
+				if ( ( data = elem[ dataPriv.expando ] ) ) {
+					if ( data.events ) {
+						for ( type in data.events ) {
+							if ( special[ type ] ) {
+								jQuery.event.remove( elem, type );
+
+							// This is a shortcut to avoid jQuery.event.remove's overhead
+							} else {
+								jQuery.removeEvent( elem, type, data.handle );
+							}
+						}
+					}
+
+					// Support: Chrome <=35 - 45+
+					// Assign undefined instead of using delete, see Data#remove
+					elem[ dataPriv.expando ] = undefined;
+				}
+				if ( elem[ dataUser.expando ] ) {
+
+					// Support: Chrome <=35 - 45+
+					// Assign undefined instead of using delete, see Data#remove
+					elem[ dataUser.expando ] = undefined;
+				}
+			}
+		}
+	}
+} );
+
+jQuery.fn.extend( {
+	detach: function( selector ) {
+		return remove( this, selector, true );
+	},
+
+	remove: function( selector ) {
+		return remove( this, selector );
+	},
+
+	text: function( value ) {
+		return access( this, function( value ) {
+			return value === undefined ?
+				jQuery.text( this ) :
+				this.empty().each( function() {
+					if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) {
+						this.textContent = value;
+					}
+				} );
+		}, null, value, arguments.length );
+	},
+
+	append: function() {
+		return domManip( this, arguments, function( elem ) {
+			if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) {
+				var target = manipulationTarget( this, elem );
+				target.appendChild( elem );
+			}
+		} );
+	},
+
+	prepend: function() {
+		return domManip( this, arguments, function( elem ) {
+			if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) {
+				var target = manipulationTarget( this, elem );
+				target.insertBefore( elem, target.firstChild );
+			}
+		} );
+	},
+
+	before: function() {
+		return domManip( this, arguments, function( elem ) {
+			if ( this.parentNode ) {
+				this.parentNode.insertBefore( elem, this );
+			}
+		} );
+	},
+
+	after: function() {
+		return domManip( this, arguments, function( elem ) {
+			if ( this.parentNode ) {
+				this.parentNode.insertBefore( elem, this.nextSibling );
+			}
+		} );
+	},
+
+	empty: function() {
+		var elem,
+			i = 0;
+
+		for ( ; ( elem = this[ i ] ) != null; i++ ) {
+			if ( elem.nodeType === 1 ) {
+
+				// Prevent memory leaks
+				jQuery.cleanData( getAll( elem, false ) );
+
+				// Remove any remaining nodes
+				elem.textContent = "";
+			}
+		}
+
+		return this;
+	},
+
+	clone: function( dataAndEvents, deepDataAndEvents ) {
+		dataAndEvents = dataAndEvents == null ? false : dataAndEvents;
+		deepDataAndEvents = deepDataAndEvents == null ? dataAndEvents : deepDataAndEvents;
+
+		return this.map( function() {
+			return jQuery.clone( this, dataAndEvents, deepDataAndEvents );
+		} );
+	},
+
+	html: function( value ) {
+		return access( this, function( value ) {
+			var elem = this[ 0 ] || {},
+				i = 0,
+				l = this.length;
+
+			if ( value === undefined && elem.nodeType === 1 ) {
+				return elem.innerHTML;
+			}
+
+			// See if we can take a shortcut and just use innerHTML
+			if ( typeof value === "string" && !rnoInnerhtml.test( value ) &&
+				!wrapMap[ ( rtagName.exec( value ) || [ "", "" ] )[ 1 ].toLowerCase() ] ) {
+
+				value = jQuery.htmlPrefilter( value );
+
+				try {
+					for ( ; i < l; i++ ) {
+						elem = this[ i ] || {};
+
+						// Remove element nodes and prevent memory leaks
+						if ( elem.nodeType === 1 ) {
+							jQuery.cleanData( getAll( elem, false ) );
+							elem.innerHTML = value;
+						}
+					}
+
+					elem = 0;
+
+				// If using innerHTML throws an exception, use the fallback method
+				} catch ( e ) {}
+			}
+
+			if ( elem ) {
+				this.empty().append( value );
+			}
+		}, null, value, arguments.length );
+	},
+
+	replaceWith: function() {
+		var ignored = [];
+
+		// Make the changes, replacing each non-ignored context element with the new content
+		return domManip( this, arguments, function( elem ) {
+			var parent = this.parentNode;
+
+			if ( jQuery.inArray( this, ignored ) < 0 ) {
+				jQuery.cleanData( getAll( this ) );
+				if ( parent ) {
+					parent.replaceChild( elem, this );
+				}
+			}
+
+		// Force callback invocation
+		}, ignored );
+	}
+} );
+
+jQuery.each( {
+	appendTo: "append",
+	prependTo: "prepend",
+	insertBefore: "before",
+	insertAfter: "after",
+	replaceAll: "replaceWith"
+}, function( name, original ) {
+	jQuery.fn[ name ] = function( selector ) {
+		var elems,
+			ret = [],
+			insert = jQuery( selector ),
+			last = insert.length - 1,
+			i = 0;
+
+		for ( ; i <= last; i++ ) {
+			elems = i === last ? this : this.clone( true );
+			jQuery( insert[ i ] )[ original ]( elems );
+
+			// Support: Android <=4.0 only, PhantomJS 1 only
+			// .get() because push.apply(_, arraylike) throws on ancient WebKit
+			push.apply( ret, elems.get() );
+		}
+
+		return this.pushStack( ret );
+	};
+} );
+var rnumnonpx = new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" );
+
+var getStyles = function( elem ) {
+
+		// Support: IE <=11 only, Firefox <=30 (#15098, #14150)
+		// IE throws on elements created in popups
+		// FF meanwhile throws on frame elements through "defaultView.getComputedStyle"
+		var view = elem.ownerDocument.defaultView;
+
+		if ( !view || !view.opener ) {
+			view = window;
+		}
+
+		return view.getComputedStyle( elem );
+	};
+
+var swap = function( elem, options, callback ) {
+	var ret, name,
+		old = {};
+
+	// Remember the old values, and insert the new ones
+	for ( name in options ) {
+		old[ name ] = elem.style[ name ];
+		elem.style[ name ] = options[ name ];
+	}
+
+	ret = callback.call( elem );
+
+	// Revert the old values
+	for ( name in options ) {
+		elem.style[ name ] = old[ name ];
+	}
+
+	return ret;
+};
+
+
+var rboxStyle = new RegExp( cssExpand.join( "|" ), "i" );
+
+
+
+( function() {
+
+	// Executing both pixelPosition & boxSizingReliable tests require only one layout
+	// so they're executed at the same time to save the second computation.
+	function computeStyleTests() {
+
+		// This is a singleton, we need to execute it only once
+		if ( !div ) {
+			return;
+		}
+
+		container.style.cssText = "position:absolute;left:-11111px;width:60px;" +
+			"margin-top:1px;padding:0;border:0";
+		div.style.cssText =
+			"position:relative;display:block;box-sizing:border-box;overflow:scroll;" +
+			"margin:auto;border:1px;padding:1px;" +
+			"width:60%;top:1%";
+		documentElement.appendChild( container ).appendChild( div );
+
+		var divStyle = window.getComputedStyle( div );
+		pixelPositionVal = divStyle.top !== "1%";
+
+		// Support: Android 4.0 - 4.3 only, Firefox <=3 - 44
+		reliableMarginLeftVal = roundPixelMeasures( divStyle.marginLeft ) === 12;
+
+		// Support: Android 4.0 - 4.3 only, Safari <=9.1 - 10.1, iOS <=7.0 - 9.3
+		// Some styles come back with percentage values, even though they shouldn't
+		div.style.right = "60%";
+		pixelBoxStylesVal = roundPixelMeasures( divStyle.right ) === 36;
+
+		// Support: IE 9 - 11 only
+		// Detect misreporting of content dimensions for box-sizing:border-box elements
+		boxSizingReliableVal = roundPixelMeasures( divStyle.width ) === 36;
+
+		// Support: IE 9 only
+		// Detect overflow:scroll screwiness (gh-3699)
+		// Support: Chrome <=64
+		// Don't get tricked when zoom affects offsetWidth (gh-4029)
+		div.style.position = "absolute";
+		scrollboxSizeVal = roundPixelMeasures( div.offsetWidth / 3 ) === 12;
+
+		documentElement.removeChild( container );
+
+		// Nullify the div so it wouldn't be stored in the memory and
+		// it will also be a sign that checks already performed
+		div = null;
+	}
+
+	function roundPixelMeasures( measure ) {
+		return Math.round( parseFloat( measure ) );
+	}
+
+	var pixelPositionVal, boxSizingReliableVal, scrollboxSizeVal, pixelBoxStylesVal,
+		reliableTrDimensionsVal, reliableMarginLeftVal,
+		container = document.createElement( "div" ),
+		div = document.createElement( "div" );
+
+	// Finish early in limited (non-browser) environments
+	if ( !div.style ) {
+		return;
+	}
+
+	// Support: IE <=9 - 11 only
+	// Style of cloned element affects source element cloned (#8908)
+	div.style.backgroundClip = "content-box";
+	div.cloneNode( true ).style.backgroundClip = "";
+	support.clearCloneStyle = div.style.backgroundClip === "content-box";
+
+	jQuery.extend( support, {
+		boxSizingReliable: function() {
+			computeStyleTests();
+			return boxSizingReliableVal;
+		},
+		pixelBoxStyles: function() {
+			computeStyleTests();
+			return pixelBoxStylesVal;
+		},
+		pixelPosition: function() {
+			computeStyleTests();
+			return pixelPositionVal;
+		},
+		reliableMarginLeft: function() {
+			computeStyleTests();
+			return reliableMarginLeftVal;
+		},
+		scrollboxSize: function() {
+			computeStyleTests();
+			return scrollboxSizeVal;
+		},
+
+		// Support: IE 9 - 11+, Edge 15 - 18+
+		// IE/Edge misreport `getComputedStyle` of table rows with width/height
+		// set in CSS while `offset*` properties report correct values.
+		// Behavior in IE 9 is more subtle than in newer versions & it passes
+		// some versions of this test; make sure not to make it pass there!
+		//
+		// Support: Firefox 70+
+		// Only Firefox includes border widths
+		// in computed dimensions. (gh-4529)
+		reliableTrDimensions: function() {
+			var table, tr, trChild, trStyle;
+			if ( reliableTrDimensionsVal == null ) {
+				table = document.createElement( "table" );
+				tr = document.createElement( "tr" );
+				trChild = document.createElement( "div" );
+
+				table.style.cssText = "position:absolute;left:-11111px;border-collapse:separate";
+				tr.style.cssText = "border:1px solid";
+
+				// Support: Chrome 86+
+				// Height set through cssText does not get applied.
+				// Computed height then comes back as 0.
+				tr.style.height = "1px";
+				trChild.style.height = "9px";
+
+				// Support: Android 8 Chrome 86+
+				// In our bodyBackground.html iframe,
+				// display for all div elements is set to "inline",
+				// which causes a problem only in Android 8 Chrome 86.
+				// Ensuring the div is display: block
+				// gets around this issue.
+				trChild.style.display = "block";
+
+				documentElement
+					.appendChild( table )
+					.appendChild( tr )
+					.appendChild( trChild );
+
+				trStyle = window.getComputedStyle( tr );
+				reliableTrDimensionsVal = ( parseInt( trStyle.height, 10 ) +
+					parseInt( trStyle.borderTopWidth, 10 ) +
+					parseInt( trStyle.borderBottomWidth, 10 ) ) === tr.offsetHeight;
+
+				documentElement.removeChild( table );
+			}
+			return reliableTrDimensionsVal;
+		}
+	} );
+} )();
+
+
+function curCSS( elem, name, computed ) {
+	var width, minWidth, maxWidth, ret,
+
+		// Support: Firefox 51+
+		// Retrieving style before computed somehow
+		// fixes an issue with getting wrong values
+		// on detached elements
+		style = elem.style;
+
+	computed = computed || getStyles( elem );
+
+	// getPropertyValue is needed for:
+	//   .css('filter') (IE 9 only, #12537)
+	//   .css('--customProperty) (#3144)
+	if ( computed ) {
+		ret = computed.getPropertyValue( name ) || computed[ name ];
+
+		if ( ret === "" && !isAttached( elem ) ) {
+			ret = jQuery.style( elem, name );
+		}
+
+		// A tribute to the "awesome hack by Dean Edwards"
+		// Android Browser returns percentage for some values,
+		// but width seems to be reliably pixels.
+		// This is against the CSSOM draft spec:
+		// https://drafts.csswg.org/cssom/#resolved-values
+		if ( !support.pixelBoxStyles() && rnumnonpx.test( ret ) && rboxStyle.test( name ) ) {
+
+			// Remember the original values
+			width = style.width;
+			minWidth = style.minWidth;
+			maxWidth = style.maxWidth;
+
+			// Put in the new values to get a computed value out
+			style.minWidth = style.maxWidth = style.width = ret;
+			ret = computed.width;
+
+			// Revert the changed values
+			style.width = width;
+			style.minWidth = minWidth;
+			style.maxWidth = maxWidth;
+		}
+	}
+
+	return ret !== undefined ?
+
+		// Support: IE <=9 - 11 only
+		// IE returns zIndex value as an integer.
+		ret + "" :
+		ret;
+}
+
+
+function addGetHookIf( conditionFn, hookFn ) {
+
+	// Define the hook, we'll check on the first run if it's really needed.
+	return {
+		get: function() {
+			if ( conditionFn() ) {
+
+				// Hook not needed (or it's not possible to use it due
+				// to missing dependency), remove it.
+				delete this.get;
+				return;
+			}
+
+			// Hook needed; redefine it so that the support test is not executed again.
+			return ( this.get = hookFn ).apply( this, arguments );
+		}
+	};
+}
+
+
+var cssPrefixes = [ "Webkit", "Moz", "ms" ],
+	emptyStyle = document.createElement( "div" ).style,
+	vendorProps = {};
+
+// Return a vendor-prefixed property or undefined
+function vendorPropName( name ) {
+
+	// Check for vendor prefixed names
+	var capName = name[ 0 ].toUpperCase() + name.slice( 1 ),
+		i = cssPrefixes.length;
+
+	while ( i-- ) {
+		name = cssPrefixes[ i ] + capName;
+		if ( name in emptyStyle ) {
+			return name;
+		}
+	}
+}
+
+// Return a potentially-mapped jQuery.cssProps or vendor prefixed property
+function finalPropName( name ) {
+	var final = jQuery.cssProps[ name ] || vendorProps[ name ];
+
+	if ( final ) {
+		return final;
+	}
+	if ( name in emptyStyle ) {
+		return name;
+	}
+	return vendorProps[ name ] = vendorPropName( name ) || name;
+}
+
+
+var
+
+	// Swappable if display is none or starts with table
+	// except "table", "table-cell", or "table-caption"
+	// See here for display values: https://developer.mozilla.org/en-US/docs/CSS/display
+	rdisplayswap = /^(none|table(?!-c[ea]).+)/,
+	rcustomProp = /^--/,
+	cssShow = { position: "absolute", visibility: "hidden", display: "block" },
+	cssNormalTransform = {
+		letterSpacing: "0",
+		fontWeight: "400"
+	};
+
+function setPositiveNumber( _elem, value, subtract ) {
+
+	// Any relative (+/-) values have already been
+	// normalized at this point
+	var matches = rcssNum.exec( value );
+	return matches ?
+
+		// Guard against undefined "subtract", e.g., when used as in cssHooks
+		Math.max( 0, matches[ 2 ] - ( subtract || 0 ) ) + ( matches[ 3 ] || "px" ) :
+		value;
+}
+
+function boxModelAdjustment( elem, dimension, box, isBorderBox, styles, computedVal ) {
+	var i = dimension === "width" ? 1 : 0,
+		extra = 0,
+		delta = 0;
+
+	// Adjustment may not be necessary
+	if ( box === ( isBorderBox ? "border" : "content" ) ) {
+		return 0;
+	}
+
+	for ( ; i < 4; i += 2 ) {
+
+		// Both box models exclude margin
+		if ( box === "margin" ) {
+			delta += jQuery.css( elem, box + cssExpand[ i ], true, styles );
+		}
+
+		// If we get here with a content-box, we're seeking "padding" or "border" or "margin"
+		if ( !isBorderBox ) {
+
+			// Add padding
+			delta += jQuery.css( elem, "padding" + cssExpand[ i ], true, styles );
+
+			// For "border" or "margin", add border
+			if ( box !== "padding" ) {
+				delta += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles );
+
+			// But still keep track of it otherwise
+			} else {
+				extra += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles );
+			}
+
+		// If we get here with a border-box (content + padding + border), we're seeking "content" or
+		// "padding" or "margin"
+		} else {
+
+			// For "content", subtract padding
+			if ( box === "content" ) {
+				delta -= jQuery.css( elem, "padding" + cssExpand[ i ], true, styles );
+			}
+
+			// For "content" or "padding", subtract border
+			if ( box !== "margin" ) {
+				delta -= jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles );
+			}
+		}
+	}
+
+	// Account for positive content-box scroll gutter when requested by providing computedVal
+	if ( !isBorderBox && computedVal >= 0 ) {
+
+		// offsetWidth/offsetHeight is a rounded sum of content, padding, scroll gutter, and border
+		// Assuming integer scroll gutter, subtract the rest and round down
+		delta += Math.max( 0, Math.ceil(
+			elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] -
+			computedVal -
+			delta -
+			extra -
+			0.5
+
+		// If offsetWidth/offsetHeight is unknown, then we can't determine content-box scroll gutter
+		// Use an explicit zero to avoid NaN (gh-3964)
+		) ) || 0;
+	}
+
+	return delta;
+}
+
+function getWidthOrHeight( elem, dimension, extra ) {
+
+	// Start with computed style
+	var styles = getStyles( elem ),
+
+		// To avoid forcing a reflow, only fetch boxSizing if we need it (gh-4322).
+		// Fake content-box until we know it's needed to know the true value.
+		boxSizingNeeded = !support.boxSizingReliable() || extra,
+		isBorderBox = boxSizingNeeded &&
+			jQuery.css( elem, "boxSizing", false, styles ) === "border-box",
+		valueIsBorderBox = isBorderBox,
+
+		val = curCSS( elem, dimension, styles ),
+		offsetProp = "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 );
+
+	// Support: Firefox <=54
+	// Return a confounding non-pixel value or feign ignorance, as appropriate.
+	if ( rnumnonpx.test( val ) ) {
+		if ( !extra ) {
+			return val;
+		}
+		val = "auto";
+	}
+
+
+	// Support: IE 9 - 11 only
+	// Use offsetWidth/offsetHeight for when box sizing is unreliable.
+	// In those cases, the computed value can be trusted to be border-box.
+	if ( ( !support.boxSizingReliable() && isBorderBox ||
+
+		// Support: IE 10 - 11+, Edge 15 - 18+
+		// IE/Edge misreport `getComputedStyle` of table rows with width/height
+		// set in CSS while `offset*` properties report correct values.
+		// Interestingly, in some cases IE 9 doesn't suffer from this issue.
+		!support.reliableTrDimensions() && nodeName( elem, "tr" ) ||
+
+		// Fall back to offsetWidth/offsetHeight when value is "auto"
+		// This happens for inline elements with no explicit setting (gh-3571)
+		val === "auto" ||
+
+		// Support: Android <=4.1 - 4.3 only
+		// Also use offsetWidth/offsetHeight for misreported inline dimensions (gh-3602)
+		!parseFloat( val ) && jQuery.css( elem, "display", false, styles ) === "inline" ) &&
+
+		// Make sure the element is visible & connected
+		elem.getClientRects().length ) {
+
+		isBorderBox = jQuery.css( elem, "boxSizing", false, styles ) === "border-box";
+
+		// Where available, offsetWidth/offsetHeight approximate border box dimensions.
+		// Where not available (e.g., SVG), assume unreliable box-sizing and interpret the
+		// retrieved value as a content box dimension.
+		valueIsBorderBox = offsetProp in elem;
+		if ( valueIsBorderBox ) {
+			val = elem[ offsetProp ];
+		}
+	}
+
+	// Normalize "" and auto
+	val = parseFloat( val ) || 0;
+
+	// Adjust for the element's box model
+	return ( val +
+		boxModelAdjustment(
+			elem,
+			dimension,
+			extra || ( isBorderBox ? "border" : "content" ),
+			valueIsBorderBox,
+			styles,
+
+			// Provide the current computed size to request scroll gutter calculation (gh-3589)
+			val
+		)
+	) + "px";
+}
+
+jQuery.extend( {
+
+	// Add in style property hooks for overriding the default
+	// behavior of getting and setting a style property
+	cssHooks: {
+		opacity: {
+			get: function( elem, computed ) {
+				if ( computed ) {
+
+					// We should always get a number back from opacity
+					var ret = curCSS( elem, "opacity" );
+					return ret === "" ? "1" : ret;
+				}
+			}
+		}
+	},
+
+	// Don't automatically add "px" to these possibly-unitless properties
+	cssNumber: {
+		"animationIterationCount": true,
+		"columnCount": true,
+		"fillOpacity": true,
+		"flexGrow": true,
+		"flexShrink": true,
+		"fontWeight": true,
+		"gridArea": true,
+		"gridColumn": true,
+		"gridColumnEnd": true,
+		"gridColumnStart": true,
+		"gridRow": true,
+		"gridRowEnd": true,
+		"gridRowStart": true,
+		"lineHeight": true,
+		"opacity": true,
+		"order": true,
+		"orphans": true,
+		"widows": true,
+		"zIndex": true,
+		"zoom": true
+	},
+
+	// Add in properties whose names you wish to fix before
+	// setting or getting the value
+	cssProps: {},
+
+	// Get and set the style property on a DOM Node
+	style: function( elem, name, value, extra ) {
+
+		// Don't set styles on text and comment nodes
+		if ( !elem || elem.nodeType === 3 || elem.nodeType === 8 || !elem.style ) {
+			return;
+		}
+
+		// Make sure that we're working with the right name
+		var ret, type, hooks,
+			origName = camelCase( name ),
+			isCustomProp = rcustomProp.test( name ),
+			style = elem.style;
+
+		// Make sure that we're working with the right name. We don't
+		// want to query the value if it is a CSS custom property
+		// since they are user-defined.
+		if ( !isCustomProp ) {
+			name = finalPropName( origName );
+		}
+
+		// Gets hook for the prefixed version, then unprefixed version
+		hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ];
+
+		// Check if we're setting a value
+		if ( value !== undefined ) {
+			type = typeof value;
+
+			// Convert "+=" or "-=" to relative numbers (#7345)
+			if ( type === "string" && ( ret = rcssNum.exec( value ) ) && ret[ 1 ] ) {
+				value = adjustCSS( elem, name, ret );
+
+				// Fixes bug #9237
+				type = "number";
+			}
+
+			// Make sure that null and NaN values aren't set (#7116)
+			if ( value == null || value !== value ) {
+				return;
+			}
+
+			// If a number was passed in, add the unit (except for certain CSS properties)
+			// The isCustomProp check can be removed in jQuery 4.0 when we only auto-append
+			// "px" to a few hardcoded values.
+			if ( type === "number" && !isCustomProp ) {
+				value += ret && ret[ 3 ] || ( jQuery.cssNumber[ origName ] ? "" : "px" );
+			}
+
+			// background-* props affect original clone's values
+			if ( !support.clearCloneStyle && value === "" && name.indexOf( "background" ) === 0 ) {
+				style[ name ] = "inherit";
+			}
+
+			// If a hook was provided, use that value, otherwise just set the specified value
+			if ( !hooks || !( "set" in hooks ) ||
+				( value = hooks.set( elem, value, extra ) ) !== undefined ) {
+
+				if ( isCustomProp ) {
+					style.setProperty( name, value );
+				} else {
+					style[ name ] = value;
+				}
+			}
+
+		} else {
+
+			// If a hook was provided get the non-computed value from there
+			if ( hooks && "get" in hooks &&
+				( ret = hooks.get( elem, false, extra ) ) !== undefined ) {
+
+				return ret;
+			}
+
+			// Otherwise just get the value from the style object
+			return style[ name ];
+		}
+	},
+
+	css: function( elem, name, extra, styles ) {
+		var val, num, hooks,
+			origName = camelCase( name ),
+			isCustomProp = rcustomProp.test( name );
+
+		// Make sure that we're working with the right name. We don't
+		// want to modify the value if it is a CSS custom property
+		// since they are user-defined.
+		if ( !isCustomProp ) {
+			name = finalPropName( origName );
+		}
+
+		// Try prefixed name followed by the unprefixed name
+		hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ];
+
+		// If a hook was provided get the computed value from there
+		if ( hooks && "get" in hooks ) {
+			val = hooks.get( elem, true, extra );
+		}
+
+		// Otherwise, if a way to get the computed value exists, use that
+		if ( val === undefined ) {
+			val = curCSS( elem, name, styles );
+		}
+
+		// Convert "normal" to computed value
+		if ( val === "normal" && name in cssNormalTransform ) {
+			val = cssNormalTransform[ name ];
+		}
+
+		// Make numeric if forced or a qualifier was provided and val looks numeric
+		if ( extra === "" || extra ) {
+			num = parseFloat( val );
+			return extra === true || isFinite( num ) ? num || 0 : val;
+		}
+
+		return val;
+	}
+} );
+
+jQuery.each( [ "height", "width" ], function( _i, dimension ) {
+	jQuery.cssHooks[ dimension ] = {
+		get: function( elem, computed, extra ) {
+			if ( computed ) {
+
+				// Certain elements can have dimension info if we invisibly show them
+				// but it must have a current display style that would benefit
+				return rdisplayswap.test( jQuery.css( elem, "display" ) ) &&
+
+					// Support: Safari 8+
+					// Table columns in Safari have non-zero offsetWidth & zero
+					// getBoundingClientRect().width unless display is changed.
+					// Support: IE <=11 only
+					// Running getBoundingClientRect on a disconnected node
+					// in IE throws an error.
+					( !elem.getClientRects().length || !elem.getBoundingClientRect().width ) ?
+					swap( elem, cssShow, function() {
+						return getWidthOrHeight( elem, dimension, extra );
+					} ) :
+					getWidthOrHeight( elem, dimension, extra );
+			}
+		},
+
+		set: function( elem, value, extra ) {
+			var matches,
+				styles = getStyles( elem ),
+
+				// Only read styles.position if the test has a chance to fail
+				// to avoid forcing a reflow.
+				scrollboxSizeBuggy = !support.scrollboxSize() &&
+					styles.position === "absolute",
+
+				// To avoid forcing a reflow, only fetch boxSizing if we need it (gh-3991)
+				boxSizingNeeded = scrollboxSizeBuggy || extra,
+				isBorderBox = boxSizingNeeded &&
+					jQuery.css( elem, "boxSizing", false, styles ) === "border-box",
+				subtract = extra ?
+					boxModelAdjustment(
+						elem,
+						dimension,
+						extra,
+						isBorderBox,
+						styles
+					) :
+					0;
+
+			// Account for unreliable border-box dimensions by comparing offset* to computed and
+			// faking a content-box to get border and padding (gh-3699)
+			if ( isBorderBox && scrollboxSizeBuggy ) {
+				subtract -= Math.ceil(
+					elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] -
+					parseFloat( styles[ dimension ] ) -
+					boxModelAdjustment( elem, dimension, "border", false, styles ) -
+					0.5
+				);
+			}
+
+			// Convert to pixels if value adjustment is needed
+			if ( subtract && ( matches = rcssNum.exec( value ) ) &&
+				( matches[ 3 ] || "px" ) !== "px" ) {
+
+				elem.style[ dimension ] = value;
+				value = jQuery.css( elem, dimension );
+			}
+
+			return setPositiveNumber( elem, value, subtract );
+		}
+	};
+} );
+
+jQuery.cssHooks.marginLeft = addGetHookIf( support.reliableMarginLeft,
+	function( elem, computed ) {
+		if ( computed ) {
+			return ( parseFloat( curCSS( elem, "marginLeft" ) ) ||
+				elem.getBoundingClientRect().left -
+					swap( elem, { marginLeft: 0 }, function() {
+						return elem.getBoundingClientRect().left;
+					} )
+			) + "px";
+		}
+	}
+);
+
+// These hooks are used by animate to expand properties
+jQuery.each( {
+	margin: "",
+	padding: "",
+	border: "Width"
+}, function( prefix, suffix ) {
+	jQuery.cssHooks[ prefix + suffix ] = {
+		expand: function( value ) {
+			var i = 0,
+				expanded = {},
+
+				// Assumes a single number if not a string
+				parts = typeof value === "string" ? value.split( " " ) : [ value ];
+
+			for ( ; i < 4; i++ ) {
+				expanded[ prefix + cssExpand[ i ] + suffix ] =
+					parts[ i ] || parts[ i - 2 ] || parts[ 0 ];
+			}
+
+			return expanded;
+		}
+	};
+
+	if ( prefix !== "margin" ) {
+		jQuery.cssHooks[ prefix + suffix ].set = setPositiveNumber;
+	}
+} );
+
+jQuery.fn.extend( {
+	css: function( name, value ) {
+		return access( this, function( elem, name, value ) {
+			var styles, len,
+				map = {},
+				i = 0;
+
+			if ( Array.isArray( name ) ) {
+				styles = getStyles( elem );
+				len = name.length;
+
+				for ( ; i < len; i++ ) {
+					map[ name[ i ] ] = jQuery.css( elem, name[ i ], false, styles );
+				}
+
+				return map;
+			}
+
+			return value !== undefined ?
+				jQuery.style( elem, name, value ) :
+				jQuery.css( elem, name );
+		}, name, value, arguments.length > 1 );
+	}
+} );
+
+
+function Tween( elem, options, prop, end, easing ) {
+	return new Tween.prototype.init( elem, options, prop, end, easing );
+}
+jQuery.Tween = Tween;
+
+Tween.prototype = {
+	constructor: Tween,
+	init: function( elem, options, prop, end, easing, unit ) {
+		this.elem = elem;
+		this.prop = prop;
+		this.easing = easing || jQuery.easing._default;
+		this.options = options;
+		this.start = this.now = this.cur();
+		this.end = end;
+		this.unit = unit || ( jQuery.cssNumber[ prop ] ? "" : "px" );
+	},
+	cur: function() {
+		var hooks = Tween.propHooks[ this.prop ];
+
+		return hooks && hooks.get ?
+			hooks.get( this ) :
+			Tween.propHooks._default.get( this );
+	},
+	run: function( percent ) {
+		var eased,
+			hooks = Tween.propHooks[ this.prop ];
+
+		if ( this.options.duration ) {
+			this.pos = eased = jQuery.easing[ this.easing ](
+				percent, this.options.duration * percent, 0, 1, this.options.duration
+			);
+		} else {
+			this.pos = eased = percent;
+		}
+		this.now = ( this.end - this.start ) * eased + this.start;
+
+		if ( this.options.step ) {
+			this.options.step.call( this.elem, this.now, this );
+		}
+
+		if ( hooks && hooks.set ) {
+			hooks.set( this );
+		} else {
+			Tween.propHooks._default.set( this );
+		}
+		return this;
+	}
+};
+
+Tween.prototype.init.prototype = Tween.prototype;
+
+Tween.propHooks = {
+	_default: {
+		get: function( tween ) {
+			var result;
+
+			// Use a property on the element directly when it is not a DOM element,
+			// or when there is no matching style property that exists.
+			if ( tween.elem.nodeType !== 1 ||
+				tween.elem[ tween.prop ] != null && tween.elem.style[ tween.prop ] == null ) {
+				return tween.elem[ tween.prop ];
+			}
+
+			// Passing an empty string as a 3rd parameter to .css will automatically
+			// attempt a parseFloat and fallback to a string if the parse fails.
+			// Simple values such as "10px" are parsed to Float;
+			// complex values such as "rotate(1rad)" are returned as-is.
+			result = jQuery.css( tween.elem, tween.prop, "" );
+
+			// Empty strings, null, undefined and "auto" are converted to 0.
+			return !result || result === "auto" ? 0 : result;
+		},
+		set: function( tween ) {
+
+			// Use step hook for back compat.
+			// Use cssHook if its there.
+			// Use .style if available and use plain properties where available.
+			if ( jQuery.fx.step[ tween.prop ] ) {
+				jQuery.fx.step[ tween.prop ]( tween );
+			} else if ( tween.elem.nodeType === 1 && (
+				jQuery.cssHooks[ tween.prop ] ||
+					tween.elem.style[ finalPropName( tween.prop ) ] != null ) ) {
+				jQuery.style( tween.elem, tween.prop, tween.now + tween.unit );
+			} else {
+				tween.elem[ tween.prop ] = tween.now;
+			}
+		}
+	}
+};
+
+// Support: IE <=9 only
+// Panic based approach to setting things on disconnected nodes
+Tween.propHooks.scrollTop = Tween.propHooks.scrollLeft = {
+	set: function( tween ) {
+		if ( tween.elem.nodeType && tween.elem.parentNode ) {
+			tween.elem[ tween.prop ] = tween.now;
+		}
+	}
+};
+
+jQuery.easing = {
+	linear: function( p ) {
+		return p;
+	},
+	swing: function( p ) {
+		return 0.5 - Math.cos( p * Math.PI ) / 2;
+	},
+	_default: "swing"
+};
+
+jQuery.fx = Tween.prototype.init;
+
+// Back compat <1.8 extension point
+jQuery.fx.step = {};
+
+
+
+
+var
+	fxNow, inProgress,
+	rfxtypes = /^(?:toggle|show|hide)$/,
+	rrun = /queueHooks$/;
+
+function schedule() {
+	if ( inProgress ) {
+		if ( document.hidden === false && window.requestAnimationFrame ) {
+			window.requestAnimationFrame( schedule );
+		} else {
+			window.setTimeout( schedule, jQuery.fx.interval );
+		}
+
+		jQuery.fx.tick();
+	}
+}
+
+// Animations created synchronously will run synchronously
+function createFxNow() {
+	window.setTimeout( function() {
+		fxNow = undefined;
+	} );
+	return ( fxNow = Date.now() );
+}
+
+// Generate parameters to create a standard animation
+function genFx( type, includeWidth ) {
+	var which,
+		i = 0,
+		attrs = { height: type };
+
+	// If we include width, step value is 1 to do all cssExpand values,
+	// otherwise step value is 2 to skip over Left and Right
+	includeWidth = includeWidth ? 1 : 0;
+	for ( ; i < 4; i += 2 - includeWidth ) {
+		which = cssExpand[ i ];
+		attrs[ "margin" + which ] = attrs[ "padding" + which ] = type;
+	}
+
+	if ( includeWidth ) {
+		attrs.opacity = attrs.width = type;
+	}
+
+	return attrs;
+}
+
+function createTween( value, prop, animation ) {
+	var tween,
+		collection = ( Animation.tweeners[ prop ] || [] ).concat( Animation.tweeners[ "*" ] ),
+		index = 0,
+		length = collection.length;
+	for ( ; index < length; index++ ) {
+		if ( ( tween = collection[ index ].call( animation, prop, value ) ) ) {
+
+			// We're done with this property
+			return tween;
+		}
+	}
+}
+
+function defaultPrefilter( elem, props, opts ) {
+	var prop, value, toggle, hooks, oldfire, propTween, restoreDisplay, display,
+		isBox = "width" in props || "height" in props,
+		anim = this,
+		orig = {},
+		style = elem.style,
+		hidden = elem.nodeType && isHiddenWithinTree( elem ),
+		dataShow = dataPriv.get( elem, "fxshow" );
+
+	// Queue-skipping animations hijack the fx hooks
+	if ( !opts.queue ) {
+		hooks = jQuery._queueHooks( elem, "fx" );
+		if ( hooks.unqueued == null ) {
+			hooks.unqueued = 0;
+			oldfire = hooks.empty.fire;
+			hooks.empty.fire = function() {
+				if ( !hooks.unqueued ) {
+					oldfire();
+				}
+			};
+		}
+		hooks.unqueued++;
+
+		anim.always( function() {
+
+			// Ensure the complete handler is called before this completes
+			anim.always( function() {
+				hooks.unqueued--;
+				if ( !jQuery.queue( elem, "fx" ).length ) {
+					hooks.empty.fire();
+				}
+			} );
+		} );
+	}
+
+	// Detect show/hide animations
+	for ( prop in props ) {
+		value = props[ prop ];
+		if ( rfxtypes.test( value ) ) {
+			delete props[ prop ];
+			toggle = toggle || value === "toggle";
+			if ( value === ( hidden ? "hide" : "show" ) ) {
+
+				// Pretend to be hidden if this is a "show" and
+				// there is still data from a stopped show/hide
+				if ( value === "show" && dataShow && dataShow[ prop ] !== undefined ) {
+					hidden = true;
+
+				// Ignore all other no-op show/hide data
+				} else {
+					continue;
+				}
+			}
+			orig[ prop ] = dataShow && dataShow[ prop ] || jQuery.style( elem, prop );
+		}
+	}
+
+	// Bail out if this is a no-op like .hide().hide()
+	propTween = !jQuery.isEmptyObject( props );
+	if ( !propTween && jQuery.isEmptyObject( orig ) ) {
+		return;
+	}
+
+	// Restrict "overflow" and "display" styles during box animations
+	if ( isBox && elem.nodeType === 1 ) {
+
+		// Support: IE <=9 - 11, Edge 12 - 15
+		// Record all 3 overflow attributes because IE does not infer the shorthand
+		// from identically-valued overflowX and overflowY and Edge just mirrors
+		// the overflowX value there.
+		opts.overflow = [ style.overflow, style.overflowX, style.overflowY ];
+
+		// Identify a display type, preferring old show/hide data over the CSS cascade
+		restoreDisplay = dataShow && dataShow.display;
+		if ( restoreDisplay == null ) {
+			restoreDisplay = dataPriv.get( elem, "display" );
+		}
+		display = jQuery.css( elem, "display" );
+		if ( display === "none" ) {
+			if ( restoreDisplay ) {
+				display = restoreDisplay;
+			} else {
+
+				// Get nonempty value(s) by temporarily forcing visibility
+				showHide( [ elem ], true );
+				restoreDisplay = elem.style.display || restoreDisplay;
+				display = jQuery.css( elem, "display" );
+				showHide( [ elem ] );
+			}
+		}
+
+		// Animate inline elements as inline-block
+		if ( display === "inline" || display === "inline-block" && restoreDisplay != null ) {
+			if ( jQuery.css( elem, "float" ) === "none" ) {
+
+				// Restore the original display value at the end of pure show/hide animations
+				if ( !propTween ) {
+					anim.done( function() {
+						style.display = restoreDisplay;
+					} );
+					if ( restoreDisplay == null ) {
+						display = style.display;
+						restoreDisplay = display === "none" ? "" : display;
+					}
+				}
+				style.display = "inline-block";
+			}
+		}
+	}
+
+	if ( opts.overflow ) {
+		style.overflow = "hidden";
+		anim.always( function() {
+			style.overflow = opts.overflow[ 0 ];
+			style.overflowX = opts.overflow[ 1 ];
+			style.overflowY = opts.overflow[ 2 ];
+		} );
+	}
+
+	// Implement show/hide animations
+	propTween = false;
+	for ( prop in orig ) {
+
+		// General show/hide setup for this element animation
+		if ( !propTween ) {
+			if ( dataShow ) {
+				if ( "hidden" in dataShow ) {
+					hidden = dataShow.hidden;
+				}
+			} else {
+				dataShow = dataPriv.access( elem, "fxshow", { display: restoreDisplay } );
+			}
+
+			// Store hidden/visible for toggle so `.stop().toggle()` "reverses"
+			if ( toggle ) {
+				dataShow.hidden = !hidden;
+			}
+
+			// Show elements before animating them
+			if ( hidden ) {
+				showHide( [ elem ], true );
+			}
+
+			/* eslint-disable no-loop-func */
+
+			anim.done( function() {
+
+				/* eslint-enable no-loop-func */
+
+				// The final step of a "hide" animation is actually hiding the element
+				if ( !hidden ) {
+					showHide( [ elem ] );
+				}
+				dataPriv.remove( elem, "fxshow" );
+				for ( prop in orig ) {
+					jQuery.style( elem, prop, orig[ prop ] );
+				}
+			} );
+		}
+
+		// Per-property setup
+		propTween = createTween( hidden ? dataShow[ prop ] : 0, prop, anim );
+		if ( !( prop in dataShow ) ) {
+			dataShow[ prop ] = propTween.start;
+			if ( hidden ) {
+				propTween.end = propTween.start;
+				propTween.start = 0;
+			}
+		}
+	}
+}
+
+function propFilter( props, specialEasing ) {
+	var index, name, easing, value, hooks;
+
+	// camelCase, specialEasing and expand cssHook pass
+	for ( index in props ) {
+		name = camelCase( index );
+		easing = specialEasing[ name ];
+		value = props[ index ];
+		if ( Array.isArray( value ) ) {
+			easing = value[ 1 ];
+			value = props[ index ] = value[ 0 ];
+		}
+
+		if ( index !== name ) {
+			props[ name ] = value;
+			delete props[ index ];
+		}
+
+		hooks = jQuery.cssHooks[ name ];
+		if ( hooks && "expand" in hooks ) {
+			value = hooks.expand( value );
+			delete props[ name ];
+
+			// Not quite $.extend, this won't overwrite existing keys.
+			// Reusing 'index' because we have the correct "name"
+			for ( index in value ) {
+				if ( !( index in props ) ) {
+					props[ index ] = value[ index ];
+					specialEasing[ index ] = easing;
+				}
+			}
+		} else {
+			specialEasing[ name ] = easing;
+		}
+	}
+}
+
+function Animation( elem, properties, options ) {
+	var result,
+		stopped,
+		index = 0,
+		length = Animation.prefilters.length,
+		deferred = jQuery.Deferred().always( function() {
+
+			// Don't match elem in the :animated selector
+			delete tick.elem;
+		} ),
+		tick = function() {
+			if ( stopped ) {
+				return false;
+			}
+			var currentTime = fxNow || createFxNow(),
+				remaining = Math.max( 0, animation.startTime + animation.duration - currentTime ),
+
+				// Support: Android 2.3 only
+				// Archaic crash bug won't allow us to use `1 - ( 0.5 || 0 )` (#12497)
+				temp = remaining / animation.duration || 0,
+				percent = 1 - temp,
+				index = 0,
+				length = animation.tweens.length;
+
+			for ( ; index < length; index++ ) {
+				animation.tweens[ index ].run( percent );
+			}
+
+			deferred.notifyWith( elem, [ animation, percent, remaining ] );
+
+			// If there's more to do, yield
+			if ( percent < 1 && length ) {
+				return remaining;
+			}
+
+			// If this was an empty animation, synthesize a final progress notification
+			if ( !length ) {
+				deferred.notifyWith( elem, [ animation, 1, 0 ] );
+			}
+
+			// Resolve the animation and report its conclusion
+			deferred.resolveWith( elem, [ animation ] );
+			return false;
+		},
+		animation = deferred.promise( {
+			elem: elem,
+			props: jQuery.extend( {}, properties ),
+			opts: jQuery.extend( true, {
+				specialEasing: {},
+				easing: jQuery.easing._default
+			}, options ),
+			originalProperties: properties,
+			originalOptions: options,
+			startTime: fxNow || createFxNow(),
+			duration: options.duration,
+			tweens: [],
+			createTween: function( prop, end ) {
+				var tween = jQuery.Tween( elem, animation.opts, prop, end,
+					animation.opts.specialEasing[ prop ] || animation.opts.easing );
+				animation.tweens.push( tween );
+				return tween;
+			},
+			stop: function( gotoEnd ) {
+				var index = 0,
+
+					// If we are going to the end, we want to run all the tweens
+					// otherwise we skip this part
+					length = gotoEnd ? animation.tweens.length : 0;
+				if ( stopped ) {
+					return this;
+				}
+				stopped = true;
+				for ( ; index < length; index++ ) {
+					animation.tweens[ index ].run( 1 );
+				}
+
+				// Resolve when we played the last frame; otherwise, reject
+				if ( gotoEnd ) {
+					deferred.notifyWith( elem, [ animation, 1, 0 ] );
+					deferred.resolveWith( elem, [ animation, gotoEnd ] );
+				} else {
+					deferred.rejectWith( elem, [ animation, gotoEnd ] );
+				}
+				return this;
+			}
+		} ),
+		props = animation.props;
+
+	propFilter( props, animation.opts.specialEasing );
+
+	for ( ; index < length; index++ ) {
+		result = Animation.prefilters[ index ].call( animation, elem, props, animation.opts );
+		if ( result ) {
+			if ( isFunction( result.stop ) ) {
+				jQuery._queueHooks( animation.elem, animation.opts.queue ).stop =
+					result.stop.bind( result );
+			}
+			return result;
+		}
+	}
+
+	jQuery.map( props, createTween, animation );
+
+	if ( isFunction( animation.opts.start ) ) {
+		animation.opts.start.call( elem, animation );
+	}
+
+	// Attach callbacks from options
+	animation
+		.progress( animation.opts.progress )
+		.done( animation.opts.done, animation.opts.complete )
+		.fail( animation.opts.fail )
+		.always( animation.opts.always );
+
+	jQuery.fx.timer(
+		jQuery.extend( tick, {
+			elem: elem,
+			anim: animation,
+			queue: animation.opts.queue
+		} )
+	);
+
+	return animation;
+}
+
+jQuery.Animation = jQuery.extend( Animation, {
+
+	tweeners: {
+		"*": [ function( prop, value ) {
+			var tween = this.createTween( prop, value );
+			adjustCSS( tween.elem, prop, rcssNum.exec( value ), tween );
+			return tween;
+		} ]
+	},
+
+	tweener: function( props, callback ) {
+		if ( isFunction( props ) ) {
+			callback = props;
+			props = [ "*" ];
+		} else {
+			props = props.match( rnothtmlwhite );
+		}
+
+		var prop,
+			index = 0,
+			length = props.length;
+
+		for ( ; index < length; index++ ) {
+			prop = props[ index ];
+			Animation.tweeners[ prop ] = Animation.tweeners[ prop ] || [];
+			Animation.tweeners[ prop ].unshift( callback );
+		}
+	},
+
+	prefilters: [ defaultPrefilter ],
+
+	prefilter: function( callback, prepend ) {
+		if ( prepend ) {
+			Animation.prefilters.unshift( callback );
+		} else {
+			Animation.prefilters.push( callback );
+		}
+	}
+} );
+
+jQuery.speed = function( speed, easing, fn ) {
+	var opt = speed && typeof speed === "object" ? jQuery.extend( {}, speed ) : {
+		complete: fn || !fn && easing ||
+			isFunction( speed ) && speed,
+		duration: speed,
+		easing: fn && easing || easing && !isFunction( easing ) && easing
+	};
+
+	// Go to the end state if fx are off
+	if ( jQuery.fx.off ) {
+		opt.duration = 0;
+
+	} else {
+		if ( typeof opt.duration !== "number" ) {
+			if ( opt.duration in jQuery.fx.speeds ) {
+				opt.duration = jQuery.fx.speeds[ opt.duration ];
+
+			} else {
+				opt.duration = jQuery.fx.speeds._default;
+			}
+		}
+	}
+
+	// Normalize opt.queue - true/undefined/null -> "fx"
+	if ( opt.queue == null || opt.queue === true ) {
+		opt.queue = "fx";
+	}
+
+	// Queueing
+	opt.old = opt.complete;
+
+	opt.complete = function() {
+		if ( isFunction( opt.old ) ) {
+			opt.old.call( this );
+		}
+
+		if ( opt.queue ) {
+			jQuery.dequeue( this, opt.queue );
+		}
+	};
+
+	return opt;
+};
+
+jQuery.fn.extend( {
+	fadeTo: function( speed, to, easing, callback ) {
+
+		// Show any hidden elements after setting opacity to 0
+		return this.filter( isHiddenWithinTree ).css( "opacity", 0 ).show()
+
+			// Animate to the value specified
+			.end().animate( { opacity: to }, speed, easing, callback );
+	},
+	animate: function( prop, speed, easing, callback ) {
+		var empty = jQuery.isEmptyObject( prop ),
+			optall = jQuery.speed( speed, easing, callback ),
+			doAnimation = function() {
+
+				// Operate on a copy of prop so per-property easing won't be lost
+				var anim = Animation( this, jQuery.extend( {}, prop ), optall );
+
+				// Empty animations, or finishing resolves immediately
+				if ( empty || dataPriv.get( this, "finish" ) ) {
+					anim.stop( true );
+				}
+			};
+
+		doAnimation.finish = doAnimation;
+
+		return empty || optall.queue === false ?
+			this.each( doAnimation ) :
+			this.queue( optall.queue, doAnimation );
+	},
+	stop: function( type, clearQueue, gotoEnd ) {
+		var stopQueue = function( hooks ) {
+			var stop = hooks.stop;
+			delete hooks.stop;
+			stop( gotoEnd );
+		};
+
+		if ( typeof type !== "string" ) {
+			gotoEnd = clearQueue;
+			clearQueue = type;
+			type = undefined;
+		}
+		if ( clearQueue ) {
+			this.queue( type || "fx", [] );
+		}
+
+		return this.each( function() {
+			var dequeue = true,
+				index = type != null && type + "queueHooks",
+				timers = jQuery.timers,
+				data = dataPriv.get( this );
+
+			if ( index ) {
+				if ( data[ index ] && data[ index ].stop ) {
+					stopQueue( data[ index ] );
+				}
+			} else {
+				for ( index in data ) {
+					if ( data[ index ] && data[ index ].stop && rrun.test( index ) ) {
+						stopQueue( data[ index ] );
+					}
+				}
+			}
+
+			for ( index = timers.length; index--; ) {
+				if ( timers[ index ].elem === this &&
+					( type == null || timers[ index ].queue === type ) ) {
+
+					timers[ index ].anim.stop( gotoEnd );
+					dequeue = false;
+					timers.splice( index, 1 );
+				}
+			}
+
+			// Start the next in the queue if the last step wasn't forced.
+			// Timers currently will call their complete callbacks, which
+			// will dequeue but only if they were gotoEnd.
+			if ( dequeue || !gotoEnd ) {
+				jQuery.dequeue( this, type );
+			}
+		} );
+	},
+	finish: function( type ) {
+		if ( type !== false ) {
+			type = type || "fx";
+		}
+		return this.each( function() {
+			var index,
+				data = dataPriv.get( this ),
+				queue = data[ type + "queue" ],
+				hooks = data[ type + "queueHooks" ],
+				timers = jQuery.timers,
+				length = queue ? queue.length : 0;
+
+			// Enable finishing flag on private data
+			data.finish = true;
+
+			// Empty the queue first
+			jQuery.queue( this, type, [] );
+
+			if ( hooks && hooks.stop ) {
+				hooks.stop.call( this, true );
+			}
+
+			// Look for any active animations, and finish them
+			for ( index = timers.length; index--; ) {
+				if ( timers[ index ].elem === this && timers[ index ].queue === type ) {
+					timers[ index ].anim.stop( true );
+					timers.splice( index, 1 );
+				}
+			}
+
+			// Look for any animations in the old queue and finish them
+			for ( index = 0; index < length; index++ ) {
+				if ( queue[ index ] && queue[ index ].finish ) {
+					queue[ index ].finish.call( this );
+				}
+			}
+
+			// Turn off finishing flag
+			delete data.finish;
+		} );
+	}
+} );
+
+jQuery.each( [ "toggle", "show", "hide" ], function( _i, name ) {
+	var cssFn = jQuery.fn[ name ];
+	jQuery.fn[ name ] = function( speed, easing, callback ) {
+		return speed == null || typeof speed === "boolean" ?
+			cssFn.apply( this, arguments ) :
+			this.animate( genFx( name, true ), speed, easing, callback );
+	};
+} );
+
+// Generate shortcuts for custom animations
+jQuery.each( {
+	slideDown: genFx( "show" ),
+	slideUp: genFx( "hide" ),
+	slideToggle: genFx( "toggle" ),
+	fadeIn: { opacity: "show" },
+	fadeOut: { opacity: "hide" },
+	fadeToggle: { opacity: "toggle" }
+}, function( name, props ) {
+	jQuery.fn[ name ] = function( speed, easing, callback ) {
+		return this.animate( props, speed, easing, callback );
+	};
+} );
+
+jQuery.timers = [];
+jQuery.fx.tick = function() {
+	var timer,
+		i = 0,
+		timers = jQuery.timers;
+
+	fxNow = Date.now();
+
+	for ( ; i < timers.length; i++ ) {
+		timer = timers[ i ];
+
+		// Run the timer and safely remove it when done (allowing for external removal)
+		if ( !timer() && timers[ i ] === timer ) {
+			timers.splice( i--, 1 );
+		}
+	}
+
+	if ( !timers.length ) {
+		jQuery.fx.stop();
+	}
+	fxNow = undefined;
+};
+
+jQuery.fx.timer = function( timer ) {
+	jQuery.timers.push( timer );
+	jQuery.fx.start();
+};
+
+jQuery.fx.interval = 13;
+jQuery.fx.start = function() {
+	if ( inProgress ) {
+		return;
+	}
+
+	inProgress = true;
+	schedule();
+};
+
+jQuery.fx.stop = function() {
+	inProgress = null;
+};
+
+jQuery.fx.speeds = {
+	slow: 600,
+	fast: 200,
+
+	// Default speed
+	_default: 400
+};
+
+
+// Based off of the plugin by Clint Helfers, with permission.
+// https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
+jQuery.fn.delay = function( time, type ) {
+	time = jQuery.fx ? jQuery.fx.speeds[ time ] || time : time;
+	type = type || "fx";
+
+	return this.queue( type, function( next, hooks ) {
+		var timeout = window.setTimeout( next, time );
+		hooks.stop = function() {
+			window.clearTimeout( timeout );
+		};
+	} );
+};
+
+
+( function() {
+	var input = document.createElement( "input" ),
+		select = document.createElement( "select" ),
+		opt = select.appendChild( document.createElement( "option" ) );
+
+	input.type = "checkbox";
+
+	// Support: Android <=4.3 only
+	// Default value for a checkbox should be "on"
+	support.checkOn = input.value !== "";
+
+	// Support: IE <=11 only
+	// Must access selectedIndex to make default options select
+	support.optSelected = opt.selected;
+
+	// Support: IE <=11 only
+	// An input loses its value after becoming a radio
+	input = document.createElement( "input" );
+	input.value = "t";
+	input.type = "radio";
+	support.radioValue = input.value === "t";
+} )();
+
+
+var boolHook,
+	attrHandle = jQuery.expr.attrHandle;
+
+jQuery.fn.extend( {
+	attr: function( name, value ) {
+		return access( this, jQuery.attr, name, value, arguments.length > 1 );
+	},
+
+	removeAttr: function( name ) {
+		return this.each( function() {
+			jQuery.removeAttr( this, name );
+		} );
+	}
+} );
+
+jQuery.extend( {
+	attr: function( elem, name, value ) {
+		var ret, hooks,
+			nType = elem.nodeType;
+
+		// Don't get/set attributes on text, comment and attribute nodes
+		if ( nType === 3 || nType === 8 || nType === 2 ) {
+			return;
+		}
+
+		// Fallback to prop when attributes are not supported
+		if ( typeof elem.getAttribute === "undefined" ) {
+			return jQuery.prop( elem, name, value );
+		}
+
+		// Attribute hooks are determined by the lowercase version
+		// Grab necessary hook if one is defined
+		if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) {
+			hooks = jQuery.attrHooks[ name.toLowerCase() ] ||
+				( jQuery.expr.match.bool.test( name ) ? boolHook : undefined );
+		}
+
+		if ( value !== undefined ) {
+			if ( value === null ) {
+				jQuery.removeAttr( elem, name );
+				return;
+			}
+
+			if ( hooks && "set" in hooks &&
+				( ret = hooks.set( elem, value, name ) ) !== undefined ) {
+				return ret;
+			}
+
+			elem.setAttribute( name, value + "" );
+			return value;
+		}
+
+		if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) {
+			return ret;
+		}
+
+		ret = jQuery.find.attr( elem, name );
+
+		// Non-existent attributes return null, we normalize to undefined
+		return ret == null ? undefined : ret;
+	},
+
+	attrHooks: {
+		type: {
+			set: function( elem, value ) {
+				if ( !support.radioValue && value === "radio" &&
+					nodeName( elem, "input" ) ) {
+					var val = elem.value;
+					elem.setAttribute( "type", value );
+					if ( val ) {
+						elem.value = val;
+					}
+					return value;
+				}
+			}
+		}
+	},
+
+	removeAttr: function( elem, value ) {
+		var name,
+			i = 0,
+
+			// Attribute names can contain non-HTML whitespace characters
+			// https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
+			attrNames = value && value.match( rnothtmlwhite );
+
+		if ( attrNames && elem.nodeType === 1 ) {
+			while ( ( name = attrNames[ i++ ] ) ) {
+				elem.removeAttribute( name );
+			}
+		}
+	}
+} );
+
+// Hooks for boolean attributes
+boolHook = {
+	set: function( elem, value, name ) {
+		if ( value === false ) {
+
+			// Remove boolean attributes when set to false
+			jQuery.removeAttr( elem, name );
+		} else {
+			elem.setAttribute( name, name );
+		}
+		return name;
+	}
+};
+
+jQuery.each( jQuery.expr.match.bool.source.match( /\w+/g ), function( _i, name ) {
+	var getter = attrHandle[ name ] || jQuery.find.attr;
+
+	attrHandle[ name ] = function( elem, name, isXML ) {
+		var ret, handle,
+			lowercaseName = name.toLowerCase();
+
+		if ( !isXML ) {
+
+			// Avoid an infinite loop by temporarily removing this function from the getter
+			handle = attrHandle[ lowercaseName ];
+			attrHandle[ lowercaseName ] = ret;
+			ret = getter( elem, name, isXML ) != null ?
+				lowercaseName :
+				null;
+			attrHandle[ lowercaseName ] = handle;
+		}
+		return ret;
+	};
+} );
+
+
+
+
+var rfocusable = /^(?:input|select|textarea|button)$/i,
+	rclickable = /^(?:a|area)$/i;
+
+jQuery.fn.extend( {
+	prop: function( name, value ) {
+		return access( this, jQuery.prop, name, value, arguments.length > 1 );
+	},
+
+	removeProp: function( name ) {
+		return this.each( function() {
+			delete this[ jQuery.propFix[ name ] || name ];
+		} );
+	}
+} );
+
+jQuery.extend( {
+	prop: function( elem, name, value ) {
+		var ret, hooks,
+			nType = elem.nodeType;
+
+		// Don't get/set properties on text, comment and attribute nodes
+		if ( nType === 3 || nType === 8 || nType === 2 ) {
+			return;
+		}
+
+		if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) {
+
+			// Fix name and attach hooks
+			name = jQuery.propFix[ name ] || name;
+			hooks = jQuery.propHooks[ name ];
+		}
+
+		if ( value !== undefined ) {
+			if ( hooks && "set" in hooks &&
+				( ret = hooks.set( elem, value, name ) ) !== undefined ) {
+				return ret;
+			}
+
+			return ( elem[ name ] = value );
+		}
+
+		if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) {
+			return ret;
+		}
+
+		return elem[ name ];
+	},
+
+	propHooks: {
+		tabIndex: {
+			get: function( elem ) {
+
+				// Support: IE <=9 - 11 only
+				// elem.tabIndex doesn't always return the
+				// correct value when it hasn't been explicitly set
+				// https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/
+				// Use proper attribute retrieval(#12072)
+				var tabindex = jQuery.find.attr( elem, "tabindex" );
+
+				if ( tabindex ) {
+					return parseInt( tabindex, 10 );
+				}
+
+				if (
+					rfocusable.test( elem.nodeName ) ||
+					rclickable.test( elem.nodeName ) &&
+					elem.href
+				) {
+					return 0;
+				}
+
+				return -1;
+			}
+		}
+	},
+
+	propFix: {
+		"for": "htmlFor",
+		"class": "className"
+	}
+} );
+
+// Support: IE <=11 only
+// Accessing the selectedIndex property
+// forces the browser to respect setting selected
+// on the option
+// The getter ensures a default option is selected
+// when in an optgroup
+// eslint rule "no-unused-expressions" is disabled for this code
+// since it considers such accessions noop
+if ( !support.optSelected ) {
+	jQuery.propHooks.selected = {
+		get: function( elem ) {
+
+			/* eslint no-unused-expressions: "off" */
+
+			var parent = elem.parentNode;
+			if ( parent && parent.parentNode ) {
+				parent.parentNode.selectedIndex;
+			}
+			return null;
+		},
+		set: function( elem ) {
+
+			/* eslint no-unused-expressions: "off" */
+
+			var parent = elem.parentNode;
+			if ( parent ) {
+				parent.selectedIndex;
+
+				if ( parent.parentNode ) {
+					parent.parentNode.selectedIndex;
+				}
+			}
+		}
+	};
+}
+
+jQuery.each( [
+	"tabIndex",
+	"readOnly",
+	"maxLength",
+	"cellSpacing",
+	"cellPadding",
+	"rowSpan",
+	"colSpan",
+	"useMap",
+	"frameBorder",
+	"contentEditable"
+], function() {
+	jQuery.propFix[ this.toLowerCase() ] = this;
+} );
+
+
+
+
+	// Strip and collapse whitespace according to HTML spec
+	// https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
+	function stripAndCollapse( value ) {
+		var tokens = value.match( rnothtmlwhite ) || [];
+		return tokens.join( " " );
+	}
+
+
+function getClass( elem ) {
+	return elem.getAttribute && elem.getAttribute( "class" ) || "";
+}
+
+function classesToArray( value ) {
+	if ( Array.isArray( value ) ) {
+		return value;
+	}
+	if ( typeof value === "string" ) {
+		return value.match( rnothtmlwhite ) || [];
+	}
+	return [];
+}
+
+jQuery.fn.extend( {
+	addClass: function( value ) {
+		var classes, elem, cur, curValue, clazz, j, finalValue,
+			i = 0;
+
+		if ( isFunction( value ) ) {
+			return this.each( function( j ) {
+				jQuery( this ).addClass( value.call( this, j, getClass( this ) ) );
+			} );
+		}
+
+		classes = classesToArray( value );
+
+		if ( classes.length ) {
+			while ( ( elem = this[ i++ ] ) ) {
+				curValue = getClass( elem );
+				cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " );
+
+				if ( cur ) {
+					j = 0;
+					while ( ( clazz = classes[ j++ ] ) ) {
+						if ( cur.indexOf( " " + clazz + " " ) < 0 ) {
+							cur += clazz + " ";
+						}
+					}
+
+					// Only assign if different to avoid unneeded rendering.
+					finalValue = stripAndCollapse( cur );
+					if ( curValue !== finalValue ) {
+						elem.setAttribute( "class", finalValue );
+					}
+				}
+			}
+		}
+
+		return this;
+	},
+
+	removeClass: function( value ) {
+		var classes, elem, cur, curValue, clazz, j, finalValue,
+			i = 0;
+
+		if ( isFunction( value ) ) {
+			return this.each( function( j ) {
+				jQuery( this ).removeClass( value.call( this, j, getClass( this ) ) );
+			} );
+		}
+
+		if ( !arguments.length ) {
+			return this.attr( "class", "" );
+		}
+
+		classes = classesToArray( value );
+
+		if ( classes.length ) {
+			while ( ( elem = this[ i++ ] ) ) {
+				curValue = getClass( elem );
+
+				// This expression is here for better compressibility (see addClass)
+				cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " );
+
+				if ( cur ) {
+					j = 0;
+					while ( ( clazz = classes[ j++ ] ) ) {
+
+						// Remove *all* instances
+						while ( cur.indexOf( " " + clazz + " " ) > -1 ) {
+							cur = cur.replace( " " + clazz + " ", " " );
+						}
+					}
+
+					// Only assign if different to avoid unneeded rendering.
+					finalValue = stripAndCollapse( cur );
+					if ( curValue !== finalValue ) {
+						elem.setAttribute( "class", finalValue );
+					}
+				}
+			}
+		}
+
+		return this;
+	},
+
+	toggleClass: function( value, stateVal ) {
+		var type = typeof value,
+			isValidValue = type === "string" || Array.isArray( value );
+
+		if ( typeof stateVal === "boolean" && isValidValue ) {
+			return stateVal ? this.addClass( value ) : this.removeClass( value );
+		}
+
+		if ( isFunction( value ) ) {
+			return this.each( function( i ) {
+				jQuery( this ).toggleClass(
+					value.call( this, i, getClass( this ), stateVal ),
+					stateVal
+				);
+			} );
+		}
+
+		return this.each( function() {
+			var className, i, self, classNames;
+
+			if ( isValidValue ) {
+
+				// Toggle individual class names
+				i = 0;
+				self = jQuery( this );
+				classNames = classesToArray( value );
+
+				while ( ( className = classNames[ i++ ] ) ) {
+
+					// Check each className given, space separated list
+					if ( self.hasClass( className ) ) {
+						self.removeClass( className );
+					} else {
+						self.addClass( className );
+					}
+				}
+
+			// Toggle whole class name
+			} else if ( value === undefined || type === "boolean" ) {
+				className = getClass( this );
+				if ( className ) {
+
+					// Store className if set
+					dataPriv.set( this, "__className__", className );
+				}
+
+				// If the element has a class name or if we're passed `false`,
+				// then remove the whole classname (if there was one, the above saved it).
+				// Otherwise bring back whatever was previously saved (if anything),
+				// falling back to the empty string if nothing was stored.
+				if ( this.setAttribute ) {
+					this.setAttribute( "class",
+						className || value === false ?
+							"" :
+							dataPriv.get( this, "__className__" ) || ""
+					);
+				}
+			}
+		} );
+	},
+
+	hasClass: function( selector ) {
+		var className, elem,
+			i = 0;
+
+		className = " " + selector + " ";
+		while ( ( elem = this[ i++ ] ) ) {
+			if ( elem.nodeType === 1 &&
+				( " " + stripAndCollapse( getClass( elem ) ) + " " ).indexOf( className ) > -1 ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+} );
+
+
+
+
+var rreturn = /\r/g;
+
+jQuery.fn.extend( {
+	val: function( value ) {
+		var hooks, ret, valueIsFunction,
+			elem = this[ 0 ];
+
+		if ( !arguments.length ) {
+			if ( elem ) {
+				hooks = jQuery.valHooks[ elem.type ] ||
+					jQuery.valHooks[ elem.nodeName.toLowerCase() ];
+
+				if ( hooks &&
+					"get" in hooks &&
+					( ret = hooks.get( elem, "value" ) ) !== undefined
+				) {
+					return ret;
+				}
+
+				ret = elem.value;
+
+				// Handle most common string cases
+				if ( typeof ret === "string" ) {
+					return ret.replace( rreturn, "" );
+				}
+
+				// Handle cases where value is null/undef or number
+				return ret == null ? "" : ret;
+			}
+
+			return;
+		}
+
+		valueIsFunction = isFunction( value );
+
+		return this.each( function( i ) {
+			var val;
+
+			if ( this.nodeType !== 1 ) {
+				return;
+			}
+
+			if ( valueIsFunction ) {
+				val = value.call( this, i, jQuery( this ).val() );
+			} else {
+				val = value;
+			}
+
+			// Treat null/undefined as ""; convert numbers to string
+			if ( val == null ) {
+				val = "";
+
+			} else if ( typeof val === "number" ) {
+				val += "";
+
+			} else if ( Array.isArray( val ) ) {
+				val = jQuery.map( val, function( value ) {
+					return value == null ? "" : value + "";
+				} );
+			}
+
+			hooks = jQuery.valHooks[ this.type ] || jQuery.valHooks[ this.nodeName.toLowerCase() ];
+
+			// If set returns undefined, fall back to normal setting
+			if ( !hooks || !( "set" in hooks ) || hooks.set( this, val, "value" ) === undefined ) {
+				this.value = val;
+			}
+		} );
+	}
+} );
+
+jQuery.extend( {
+	valHooks: {
+		option: {
+			get: function( elem ) {
+
+				var val = jQuery.find.attr( elem, "value" );
+				return val != null ?
+					val :
+
+					// Support: IE <=10 - 11 only
+					// option.text throws exceptions (#14686, #14858)
+					// Strip and collapse whitespace
+					// https://html.spec.whatwg.org/#strip-and-collapse-whitespace
+					stripAndCollapse( jQuery.text( elem ) );
+			}
+		},
+		select: {
+			get: function( elem ) {
+				var value, option, i,
+					options = elem.options,
+					index = elem.selectedIndex,
+					one = elem.type === "select-one",
+					values = one ? null : [],
+					max = one ? index + 1 : options.length;
+
+				if ( index < 0 ) {
+					i = max;
+
+				} else {
+					i = one ? index : 0;
+				}
+
+				// Loop through all the selected options
+				for ( ; i < max; i++ ) {
+					option = options[ i ];
+
+					// Support: IE <=9 only
+					// IE8-9 doesn't update selected after form reset (#2551)
+					if ( ( option.selected || i === index ) &&
+
+							// Don't return options that are disabled or in a disabled optgroup
+							!option.disabled &&
+							( !option.parentNode.disabled ||
+								!nodeName( option.parentNode, "optgroup" ) ) ) {
+
+						// Get the specific value for the option
+						value = jQuery( option ).val();
+
+						// We don't need an array for one selects
+						if ( one ) {
+							return value;
+						}
+
+						// Multi-Selects return an array
+						values.push( value );
+					}
+				}
+
+				return values;
+			},
+
+			set: function( elem, value ) {
+				var optionSet, option,
+					options = elem.options,
+					values = jQuery.makeArray( value ),
+					i = options.length;
+
+				while ( i-- ) {
+					option = options[ i ];
+
+					/* eslint-disable no-cond-assign */
+
+					if ( option.selected =
+						jQuery.inArray( jQuery.valHooks.option.get( option ), values ) > -1
+					) {
+						optionSet = true;
+					}
+
+					/* eslint-enable no-cond-assign */
+				}
+
+				// Force browsers to behave consistently when non-matching value is set
+				if ( !optionSet ) {
+					elem.selectedIndex = -1;
+				}
+				return values;
+			}
+		}
+	}
+} );
+
+// Radios and checkboxes getter/setter
+jQuery.each( [ "radio", "checkbox" ], function() {
+	jQuery.valHooks[ this ] = {
+		set: function( elem, value ) {
+			if ( Array.isArray( value ) ) {
+				return ( elem.checked = jQuery.inArray( jQuery( elem ).val(), value ) > -1 );
+			}
+		}
+	};
+	if ( !support.checkOn ) {
+		jQuery.valHooks[ this ].get = function( elem ) {
+			return elem.getAttribute( "value" ) === null ? "on" : elem.value;
+		};
+	}
+} );
+
+
+
+
+// Return jQuery for attributes-only inclusion
+
+
+support.focusin = "onfocusin" in window;
+
+
+var rfocusMorph = /^(?:focusinfocus|focusoutblur)$/,
+	stopPropagationCallback = function( e ) {
+		e.stopPropagation();
+	};
+
+jQuery.extend( jQuery.event, {
+
+	trigger: function( event, data, elem, onlyHandlers ) {
+
+		var i, cur, tmp, bubbleType, ontype, handle, special, lastElement,
+			eventPath = [ elem || document ],
+			type = hasOwn.call( event, "type" ) ? event.type : event,
+			namespaces = hasOwn.call( event, "namespace" ) ? event.namespace.split( "." ) : [];
+
+		cur = lastElement = tmp = elem = elem || document;
+
+		// Don't do events on text and comment nodes
+		if ( elem.nodeType === 3 || elem.nodeType === 8 ) {
+			return;
+		}
+
+		// focus/blur morphs to focusin/out; ensure we're not firing them right now
+		if ( rfocusMorph.test( type + jQuery.event.triggered ) ) {
+			return;
+		}
+
+		if ( type.indexOf( "." ) > -1 ) {
+
+			// Namespaced trigger; create a regexp to match event type in handle()
+			namespaces = type.split( "." );
+			type = namespaces.shift();
+			namespaces.sort();
+		}
+		ontype = type.indexOf( ":" ) < 0 && "on" + type;
+
+		// Caller can pass in a jQuery.Event object, Object, or just an event type string
+		event = event[ jQuery.expando ] ?
+			event :
+			new jQuery.Event( type, typeof event === "object" && event );
+
+		// Trigger bitmask: & 1 for native handlers; & 2 for jQuery (always true)
+		event.isTrigger = onlyHandlers ? 2 : 3;
+		event.namespace = namespaces.join( "." );
+		event.rnamespace = event.namespace ?
+			new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) :
+			null;
+
+		// Clean up the event in case it is being reused
+		event.result = undefined;
+		if ( !event.target ) {
+			event.target = elem;
+		}
+
+		// Clone any incoming data and prepend the event, creating the handler arg list
+		data = data == null ?
+			[ event ] :
+			jQuery.makeArray( data, [ event ] );
+
+		// Allow special events to draw outside the lines
+		special = jQuery.event.special[ type ] || {};
+		if ( !onlyHandlers && special.trigger && special.trigger.apply( elem, data ) === false ) {
+			return;
+		}
+
+		// Determine event propagation path in advance, per W3C events spec (#9951)
+		// Bubble up to document, then to window; watch for a global ownerDocument var (#9724)
+		if ( !onlyHandlers && !special.noBubble && !isWindow( elem ) ) {
+
+			bubbleType = special.delegateType || type;
+			if ( !rfocusMorph.test( bubbleType + type ) ) {
+				cur = cur.parentNode;
+			}
+			for ( ; cur; cur = cur.parentNode ) {
+				eventPath.push( cur );
+				tmp = cur;
+			}
+
+			// Only add window if we got to document (e.g., not plain obj or detached DOM)
+			if ( tmp === ( elem.ownerDocument || document ) ) {
+				eventPath.push( tmp.defaultView || tmp.parentWindow || window );
+			}
+		}
+
+		// Fire handlers on the event path
+		i = 0;
+		while ( ( cur = eventPath[ i++ ] ) && !event.isPropagationStopped() ) {
+			lastElement = cur;
+			event.type = i > 1 ?
+				bubbleType :
+				special.bindType || type;
+
+			// jQuery handler
+			handle = ( dataPriv.get( cur, "events" ) || Object.create( null ) )[ event.type ] &&
+				dataPriv.get( cur, "handle" );
+			if ( handle ) {
+				handle.apply( cur, data );
+			}
+
+			// Native handler
+			handle = ontype && cur[ ontype ];
+			if ( handle && handle.apply && acceptData( cur ) ) {
+				event.result = handle.apply( cur, data );
+				if ( event.result === false ) {
+					event.preventDefault();
+				}
+			}
+		}
+		event.type = type;
+
+		// If nobody prevented the default action, do it now
+		if ( !onlyHandlers && !event.isDefaultPrevented() ) {
+
+			if ( ( !special._default ||
+				special._default.apply( eventPath.pop(), data ) === false ) &&
+				acceptData( elem ) ) {
+
+				// Call a native DOM method on the target with the same name as the event.
+				// Don't do default actions on window, that's where global variables be (#6170)
+				if ( ontype && isFunction( elem[ type ] ) && !isWindow( elem ) ) {
+
+					// Don't re-trigger an onFOO event when we call its FOO() method
+					tmp = elem[ ontype ];
+
+					if ( tmp ) {
+						elem[ ontype ] = null;
+					}
+
+					// Prevent re-triggering of the same event, since we already bubbled it above
+					jQuery.event.triggered = type;
+
+					if ( event.isPropagationStopped() ) {
+						lastElement.addEventListener( type, stopPropagationCallback );
+					}
+
+					elem[ type ]();
+
+					if ( event.isPropagationStopped() ) {
+						lastElement.removeEventListener( type, stopPropagationCallback );
+					}
+
+					jQuery.event.triggered = undefined;
+
+					if ( tmp ) {
+						elem[ ontype ] = tmp;
+					}
+				}
+			}
+		}
+
+		return event.result;
+	},
+
+	// Piggyback on a donor event to simulate a different one
+	// Used only for `focus(in | out)` events
+	simulate: function( type, elem, event ) {
+		var e = jQuery.extend(
+			new jQuery.Event(),
+			event,
+			{
+				type: type,
+				isSimulated: true
+			}
+		);
+
+		jQuery.event.trigger( e, null, elem );
+	}
+
+} );
+
+jQuery.fn.extend( {
+
+	trigger: function( type, data ) {
+		return this.each( function() {
+			jQuery.event.trigger( type, data, this );
+		} );
+	},
+	triggerHandler: function( type, data ) {
+		var elem = this[ 0 ];
+		if ( elem ) {
+			return jQuery.event.trigger( type, data, elem, true );
+		}
+	}
+} );
+
+
+// Support: Firefox <=44
+// Firefox doesn't have focus(in | out) events
+// Related ticket - https://bugzilla.mozilla.org/show_bug.cgi?id=687787
+//
+// Support: Chrome <=48 - 49, Safari <=9.0 - 9.1
+// focus(in | out) events fire after focus & blur events,
+// which is spec violation - http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order
+// Related ticket - https://bugs.chromium.org/p/chromium/issues/detail?id=449857
+if ( !support.focusin ) {
+	jQuery.each( { focus: "focusin", blur: "focusout" }, function( orig, fix ) {
+
+		// Attach a single capturing handler on the document while someone wants focusin/focusout
+		var handler = function( event ) {
+			jQuery.event.simulate( fix, event.target, jQuery.event.fix( event ) );
+		};
+
+		jQuery.event.special[ fix ] = {
+			setup: function() {
+
+				// Handle: regular nodes (via `this.ownerDocument`), window
+				// (via `this.document`) & document (via `this`).
+				var doc = this.ownerDocument || this.document || this,
+					attaches = dataPriv.access( doc, fix );
+
+				if ( !attaches ) {
+					doc.addEventListener( orig, handler, true );
+				}
+				dataPriv.access( doc, fix, ( attaches || 0 ) + 1 );
+			},
+			teardown: function() {
+				var doc = this.ownerDocument || this.document || this,
+					attaches = dataPriv.access( doc, fix ) - 1;
+
+				if ( !attaches ) {
+					doc.removeEventListener( orig, handler, true );
+					dataPriv.remove( doc, fix );
+
+				} else {
+					dataPriv.access( doc, fix, attaches );
+				}
+			}
+		};
+	} );
+}
+var location = window.location;
+
+var nonce = { guid: Date.now() };
+
+var rquery = ( /\?/ );
+
+
+
+// Cross-browser xml parsing
+jQuery.parseXML = function( data ) {
+	var xml, parserErrorElem;
+	if ( !data || typeof data !== "string" ) {
+		return null;
+	}
+
+	// Support: IE 9 - 11 only
+	// IE throws on parseFromString with invalid input.
+	try {
+		xml = ( new window.DOMParser() ).parseFromString( data, "text/xml" );
+	} catch ( e ) {}
+
+	parserErrorElem = xml && xml.getElementsByTagName( "parsererror" )[ 0 ];
+	if ( !xml || parserErrorElem ) {
+		jQuery.error( "Invalid XML: " + (
+			parserErrorElem ?
+				jQuery.map( parserErrorElem.childNodes, function( el ) {
+					return el.textContent;
+				} ).join( "\n" ) :
+				data
+		) );
+	}
+	return xml;
+};
+
+
+var
+	rbracket = /\[\]$/,
+	rCRLF = /\r?\n/g,
+	rsubmitterTypes = /^(?:submit|button|image|reset|file)$/i,
+	rsubmittable = /^(?:input|select|textarea|keygen)/i;
+
+function buildParams( prefix, obj, traditional, add ) {
+	var name;
+
+	if ( Array.isArray( obj ) ) {
+
+		// Serialize array item.
+		jQuery.each( obj, function( i, v ) {
+			if ( traditional || rbracket.test( prefix ) ) {
+
+				// Treat each array item as a scalar.
+				add( prefix, v );
+
+			} else {
+
+				// Item is non-scalar (array or object), encode its numeric index.
+				buildParams(
+					prefix + "[" + ( typeof v === "object" && v != null ? i : "" ) + "]",
+					v,
+					traditional,
+					add
+				);
+			}
+		} );
+
+	} else if ( !traditional && toType( obj ) === "object" ) {
+
+		// Serialize object item.
+		for ( name in obj ) {
+			buildParams( prefix + "[" + name + "]", obj[ name ], traditional, add );
+		}
+
+	} else {
+
+		// Serialize scalar item.
+		add( prefix, obj );
+	}
+}
+
+// Serialize an array of form elements or a set of
+// key/values into a query string
+jQuery.param = function( a, traditional ) {
+	var prefix,
+		s = [],
+		add = function( key, valueOrFunction ) {
+
+			// If value is a function, invoke it and use its return value
+			var value = isFunction( valueOrFunction ) ?
+				valueOrFunction() :
+				valueOrFunction;
+
+			s[ s.length ] = encodeURIComponent( key ) + "=" +
+				encodeURIComponent( value == null ? "" : value );
+		};
+
+	if ( a == null ) {
+		return "";
+	}
+
+	// If an array was passed in, assume that it is an array of form elements.
+	if ( Array.isArray( a ) || ( a.jquery && !jQuery.isPlainObject( a ) ) ) {
+
+		// Serialize the form elements
+		jQuery.each( a, function() {
+			add( this.name, this.value );
+		} );
+
+	} else {
+
+		// If traditional, encode the "old" way (the way 1.3.2 or older
+		// did it), otherwise encode params recursively.
+		for ( prefix in a ) {
+			buildParams( prefix, a[ prefix ], traditional, add );
+		}
+	}
+
+	// Return the resulting serialization
+	return s.join( "&" );
+};
+
+jQuery.fn.extend( {
+	serialize: function() {
+		return jQuery.param( this.serializeArray() );
+	},
+	serializeArray: function() {
+		return this.map( function() {
+
+			// Can add propHook for "elements" to filter or add form elements
+			var elements = jQuery.prop( this, "elements" );
+			return elements ? jQuery.makeArray( elements ) : this;
+		} ).filter( function() {
+			var type = this.type;
+
+			// Use .is( ":disabled" ) so that fieldset[disabled] works
+			return this.name && !jQuery( this ).is( ":disabled" ) &&
+				rsubmittable.test( this.nodeName ) && !rsubmitterTypes.test( type ) &&
+				( this.checked || !rcheckableType.test( type ) );
+		} ).map( function( _i, elem ) {
+			var val = jQuery( this ).val();
+
+			if ( val == null ) {
+				return null;
+			}
+
+			if ( Array.isArray( val ) ) {
+				return jQuery.map( val, function( val ) {
+					return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) };
+				} );
+			}
+
+			return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) };
+		} ).get();
+	}
+} );
+
+
+var
+	r20 = /%20/g,
+	rhash = /#.*$/,
+	rantiCache = /([?&])_=[^&]*/,
+	rheaders = /^(.*?):[ \t]*([^\r\n]*)$/mg,
+
+	// #7653, #8125, #8152: local protocol detection
+	rlocalProtocol = /^(?:about|app|app-storage|.+-extension|file|res|widget):$/,
+	rnoContent = /^(?:GET|HEAD)$/,
+	rprotocol = /^\/\//,
+
+	/* Prefilters
+	 * 1) They are useful to introduce custom dataTypes (see ajax/jsonp.js for an example)
+	 * 2) These are called:
+	 *    - BEFORE asking for a transport
+	 *    - AFTER param serialization (s.data is a string if s.processData is true)
+	 * 3) key is the dataType
+	 * 4) the catchall symbol "*" can be used
+	 * 5) execution will start with transport dataType and THEN continue down to "*" if needed
+	 */
+	prefilters = {},
+
+	/* Transports bindings
+	 * 1) key is the dataType
+	 * 2) the catchall symbol "*" can be used
+	 * 3) selection will start with transport dataType and THEN go to "*" if needed
+	 */
+	transports = {},
+
+	// Avoid comment-prolog char sequence (#10098); must appease lint and evade compression
+	allTypes = "*/".concat( "*" ),
+
+	// Anchor tag for parsing the document origin
+	originAnchor = document.createElement( "a" );
+
+originAnchor.href = location.href;
+
+// Base "constructor" for jQuery.ajaxPrefilter and jQuery.ajaxTransport
+function addToPrefiltersOrTransports( structure ) {
+
+	// dataTypeExpression is optional and defaults to "*"
+	return function( dataTypeExpression, func ) {
+
+		if ( typeof dataTypeExpression !== "string" ) {
+			func = dataTypeExpression;
+			dataTypeExpression = "*";
+		}
+
+		var dataType,
+			i = 0,
+			dataTypes = dataTypeExpression.toLowerCase().match( rnothtmlwhite ) || [];
+
+		if ( isFunction( func ) ) {
+
+			// For each dataType in the dataTypeExpression
+			while ( ( dataType = dataTypes[ i++ ] ) ) {
+
+				// Prepend if requested
+				if ( dataType[ 0 ] === "+" ) {
+					dataType = dataType.slice( 1 ) || "*";
+					( structure[ dataType ] = structure[ dataType ] || [] ).unshift( func );
+
+				// Otherwise append
+				} else {
+					( structure[ dataType ] = structure[ dataType ] || [] ).push( func );
+				}
+			}
+		}
+	};
+}
+
+// Base inspection function for prefilters and transports
+function inspectPrefiltersOrTransports( structure, options, originalOptions, jqXHR ) {
+
+	var inspected = {},
+		seekingTransport = ( structure === transports );
+
+	function inspect( dataType ) {
+		var selected;
+		inspected[ dataType ] = true;
+		jQuery.each( structure[ dataType ] || [], function( _, prefilterOrFactory ) {
+			var dataTypeOrTransport = prefilterOrFactory( options, originalOptions, jqXHR );
+			if ( typeof dataTypeOrTransport === "string" &&
+				!seekingTransport && !inspected[ dataTypeOrTransport ] ) {
+
+				options.dataTypes.unshift( dataTypeOrTransport );
+				inspect( dataTypeOrTransport );
+				return false;
+			} else if ( seekingTransport ) {
+				return !( selected = dataTypeOrTransport );
+			}
+		} );
+		return selected;
+	}
+
+	return inspect( options.dataTypes[ 0 ] ) || !inspected[ "*" ] && inspect( "*" );
+}
+
+// A special extend for ajax options
+// that takes "flat" options (not to be deep extended)
+// Fixes #9887
+function ajaxExtend( target, src ) {
+	var key, deep,
+		flatOptions = jQuery.ajaxSettings.flatOptions || {};
+
+	for ( key in src ) {
+		if ( src[ key ] !== undefined ) {
+			( flatOptions[ key ] ? target : ( deep || ( deep = {} ) ) )[ key ] = src[ key ];
+		}
+	}
+	if ( deep ) {
+		jQuery.extend( true, target, deep );
+	}
+
+	return target;
+}
+
+/* Handles responses to an ajax request:
+ * - finds the right dataType (mediates between content-type and expected dataType)
+ * - returns the corresponding response
+ */
+function ajaxHandleResponses( s, jqXHR, responses ) {
+
+	var ct, type, finalDataType, firstDataType,
+		contents = s.contents,
+		dataTypes = s.dataTypes;
+
+	// Remove auto dataType and get content-type in the process
+	while ( dataTypes[ 0 ] === "*" ) {
+		dataTypes.shift();
+		if ( ct === undefined ) {
+			ct = s.mimeType || jqXHR.getResponseHeader( "Content-Type" );
+		}
+	}
+
+	// Check if we're dealing with a known content-type
+	if ( ct ) {
+		for ( type in contents ) {
+			if ( contents[ type ] && contents[ type ].test( ct ) ) {
+				dataTypes.unshift( type );
+				break;
+			}
+		}
+	}
+
+	// Check to see if we have a response for the expected dataType
+	if ( dataTypes[ 0 ] in responses ) {
+		finalDataType = dataTypes[ 0 ];
+	} else {
+
+		// Try convertible dataTypes
+		for ( type in responses ) {
+			if ( !dataTypes[ 0 ] || s.converters[ type + " " + dataTypes[ 0 ] ] ) {
+				finalDataType = type;
+				break;
+			}
+			if ( !firstDataType ) {
+				firstDataType = type;
+			}
+		}
+
+		// Or just use first one
+		finalDataType = finalDataType || firstDataType;
+	}
+
+	// If we found a dataType
+	// We add the dataType to the list if needed
+	// and return the corresponding response
+	if ( finalDataType ) {
+		if ( finalDataType !== dataTypes[ 0 ] ) {
+			dataTypes.unshift( finalDataType );
+		}
+		return responses[ finalDataType ];
+	}
+}
+
+/* Chain conversions given the request and the original response
+ * Also sets the responseXXX fields on the jqXHR instance
+ */
+function ajaxConvert( s, response, jqXHR, isSuccess ) {
+	var conv2, current, conv, tmp, prev,
+		converters = {},
+
+		// Work with a copy of dataTypes in case we need to modify it for conversion
+		dataTypes = s.dataTypes.slice();
+
+	// Create converters map with lowercased keys
+	if ( dataTypes[ 1 ] ) {
+		for ( conv in s.converters ) {
+			converters[ conv.toLowerCase() ] = s.converters[ conv ];
+		}
+	}
+
+	current = dataTypes.shift();
+
+	// Convert to each sequential dataType
+	while ( current ) {
+
+		if ( s.responseFields[ current ] ) {
+			jqXHR[ s.responseFields[ current ] ] = response;
+		}
+
+		// Apply the dataFilter if provided
+		if ( !prev && isSuccess && s.dataFilter ) {
+			response = s.dataFilter( response, s.dataType );
+		}
+
+		prev = current;
+		current = dataTypes.shift();
+
+		if ( current ) {
+
+			// There's only work to do if current dataType is non-auto
+			if ( current === "*" ) {
+
+				current = prev;
+
+			// Convert response if prev dataType is non-auto and differs from current
+			} else if ( prev !== "*" && prev !== current ) {
+
+				// Seek a direct converter
+				conv = converters[ prev + " " + current ] || converters[ "* " + current ];
+
+				// If none found, seek a pair
+				if ( !conv ) {
+					for ( conv2 in converters ) {
+
+						// If conv2 outputs current
+						tmp = conv2.split( " " );
+						if ( tmp[ 1 ] === current ) {
+
+							// If prev can be converted to accepted input
+							conv = converters[ prev + " " + tmp[ 0 ] ] ||
+								converters[ "* " + tmp[ 0 ] ];
+							if ( conv ) {
+
+								// Condense equivalence converters
+								if ( conv === true ) {
+									conv = converters[ conv2 ];
+
+								// Otherwise, insert the intermediate dataType
+								} else if ( converters[ conv2 ] !== true ) {
+									current = tmp[ 0 ];
+									dataTypes.unshift( tmp[ 1 ] );
+								}
+								break;
+							}
+						}
+					}
+				}
+
+				// Apply converter (if not an equivalence)
+				if ( conv !== true ) {
+
+					// Unless errors are allowed to bubble, catch and return them
+					if ( conv && s.throws ) {
+						response = conv( response );
+					} else {
+						try {
+							response = conv( response );
+						} catch ( e ) {
+							return {
+								state: "parsererror",
+								error: conv ? e : "No conversion from " + prev + " to " + current
+							};
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return { state: "success", data: response };
+}
+
+jQuery.extend( {
+
+	// Counter for holding the number of active queries
+	active: 0,
+
+	// Last-Modified header cache for next request
+	lastModified: {},
+	etag: {},
+
+	ajaxSettings: {
+		url: location.href,
+		type: "GET",
+		isLocal: rlocalProtocol.test( location.protocol ),
+		global: true,
+		processData: true,
+		async: true,
+		contentType: "application/x-www-form-urlencoded; charset=UTF-8",
+
+		/*
+		timeout: 0,
+		data: null,
+		dataType: null,
+		username: null,
+		password: null,
+		cache: null,
+		throws: false,
+		traditional: false,
+		headers: {},
+		*/
+
+		accepts: {
+			"*": allTypes,
+			text: "text/plain",
+			html: "text/html",
+			xml: "application/xml, text/xml",
+			json: "application/json, text/javascript"
+		},
+
+		contents: {
+			xml: /\bxml\b/,
+			html: /\bhtml/,
+			json: /\bjson\b/
+		},
+
+		responseFields: {
+			xml: "responseXML",
+			text: "responseText",
+			json: "responseJSON"
+		},
+
+		// Data converters
+		// Keys separate source (or catchall "*") and destination types with a single space
+		converters: {
+
+			// Convert anything to text
+			"* text": String,
+
+			// Text to html (true = no transformation)
+			"text html": true,
+
+			// Evaluate text as a json expression
+			"text json": JSON.parse,
+
+			// Parse text as xml
+			"text xml": jQuery.parseXML
+		},
+
+		// For options that shouldn't be deep extended:
+		// you can add your own custom options here if
+		// and when you create one that shouldn't be
+		// deep extended (see ajaxExtend)
+		flatOptions: {
+			url: true,
+			context: true
+		}
+	},
+
+	// Creates a full fledged settings object into target
+	// with both ajaxSettings and settings fields.
+	// If target is omitted, writes into ajaxSettings.
+	ajaxSetup: function( target, settings ) {
+		return settings ?
+
+			// Building a settings object
+			ajaxExtend( ajaxExtend( target, jQuery.ajaxSettings ), settings ) :
+
+			// Extending ajaxSettings
+			ajaxExtend( jQuery.ajaxSettings, target );
+	},
+
+	ajaxPrefilter: addToPrefiltersOrTransports( prefilters ),
+	ajaxTransport: addToPrefiltersOrTransports( transports ),
+
+	// Main method
+	ajax: function( url, options ) {
+
+		// If url is an object, simulate pre-1.5 signature
+		if ( typeof url === "object" ) {
+			options = url;
+			url = undefined;
+		}
+
+		// Force options to be an object
+		options = options || {};
+
+		var transport,
+
+			// URL without anti-cache param
+			cacheURL,
+
+			// Response headers
+			responseHeadersString,
+			responseHeaders,
+
+			// timeout handle
+			timeoutTimer,
+
+			// Url cleanup var
+			urlAnchor,
+
+			// Request state (becomes false upon send and true upon completion)
+			completed,
+
+			// To know if global events are to be dispatched
+			fireGlobals,
+
+			// Loop variable
+			i,
+
+			// uncached part of the url
+			uncached,
+
+			// Create the final options object
+			s = jQuery.ajaxSetup( {}, options ),
+
+			// Callbacks context
+			callbackContext = s.context || s,
+
+			// Context for global events is callbackContext if it is a DOM node or jQuery collection
+			globalEventContext = s.context &&
+				( callbackContext.nodeType || callbackContext.jquery ) ?
+				jQuery( callbackContext ) :
+				jQuery.event,
+
+			// Deferreds
+			deferred = jQuery.Deferred(),
+			completeDeferred = jQuery.Callbacks( "once memory" ),
+
+			// Status-dependent callbacks
+			statusCode = s.statusCode || {},
+
+			// Headers (they are sent all at once)
+			requestHeaders = {},
+			requestHeadersNames = {},
+
+			// Default abort message
+			strAbort = "canceled",
+
+			// Fake xhr
+			jqXHR = {
+				readyState: 0,
+
+				// Builds headers hashtable if needed
+				getResponseHeader: function( key ) {
+					var match;
+					if ( completed ) {
+						if ( !responseHeaders ) {
+							responseHeaders = {};
+							while ( ( match = rheaders.exec( responseHeadersString ) ) ) {
+								responseHeaders[ match[ 1 ].toLowerCase() + " " ] =
+									( responseHeaders[ match[ 1 ].toLowerCase() + " " ] || [] )
+										.concat( match[ 2 ] );
+							}
+						}
+						match = responseHeaders[ key.toLowerCase() + " " ];
+					}
+					return match == null ? null : match.join( ", " );
+				},
+
+				// Raw string
+				getAllResponseHeaders: function() {
+					return completed ? responseHeadersString : null;
+				},
+
+				// Caches the header
+				setRequestHeader: function( name, value ) {
+					if ( completed == null ) {
+						name = requestHeadersNames[ name.toLowerCase() ] =
+							requestHeadersNames[ name.toLowerCase() ] || name;
+						requestHeaders[ name ] = value;
+					}
+					return this;
+				},
+
+				// Overrides response content-type header
+				overrideMimeType: function( type ) {
+					if ( completed == null ) {
+						s.mimeType = type;
+					}
+					return this;
+				},
+
+				// Status-dependent callbacks
+				statusCode: function( map ) {
+					var code;
+					if ( map ) {
+						if ( completed ) {
+
+							// Execute the appropriate callbacks
+							jqXHR.always( map[ jqXHR.status ] );
+						} else {
+
+							// Lazy-add the new callbacks in a way that preserves old ones
+							for ( code in map ) {
+								statusCode[ code ] = [ statusCode[ code ], map[ code ] ];
+							}
+						}
+					}
+					return this;
+				},
+
+				// Cancel the request
+				abort: function( statusText ) {
+					var finalText = statusText || strAbort;
+					if ( transport ) {
+						transport.abort( finalText );
+					}
+					done( 0, finalText );
+					return this;
+				}
+			};
+
+		// Attach deferreds
+		deferred.promise( jqXHR );
+
+		// Add protocol if not provided (prefilters might expect it)
+		// Handle falsy url in the settings object (#10093: consistency with old signature)
+		// We also use the url parameter if available
+		s.url = ( ( url || s.url || location.href ) + "" )
+			.replace( rprotocol, location.protocol + "//" );
+
+		// Alias method option to type as per ticket #12004
+		s.type = options.method || options.type || s.method || s.type;
+
+		// Extract dataTypes list
+		s.dataTypes = ( s.dataType || "*" ).toLowerCase().match( rnothtmlwhite ) || [ "" ];
+
+		// A cross-domain request is in order when the origin doesn't match the current origin.
+		if ( s.crossDomain == null ) {
+			urlAnchor = document.createElement( "a" );
+
+			// Support: IE <=8 - 11, Edge 12 - 15
+			// IE throws exception on accessing the href property if url is malformed,
+			// e.g. http://example.com:80x/
+			try {
+				urlAnchor.href = s.url;
+
+				// Support: IE <=8 - 11 only
+				// Anchor's host property isn't correctly set when s.url is relative
+				urlAnchor.href = urlAnchor.href;
+				s.crossDomain = originAnchor.protocol + "//" + originAnchor.host !==
+					urlAnchor.protocol + "//" + urlAnchor.host;
+			} catch ( e ) {
+
+				// If there is an error parsing the URL, assume it is crossDomain,
+				// it can be rejected by the transport if it is invalid
+				s.crossDomain = true;
+			}
+		}
+
+		// Convert data if not already a string
+		if ( s.data && s.processData && typeof s.data !== "string" ) {
+			s.data = jQuery.param( s.data, s.traditional );
+		}
+
+		// Apply prefilters
+		inspectPrefiltersOrTransports( prefilters, s, options, jqXHR );
+
+		// If request was aborted inside a prefilter, stop there
+		if ( completed ) {
+			return jqXHR;
+		}
+
+		// We can fire global events as of now if asked to
+		// Don't fire events if jQuery.event is undefined in an AMD-usage scenario (#15118)
+		fireGlobals = jQuery.event && s.global;
+
+		// Watch for a new set of requests
+		if ( fireGlobals && jQuery.active++ === 0 ) {
+			jQuery.event.trigger( "ajaxStart" );
+		}
+
+		// Uppercase the type
+		s.type = s.type.toUpperCase();
+
+		// Determine if request has content
+		s.hasContent = !rnoContent.test( s.type );
+
+		// Save the URL in case we're toying with the If-Modified-Since
+		// and/or If-None-Match header later on
+		// Remove hash to simplify url manipulation
+		cacheURL = s.url.replace( rhash, "" );
+
+		// More options handling for requests with no content
+		if ( !s.hasContent ) {
+
+			// Remember the hash so we can put it back
+			uncached = s.url.slice( cacheURL.length );
+
+			// If data is available and should be processed, append data to url
+			if ( s.data && ( s.processData || typeof s.data === "string" ) ) {
+				cacheURL += ( rquery.test( cacheURL ) ? "&" : "?" ) + s.data;
+
+				// #9682: remove data so that it's not used in an eventual retry
+				delete s.data;
+			}
+
+			// Add or update anti-cache param if needed
+			if ( s.cache === false ) {
+				cacheURL = cacheURL.replace( rantiCache, "$1" );
+				uncached = ( rquery.test( cacheURL ) ? "&" : "?" ) + "_=" + ( nonce.guid++ ) +
+					uncached;
+			}
+
+			// Put hash and anti-cache on the URL that will be requested (gh-1732)
+			s.url = cacheURL + uncached;
+
+		// Change '%20' to '+' if this is encoded form body content (gh-2658)
+		} else if ( s.data && s.processData &&
+			( s.contentType || "" ).indexOf( "application/x-www-form-urlencoded" ) === 0 ) {
+			s.data = s.data.replace( r20, "+" );
+		}
+
+		// Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode.
+		if ( s.ifModified ) {
+			if ( jQuery.lastModified[ cacheURL ] ) {
+				jqXHR.setRequestHeader( "If-Modified-Since", jQuery.lastModified[ cacheURL ] );
+			}
+			if ( jQuery.etag[ cacheURL ] ) {
+				jqXHR.setRequestHeader( "If-None-Match", jQuery.etag[ cacheURL ] );
+			}
+		}
+
+		// Set the correct header, if data is being sent
+		if ( s.data && s.hasContent && s.contentType !== false || options.contentType ) {
+			jqXHR.setRequestHeader( "Content-Type", s.contentType );
+		}
+
+		// Set the Accepts header for the server, depending on the dataType
+		jqXHR.setRequestHeader(
+			"Accept",
+			s.dataTypes[ 0 ] && s.accepts[ s.dataTypes[ 0 ] ] ?
+				s.accepts[ s.dataTypes[ 0 ] ] +
+					( s.dataTypes[ 0 ] !== "*" ? ", " + allTypes + "; q=0.01" : "" ) :
+				s.accepts[ "*" ]
+		);
+
+		// Check for headers option
+		for ( i in s.headers ) {
+			jqXHR.setRequestHeader( i, s.headers[ i ] );
+		}
+
+		// Allow custom headers/mimetypes and early abort
+		if ( s.beforeSend &&
+			( s.beforeSend.call( callbackContext, jqXHR, s ) === false || completed ) ) {
+
+			// Abort if not done already and return
+			return jqXHR.abort();
+		}
+
+		// Aborting is no longer a cancellation
+		strAbort = "abort";
+
+		// Install callbacks on deferreds
+		completeDeferred.add( s.complete );
+		jqXHR.done( s.success );
+		jqXHR.fail( s.error );
+
+		// Get transport
+		transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR );
+
+		// If no transport, we auto-abort
+		if ( !transport ) {
+			done( -1, "No Transport" );
+		} else {
+			jqXHR.readyState = 1;
+
+			// Send global event
+			if ( fireGlobals ) {
+				globalEventContext.trigger( "ajaxSend", [ jqXHR, s ] );
+			}
+
+			// If request was aborted inside ajaxSend, stop there
+			if ( completed ) {
+				return jqXHR;
+			}
+
+			// Timeout
+			if ( s.async && s.timeout > 0 ) {
+				timeoutTimer = window.setTimeout( function() {
+					jqXHR.abort( "timeout" );
+				}, s.timeout );
+			}
+
+			try {
+				completed = false;
+				transport.send( requestHeaders, done );
+			} catch ( e ) {
+
+				// Rethrow post-completion exceptions
+				if ( completed ) {
+					throw e;
+				}
+
+				// Propagate others as results
+				done( -1, e );
+			}
+		}
+
+		// Callback for when everything is done
+		function done( status, nativeStatusText, responses, headers ) {
+			var isSuccess, success, error, response, modified,
+				statusText = nativeStatusText;
+
+			// Ignore repeat invocations
+			if ( completed ) {
+				return;
+			}
+
+			completed = true;
+
+			// Clear timeout if it exists
+			if ( timeoutTimer ) {
+				window.clearTimeout( timeoutTimer );
+			}
+
+			// Dereference transport for early garbage collection
+			// (no matter how long the jqXHR object will be used)
+			transport = undefined;
+
+			// Cache response headers
+			responseHeadersString = headers || "";
+
+			// Set readyState
+			jqXHR.readyState = status > 0 ? 4 : 0;
+
+			// Determine if successful
+			isSuccess = status >= 200 && status < 300 || status === 304;
+
+			// Get response data
+			if ( responses ) {
+				response = ajaxHandleResponses( s, jqXHR, responses );
+			}
+
+			// Use a noop converter for missing script but not if jsonp
+			if ( !isSuccess &&
+				jQuery.inArray( "script", s.dataTypes ) > -1 &&
+				jQuery.inArray( "json", s.dataTypes ) < 0 ) {
+				s.converters[ "text script" ] = function() {};
+			}
+
+			// Convert no matter what (that way responseXXX fields are always set)
+			response = ajaxConvert( s, response, jqXHR, isSuccess );
+
+			// If successful, handle type chaining
+			if ( isSuccess ) {
+
+				// Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode.
+				if ( s.ifModified ) {
+					modified = jqXHR.getResponseHeader( "Last-Modified" );
+					if ( modified ) {
+						jQuery.lastModified[ cacheURL ] = modified;
+					}
+					modified = jqXHR.getResponseHeader( "etag" );
+					if ( modified ) {
+						jQuery.etag[ cacheURL ] = modified;
+					}
+				}
+
+				// if no content
+				if ( status === 204 || s.type === "HEAD" ) {
+					statusText = "nocontent";
+
+				// if not modified
+				} else if ( status === 304 ) {
+					statusText = "notmodified";
+
+				// If we have data, let's convert it
+				} else {
+					statusText = response.state;
+					success = response.data;
+					error = response.error;
+					isSuccess = !error;
+				}
+			} else {
+
+				// Extract error from statusText and normalize for non-aborts
+				error = statusText;
+				if ( status || !statusText ) {
+					statusText = "error";
+					if ( status < 0 ) {
+						status = 0;
+					}
+				}
+			}
+
+			// Set data for the fake xhr object
+			jqXHR.status = status;
+			jqXHR.statusText = ( nativeStatusText || statusText ) + "";
+
+			// Success/Error
+			if ( isSuccess ) {
+				deferred.resolveWith( callbackContext, [ success, statusText, jqXHR ] );
+			} else {
+				deferred.rejectWith( callbackContext, [ jqXHR, statusText, error ] );
+			}
+
+			// Status-dependent callbacks
+			jqXHR.statusCode( statusCode );
+			statusCode = undefined;
+
+			if ( fireGlobals ) {
+				globalEventContext.trigger( isSuccess ? "ajaxSuccess" : "ajaxError",
+					[ jqXHR, s, isSuccess ? success : error ] );
+			}
+
+			// Complete
+			completeDeferred.fireWith( callbackContext, [ jqXHR, statusText ] );
+
+			if ( fireGlobals ) {
+				globalEventContext.trigger( "ajaxComplete", [ jqXHR, s ] );
+
+				// Handle the global AJAX counter
+				if ( !( --jQuery.active ) ) {
+					jQuery.event.trigger( "ajaxStop" );
+				}
+			}
+		}
+
+		return jqXHR;
+	},
+
+	getJSON: function( url, data, callback ) {
+		return jQuery.get( url, data, callback, "json" );
+	},
+
+	getScript: function( url, callback ) {
+		return jQuery.get( url, undefined, callback, "script" );
+	}
+} );
+
+jQuery.each( [ "get", "post" ], function( _i, method ) {
+	jQuery[ method ] = function( url, data, callback, type ) {
+
+		// Shift arguments if data argument was omitted
+		if ( isFunction( data ) ) {
+			type = type || callback;
+			callback = data;
+			data = undefined;
+		}
+
+		// The url can be an options object (which then must have .url)
+		return jQuery.ajax( jQuery.extend( {
+			url: url,
+			type: method,
+			dataType: type,
+			data: data,
+			success: callback
+		}, jQuery.isPlainObject( url ) && url ) );
+	};
+} );
+
+jQuery.ajaxPrefilter( function( s ) {
+	var i;
+	for ( i in s.headers ) {
+		if ( i.toLowerCase() === "content-type" ) {
+			s.contentType = s.headers[ i ] || "";
+		}
+	}
+} );
+
+
+jQuery._evalUrl = function( url, options, doc ) {
+	return jQuery.ajax( {
+		url: url,
+
+		// Make this explicit, since user can override this through ajaxSetup (#11264)
+		type: "GET",
+		dataType: "script",
+		cache: true,
+		async: false,
+		global: false,
+
+		// Only evaluate the response if it is successful (gh-4126)
+		// dataFilter is not invoked for failure responses, so using it instead
+		// of the default converter is kludgy but it works.
+		converters: {
+			"text script": function() {}
+		},
+		dataFilter: function( response ) {
+			jQuery.globalEval( response, options, doc );
+		}
+	} );
+};
+
+
+jQuery.fn.extend( {
+	wrapAll: function( html ) {
+		var wrap;
+
+		if ( this[ 0 ] ) {
+			if ( isFunction( html ) ) {
+				html = html.call( this[ 0 ] );
+			}
+
+			// The elements to wrap the target around
+			wrap = jQuery( html, this[ 0 ].ownerDocument ).eq( 0 ).clone( true );
+
+			if ( this[ 0 ].parentNode ) {
+				wrap.insertBefore( this[ 0 ] );
+			}
+
+			wrap.map( function() {
+				var elem = this;
+
+				while ( elem.firstElementChild ) {
+					elem = elem.firstElementChild;
+				}
+
+				return elem;
+			} ).append( this );
+		}
+
+		return this;
+	},
+
+	wrapInner: function( html ) {
+		if ( isFunction( html ) ) {
+			return this.each( function( i ) {
+				jQuery( this ).wrapInner( html.call( this, i ) );
+			} );
+		}
+
+		return this.each( function() {
+			var self = jQuery( this ),
+				contents = self.contents();
+
+			if ( contents.length ) {
+				contents.wrapAll( html );
+
+			} else {
+				self.append( html );
+			}
+		} );
+	},
+
+	wrap: function( html ) {
+		var htmlIsFunction = isFunction( html );
+
+		return this.each( function( i ) {
+			jQuery( this ).wrapAll( htmlIsFunction ? html.call( this, i ) : html );
+		} );
+	},
+
+	unwrap: function( selector ) {
+		this.parent( selector ).not( "body" ).each( function() {
+			jQuery( this ).replaceWith( this.childNodes );
+		} );
+		return this;
+	}
+} );
+
+
+jQuery.expr.pseudos.hidden = function( elem ) {
+	return !jQuery.expr.pseudos.visible( elem );
+};
+jQuery.expr.pseudos.visible = function( elem ) {
+	return !!( elem.offsetWidth || elem.offsetHeight || elem.getClientRects().length );
+};
+
+
+
+
+jQuery.ajaxSettings.xhr = function() {
+	try {
+		return new window.XMLHttpRequest();
+	} catch ( e ) {}
+};
+
+var xhrSuccessStatus = {
+
+		// File protocol always yields status code 0, assume 200
+		0: 200,
+
+		// Support: IE <=9 only
+		// #1450: sometimes IE returns 1223 when it should be 204
+		1223: 204
+	},
+	xhrSupported = jQuery.ajaxSettings.xhr();
+
+support.cors = !!xhrSupported && ( "withCredentials" in xhrSupported );
+support.ajax = xhrSupported = !!xhrSupported;
+
+jQuery.ajaxTransport( function( options ) {
+	var callback, errorCallback;
+
+	// Cross domain only allowed if supported through XMLHttpRequest
+	if ( support.cors || xhrSupported && !options.crossDomain ) {
+		return {
+			send: function( headers, complete ) {
+				var i,
+					xhr = options.xhr();
+
+				xhr.open(
+					options.type,
+					options.url,
+					options.async,
+					options.username,
+					options.password
+				);
+
+				// Apply custom fields if provided
+				if ( options.xhrFields ) {
+					for ( i in options.xhrFields ) {
+						xhr[ i ] = options.xhrFields[ i ];
+					}
+				}
+
+				// Override mime type if needed
+				if ( options.mimeType && xhr.overrideMimeType ) {
+					xhr.overrideMimeType( options.mimeType );
+				}
+
+				// X-Requested-With header
+				// For cross-domain requests, seeing as conditions for a preflight are
+				// akin to a jigsaw puzzle, we simply never set it to be sure.
+				// (it can always be set on a per-request basis or even using ajaxSetup)
+				// For same-domain requests, won't change header if already provided.
+				if ( !options.crossDomain && !headers[ "X-Requested-With" ] ) {
+					headers[ "X-Requested-With" ] = "XMLHttpRequest";
+				}
+
+				// Set headers
+				for ( i in headers ) {
+					xhr.setRequestHeader( i, headers[ i ] );
+				}
+
+				// Callback
+				callback = function( type ) {
+					return function() {
+						if ( callback ) {
+							callback = errorCallback = xhr.onload =
+								xhr.onerror = xhr.onabort = xhr.ontimeout =
+									xhr.onreadystatechange = null;
+
+							if ( type === "abort" ) {
+								xhr.abort();
+							} else if ( type === "error" ) {
+
+								// Support: IE <=9 only
+								// On a manual native abort, IE9 throws
+								// errors on any property access that is not readyState
+								if ( typeof xhr.status !== "number" ) {
+									complete( 0, "error" );
+								} else {
+									complete(
+
+										// File: protocol always yields status 0; see #8605, #14207
+										xhr.status,
+										xhr.statusText
+									);
+								}
+							} else {
+								complete(
+									xhrSuccessStatus[ xhr.status ] || xhr.status,
+									xhr.statusText,
+
+									// Support: IE <=9 only
+									// IE9 has no XHR2 but throws on binary (trac-11426)
+									// For XHR2 non-text, let the caller handle it (gh-2498)
+									( xhr.responseType || "text" ) !== "text"  ||
+									typeof xhr.responseText !== "string" ?
+										{ binary: xhr.response } :
+										{ text: xhr.responseText },
+									xhr.getAllResponseHeaders()
+								);
+							}
+						}
+					};
+				};
+
+				// Listen to events
+				xhr.onload = callback();
+				errorCallback = xhr.onerror = xhr.ontimeout = callback( "error" );
+
+				// Support: IE 9 only
+				// Use onreadystatechange to replace onabort
+				// to handle uncaught aborts
+				if ( xhr.onabort !== undefined ) {
+					xhr.onabort = errorCallback;
+				} else {
+					xhr.onreadystatechange = function() {
+
+						// Check readyState before timeout as it changes
+						if ( xhr.readyState === 4 ) {
+
+							// Allow onerror to be called first,
+							// but that will not handle a native abort
+							// Also, save errorCallback to a variable
+							// as xhr.onerror cannot be accessed
+							window.setTimeout( function() {
+								if ( callback ) {
+									errorCallback();
+								}
+							} );
+						}
+					};
+				}
+
+				// Create the abort callback
+				callback = callback( "abort" );
+
+				try {
+
+					// Do send the request (this may raise an exception)
+					xhr.send( options.hasContent && options.data || null );
+				} catch ( e ) {
+
+					// #14683: Only rethrow if this hasn't been notified as an error yet
+					if ( callback ) {
+						throw e;
+					}
+				}
+			},
+
+			abort: function() {
+				if ( callback ) {
+					callback();
+				}
+			}
+		};
+	}
+} );
+
+
+
+
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
+jQuery.ajaxPrefilter( function( s ) {
+	if ( s.crossDomain ) {
+		s.contents.script = false;
+	}
+} );
+
+// Install script dataType
+jQuery.ajaxSetup( {
+	accepts: {
+		script: "text/javascript, application/javascript, " +
+			"application/ecmascript, application/x-ecmascript"
+	},
+	contents: {
+		script: /\b(?:java|ecma)script\b/
+	},
+	converters: {
+		"text script": function( text ) {
+			jQuery.globalEval( text );
+			return text;
+		}
+	}
+} );
+
+// Handle cache's special case and crossDomain
+jQuery.ajaxPrefilter( "script", function( s ) {
+	if ( s.cache === undefined ) {
+		s.cache = false;
+	}
+	if ( s.crossDomain ) {
+		s.type = "GET";
+	}
+} );
+
+// Bind script tag hack transport
+jQuery.ajaxTransport( "script", function( s ) {
+
+	// This transport only deals with cross domain or forced-by-attrs requests
+	if ( s.crossDomain || s.scriptAttrs ) {
+		var script, callback;
+		return {
+			send: function( _, complete ) {
+				script = jQuery( "<script>" )
+					.attr( s.scriptAttrs || {} )
+					.prop( { charset: s.scriptCharset, src: s.url } )
+					.on( "load error", callback = function( evt ) {
+						script.remove();
+						callback = null;
+						if ( evt ) {
+							complete( evt.type === "error" ? 404 : 200, evt.type );
+						}
+					} );
+
+				// Use native DOM manipulation to avoid our domManip AJAX trickery
+				document.head.appendChild( script[ 0 ] );
+			},
+			abort: function() {
+				if ( callback ) {
+					callback();
+				}
+			}
+		};
+	}
+} );
+
+
+
+
+var oldCallbacks = [],
+	rjsonp = /(=)\?(?=&|$)|\?\?/;
+
+// Default jsonp settings
+jQuery.ajaxSetup( {
+	jsonp: "callback",
+	jsonpCallback: function() {
+		var callback = oldCallbacks.pop() || ( jQuery.expando + "_" + ( nonce.guid++ ) );
+		this[ callback ] = true;
+		return callback;
+	}
+} );
+
+// Detect, normalize options and install callbacks for jsonp requests
+jQuery.ajaxPrefilter( "json jsonp", function( s, originalSettings, jqXHR ) {
+
+	var callbackName, overwritten, responseContainer,
+		jsonProp = s.jsonp !== false && ( rjsonp.test( s.url ) ?
+			"url" :
+			typeof s.data === "string" &&
+				( s.contentType || "" )
+					.indexOf( "application/x-www-form-urlencoded" ) === 0 &&
+				rjsonp.test( s.data ) && "data"
+		);
+
+	// Handle iff the expected data type is "jsonp" or we have a parameter to set
+	if ( jsonProp || s.dataTypes[ 0 ] === "jsonp" ) {
+
+		// Get callback name, remembering preexisting value associated with it
+		callbackName = s.jsonpCallback = isFunction( s.jsonpCallback ) ?
+			s.jsonpCallback() :
+			s.jsonpCallback;
+
+		// Insert callback into url or form data
+		if ( jsonProp ) {
+			s[ jsonProp ] = s[ jsonProp ].replace( rjsonp, "$1" + callbackName );
+		} else if ( s.jsonp !== false ) {
+			s.url += ( rquery.test( s.url ) ? "&" : "?" ) + s.jsonp + "=" + callbackName;
+		}
+
+		// Use data converter to retrieve json after script execution
+		s.converters[ "script json" ] = function() {
+			if ( !responseContainer ) {
+				jQuery.error( callbackName + " was not called" );
+			}
+			return responseContainer[ 0 ];
+		};
+
+		// Force json dataType
+		s.dataTypes[ 0 ] = "json";
+
+		// Install callback
+		overwritten = window[ callbackName ];
+		window[ callbackName ] = function() {
+			responseContainer = arguments;
+		};
+
+		// Clean-up function (fires after converters)
+		jqXHR.always( function() {
+
+			// If previous value didn't exist - remove it
+			if ( overwritten === undefined ) {
+				jQuery( window ).removeProp( callbackName );
+
+			// Otherwise restore preexisting value
+			} else {
+				window[ callbackName ] = overwritten;
+			}
+
+			// Save back as free
+			if ( s[ callbackName ] ) {
+
+				// Make sure that re-using the options doesn't screw things around
+				s.jsonpCallback = originalSettings.jsonpCallback;
+
+				// Save the callback name for future use
+				oldCallbacks.push( callbackName );
+			}
+
+			// Call if it was a function and we have a response
+			if ( responseContainer && isFunction( overwritten ) ) {
+				overwritten( responseContainer[ 0 ] );
+			}
+
+			responseContainer = overwritten = undefined;
+		} );
+
+		// Delegate to script
+		return "script";
+	}
+} );
+
+
+
+
+// Support: Safari 8 only
+// In Safari 8 documents created via document.implementation.createHTMLDocument
+// collapse sibling forms: the second one becomes a child of the first one.
+// Because of that, this security measure has to be disabled in Safari 8.
+// https://bugs.webkit.org/show_bug.cgi?id=137337
+support.createHTMLDocument = ( function() {
+	var body = document.implementation.createHTMLDocument( "" ).body;
+	body.innerHTML = "<form></form><form></form>";
+	return body.childNodes.length === 2;
+} )();
+
+
+// Argument "data" should be string of html
+// context (optional): If specified, the fragment will be created in this context,
+// defaults to document
+// keepScripts (optional): If true, will include scripts passed in the html string
+jQuery.parseHTML = function( data, context, keepScripts ) {
+	if ( typeof data !== "string" ) {
+		return [];
+	}
+	if ( typeof context === "boolean" ) {
+		keepScripts = context;
+		context = false;
+	}
+
+	var base, parsed, scripts;
+
+	if ( !context ) {
+
+		// Stop scripts or inline event handlers from being executed immediately
+		// by using document.implementation
+		if ( support.createHTMLDocument ) {
+			context = document.implementation.createHTMLDocument( "" );
+
+			// Set the base href for the created document
+			// so any parsed elements with URLs
+			// are based on the document's URL (gh-2965)
+			base = context.createElement( "base" );
+			base.href = document.location.href;
+			context.head.appendChild( base );
+		} else {
+			context = document;
+		}
+	}
+
+	parsed = rsingleTag.exec( data );
+	scripts = !keepScripts && [];
+
+	// Single tag
+	if ( parsed ) {
+		return [ context.createElement( parsed[ 1 ] ) ];
+	}
+
+	parsed = buildFragment( [ data ], context, scripts );
+
+	if ( scripts && scripts.length ) {
+		jQuery( scripts ).remove();
+	}
+
+	return jQuery.merge( [], parsed.childNodes );
+};
+
+
+/**
+ * Load a url into a page
+ */
+jQuery.fn.load = function( url, params, callback ) {
+	var selector, type, response,
+		self = this,
+		off = url.indexOf( " " );
+
+	if ( off > -1 ) {
+		selector = stripAndCollapse( url.slice( off ) );
+		url = url.slice( 0, off );
+	}
+
+	// If it's a function
+	if ( isFunction( params ) ) {
+
+		// We assume that it's the callback
+		callback = params;
+		params = undefined;
+
+	// Otherwise, build a param string
+	} else if ( params && typeof params === "object" ) {
+		type = "POST";
+	}
+
+	// If we have elements to modify, make the request
+	if ( self.length > 0 ) {
+		jQuery.ajax( {
+			url: url,
+
+			// If "type" variable is undefined, then "GET" method will be used.
+			// Make value of this field explicit since
+			// user can override it through ajaxSetup method
+			type: type || "GET",
+			dataType: "html",
+			data: params
+		} ).done( function( responseText ) {
+
+			// Save response for use in complete callback
+			response = arguments;
+
+			self.html( selector ?
+
+				// If a selector was specified, locate the right elements in a dummy div
+				// Exclude scripts to avoid IE 'Permission Denied' errors
+				jQuery( "<div>" ).append( jQuery.parseHTML( responseText ) ).find( selector ) :
+
+				// Otherwise use the full result
+				responseText );
+
+		// If the request succeeds, this function gets "data", "status", "jqXHR"
+		// but they are ignored because response was set above.
+		// If it fails, this function gets "jqXHR", "status", "error"
+		} ).always( callback && function( jqXHR, status ) {
+			self.each( function() {
+				callback.apply( this, response || [ jqXHR.responseText, status, jqXHR ] );
+			} );
+		} );
+	}
+
+	return this;
+};
+
+
+
+
+jQuery.expr.pseudos.animated = function( elem ) {
+	return jQuery.grep( jQuery.timers, function( fn ) {
+		return elem === fn.elem;
+	} ).length;
+};
+
+
+
+
+jQuery.offset = {
+	setOffset: function( elem, options, i ) {
+		var curPosition, curLeft, curCSSTop, curTop, curOffset, curCSSLeft, calculatePosition,
+			position = jQuery.css( elem, "position" ),
+			curElem = jQuery( elem ),
+			props = {};
+
+		// Set position first, in-case top/left are set even on static elem
+		if ( position === "static" ) {
+			elem.style.position = "relative";
+		}
+
+		curOffset = curElem.offset();
+		curCSSTop = jQuery.css( elem, "top" );
+		curCSSLeft = jQuery.css( elem, "left" );
+		calculatePosition = ( position === "absolute" || position === "fixed" ) &&
+			( curCSSTop + curCSSLeft ).indexOf( "auto" ) > -1;
+
+		// Need to be able to calculate position if either
+		// top or left is auto and position is either absolute or fixed
+		if ( calculatePosition ) {
+			curPosition = curElem.position();
+			curTop = curPosition.top;
+			curLeft = curPosition.left;
+
+		} else {
+			curTop = parseFloat( curCSSTop ) || 0;
+			curLeft = parseFloat( curCSSLeft ) || 0;
+		}
+
+		if ( isFunction( options ) ) {
+
+			// Use jQuery.extend here to allow modification of coordinates argument (gh-1848)
+			options = options.call( elem, i, jQuery.extend( {}, curOffset ) );
+		}
+
+		if ( options.top != null ) {
+			props.top = ( options.top - curOffset.top ) + curTop;
+		}
+		if ( options.left != null ) {
+			props.left = ( options.left - curOffset.left ) + curLeft;
+		}
+
+		if ( "using" in options ) {
+			options.using.call( elem, props );
+
+		} else {
+			curElem.css( props );
+		}
+	}
+};
+
+jQuery.fn.extend( {
+
+	// offset() relates an element's border box to the document origin
+	offset: function( options ) {
+
+		// Preserve chaining for setter
+		if ( arguments.length ) {
+			return options === undefined ?
+				this :
+				this.each( function( i ) {
+					jQuery.offset.setOffset( this, options, i );
+				} );
+		}
+
+		var rect, win,
+			elem = this[ 0 ];
+
+		if ( !elem ) {
+			return;
+		}
+
+		// Return zeros for disconnected and hidden (display: none) elements (gh-2310)
+		// Support: IE <=11 only
+		// Running getBoundingClientRect on a
+		// disconnected node in IE throws an error
+		if ( !elem.getClientRects().length ) {
+			return { top: 0, left: 0 };
+		}
+
+		// Get document-relative position by adding viewport scroll to viewport-relative gBCR
+		rect = elem.getBoundingClientRect();
+		win = elem.ownerDocument.defaultView;
+		return {
+			top: rect.top + win.pageYOffset,
+			left: rect.left + win.pageXOffset
+		};
+	},
+
+	// position() relates an element's margin box to its offset parent's padding box
+	// This corresponds to the behavior of CSS absolute positioning
+	position: function() {
+		if ( !this[ 0 ] ) {
+			return;
+		}
+
+		var offsetParent, offset, doc,
+			elem = this[ 0 ],
+			parentOffset = { top: 0, left: 0 };
+
+		// position:fixed elements are offset from the viewport, which itself always has zero offset
+		if ( jQuery.css( elem, "position" ) === "fixed" ) {
+
+			// Assume position:fixed implies availability of getBoundingClientRect
+			offset = elem.getBoundingClientRect();
+
+		} else {
+			offset = this.offset();
+
+			// Account for the *real* offset parent, which can be the document or its root element
+			// when a statically positioned element is identified
+			doc = elem.ownerDocument;
+			offsetParent = elem.offsetParent || doc.documentElement;
+			while ( offsetParent &&
+				( offsetParent === doc.body || offsetParent === doc.documentElement ) &&
+				jQuery.css( offsetParent, "position" ) === "static" ) {
+
+				offsetParent = offsetParent.parentNode;
+			}
+			if ( offsetParent && offsetParent !== elem && offsetParent.nodeType === 1 ) {
+
+				// Incorporate borders into its offset, since they are outside its content origin
+				parentOffset = jQuery( offsetParent ).offset();
+				parentOffset.top += jQuery.css( offsetParent, "borderTopWidth", true );
+				parentOffset.left += jQuery.css( offsetParent, "borderLeftWidth", true );
+			}
+		}
+
+		// Subtract parent offsets and element margins
+		return {
+			top: offset.top - parentOffset.top - jQuery.css( elem, "marginTop", true ),
+			left: offset.left - parentOffset.left - jQuery.css( elem, "marginLeft", true )
+		};
+	},
+
+	// This method will return documentElement in the following cases:
+	// 1) For the element inside the iframe without offsetParent, this method will return
+	//    documentElement of the parent window
+	// 2) For the hidden or detached element
+	// 3) For body or html element, i.e. in case of the html node - it will return itself
+	//
+	// but those exceptions were never presented as a real life use-cases
+	// and might be considered as more preferable results.
+	//
+	// This logic, however, is not guaranteed and can change at any point in the future
+	offsetParent: function() {
+		return this.map( function() {
+			var offsetParent = this.offsetParent;
+
+			while ( offsetParent && jQuery.css( offsetParent, "position" ) === "static" ) {
+				offsetParent = offsetParent.offsetParent;
+			}
+
+			return offsetParent || documentElement;
+		} );
+	}
+} );
+
+// Create scrollLeft and scrollTop methods
+jQuery.each( { scrollLeft: "pageXOffset", scrollTop: "pageYOffset" }, function( method, prop ) {
+	var top = "pageYOffset" === prop;
+
+	jQuery.fn[ method ] = function( val ) {
+		return access( this, function( elem, method, val ) {
+
+			// Coalesce documents and windows
+			var win;
+			if ( isWindow( elem ) ) {
+				win = elem;
+			} else if ( elem.nodeType === 9 ) {
+				win = elem.defaultView;
+			}
+
+			if ( val === undefined ) {
+				return win ? win[ prop ] : elem[ method ];
+			}
+
+			if ( win ) {
+				win.scrollTo(
+					!top ? val : win.pageXOffset,
+					top ? val : win.pageYOffset
+				);
+
+			} else {
+				elem[ method ] = val;
+			}
+		}, method, val, arguments.length );
+	};
+} );
+
+// Support: Safari <=7 - 9.1, Chrome <=37 - 49
+// Add the top/left cssHooks using jQuery.fn.position
+// Webkit bug: https://bugs.webkit.org/show_bug.cgi?id=29084
+// Blink bug: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
+// getComputedStyle returns percent when specified for top/left/bottom/right;
+// rather than make the css module depend on the offset module, just check for it here
+jQuery.each( [ "top", "left" ], function( _i, prop ) {
+	jQuery.cssHooks[ prop ] = addGetHookIf( support.pixelPosition,
+		function( elem, computed ) {
+			if ( computed ) {
+				computed = curCSS( elem, prop );
+
+				// If curCSS returns percentage, fallback to offset
+				return rnumnonpx.test( computed ) ?
+					jQuery( elem ).position()[ prop ] + "px" :
+					computed;
+			}
+		}
+	);
+} );
+
+
+// Create innerHeight, innerWidth, height, width, outerHeight and outerWidth methods
+jQuery.each( { Height: "height", Width: "width" }, function( name, type ) {
+	jQuery.each( {
+		padding: "inner" + name,
+		content: type,
+		"": "outer" + name
+	}, function( defaultExtra, funcName ) {
+
+		// Margin is only for outerHeight, outerWidth
+		jQuery.fn[ funcName ] = function( margin, value ) {
+			var chainable = arguments.length && ( defaultExtra || typeof margin !== "boolean" ),
+				extra = defaultExtra || ( margin === true || value === true ? "margin" : "border" );
+
+			return access( this, function( elem, type, value ) {
+				var doc;
+
+				if ( isWindow( elem ) ) {
+
+					// $( window ).outerWidth/Height return w/h including scrollbars (gh-1729)
+					return funcName.indexOf( "outer" ) === 0 ?
+						elem[ "inner" + name ] :
+						elem.document.documentElement[ "client" + name ];
+				}
+
+				// Get document width or height
+				if ( elem.nodeType === 9 ) {
+					doc = elem.documentElement;
+
+					// Either scroll[Width/Height] or offset[Width/Height] or client[Width/Height],
+					// whichever is greatest
+					return Math.max(
+						elem.body[ "scroll" + name ], doc[ "scroll" + name ],
+						elem.body[ "offset" + name ], doc[ "offset" + name ],
+						doc[ "client" + name ]
+					);
+				}
+
+				return value === undefined ?
+
+					// Get width or height on the element, requesting but not forcing parseFloat
+					jQuery.css( elem, type, extra ) :
+
+					// Set width or height on the element
+					jQuery.style( elem, type, value, extra );
+			}, type, chainable ? margin : undefined, chainable );
+		};
+	} );
+} );
+
+
+jQuery.each( [
+	"ajaxStart",
+	"ajaxStop",
+	"ajaxComplete",
+	"ajaxError",
+	"ajaxSuccess",
+	"ajaxSend"
+], function( _i, type ) {
+	jQuery.fn[ type ] = function( fn ) {
+		return this.on( type, fn );
+	};
+} );
+
+
+
+
+jQuery.fn.extend( {
+
+	bind: function( types, data, fn ) {
+		return this.on( types, null, data, fn );
+	},
+	unbind: function( types, fn ) {
+		return this.off( types, null, fn );
+	},
+
+	delegate: function( selector, types, data, fn ) {
+		return this.on( types, selector, data, fn );
+	},
+	undelegate: function( selector, types, fn ) {
+
+		// ( namespace ) or ( selector, types [, fn] )
+		return arguments.length === 1 ?
+			this.off( selector, "**" ) :
+			this.off( types, selector || "**", fn );
+	},
+
+	hover: function( fnOver, fnOut ) {
+		return this.mouseenter( fnOver ).mouseleave( fnOut || fnOver );
+	}
+} );
+
+jQuery.each(
+	( "blur focus focusin focusout resize scroll click dblclick " +
+	"mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave " +
+	"change select submit keydown keypress keyup contextmenu" ).split( " " ),
+	function( _i, name ) {
+
+		// Handle event binding
+		jQuery.fn[ name ] = function( data, fn ) {
+			return arguments.length > 0 ?
+				this.on( name, null, data, fn ) :
+				this.trigger( name );
+		};
+	}
+);
+
+
+
+
+// Support: Android <=4.0 only
+// Make sure we trim BOM and NBSP
+var rtrim = /^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g;
+
+// Bind a function to a context, optionally partially applying any
+// arguments.
+// jQuery.proxy is deprecated to promote standards (specifically Function#bind)
+// However, it is not slated for removal any time soon
+jQuery.proxy = function( fn, context ) {
+	var tmp, args, proxy;
+
+	if ( typeof context === "string" ) {
+		tmp = fn[ context ];
+		context = fn;
+		fn = tmp;
+	}
+
+	// Quick check to determine if target is callable, in the spec
+	// this throws a TypeError, but we will just return undefined.
+	if ( !isFunction( fn ) ) {
+		return undefined;
+	}
+
+	// Simulated bind
+	args = slice.call( arguments, 2 );
+	proxy = function() {
+		return fn.apply( context || this, args.concat( slice.call( arguments ) ) );
+	};
+
+	// Set the guid of unique handler to the same of original handler, so it can be removed
+	proxy.guid = fn.guid = fn.guid || jQuery.guid++;
+
+	return proxy;
+};
+
+jQuery.holdReady = function( hold ) {
+	if ( hold ) {
+		jQuery.readyWait++;
+	} else {
+		jQuery.ready( true );
+	}
+};
+jQuery.isArray = Array.isArray;
+jQuery.parseJSON = JSON.parse;
+jQuery.nodeName = nodeName;
+jQuery.isFunction = isFunction;
+jQuery.isWindow = isWindow;
+jQuery.camelCase = camelCase;
+jQuery.type = toType;
+
+jQuery.now = Date.now;
+
+jQuery.isNumeric = function( obj ) {
+
+	// As of jQuery 3.0, isNumeric is limited to
+	// strings and numbers (primitives or objects)
+	// that can be coerced to finite numbers (gh-2662)
+	var type = jQuery.type( obj );
+	return ( type === "number" || type === "string" ) &&
+
+		// parseFloat NaNs numeric-cast false positives ("")
+		// ...but misinterprets leading-number strings, particularly hex literals ("0x...")
+		// subtraction forces infinities to NaN
+		!isNaN( obj - parseFloat( obj ) );
+};
+
+jQuery.trim = function( text ) {
+	return text == null ?
+		"" :
+		( text + "" ).replace( rtrim, "" );
+};
+
+
+
+// Register as a named AMD module, since jQuery can be concatenated with other
+// files that may use define, but not via a proper concatenation script that
+// understands anonymous AMD modules. A named AMD is safest and most robust
+// way to register. Lowercase jquery is used because AMD module names are
+// derived from file names, and jQuery is normally delivered in a lowercase
+// file name. Do this after creating the global so that if an AMD module wants
+// to call noConflict to hide this version of jQuery, it will work.
+
+// Note that for maximum portability, libraries that are not jQuery should
+// declare themselves as anonymous modules, and avoid setting a global if an
+// AMD loader is present. jQuery is a special case. For more information, see
+// https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
+
+if ( typeof define === "function" && define.amd ) {
+	define( "jquery", [], function() {
+		return jQuery;
+	} );
+}
+
+
+
+
+var
+
+	// Map over jQuery in case of overwrite
+	_jQuery = window.jQuery,
+
+	// Map over the $ in case of overwrite
+	_$ = window.$;
+
+jQuery.noConflict = function( deep ) {
+	if ( window.$ === jQuery ) {
+		window.$ = _$;
+	}
+
+	if ( deep && window.jQuery === jQuery ) {
+		window.jQuery = _jQuery;
+	}
+
+	return jQuery;
+};
+
+// Expose jQuery and $ identifiers, even in AMD
+// (#7102#comment:10, https://github.com/jquery/jquery/pull/557)
+// and CommonJS for browser emulators (#13566)
+if ( typeof noGlobal === "undefined" ) {
+	window.jQuery = window.$ = jQuery;
+}
+
+
+
+
+return jQuery;
+} );
diff --git a/_static/js/theme.js b/_static/js/theme.js
new file mode 100644
index 000000000..2defd10d7
--- /dev/null
+++ b/_static/js/theme.js
@@ -0,0 +1,265 @@
+var jQuery = (typeof(window) != 'undefined') ? window.jQuery : require('jquery');
+
+// Sphinx theme nav state
+function ThemeNav () {
+
+    var nav = {
+        navBar: null,
+        win: null,
+        winScroll: false,
+        winResize: false,
+        linkScroll: false,
+        winPosition: 0,
+        winHeight: null,
+        docHeight: null,
+        isRunning: false
+    };
+
+    nav.enable = function (withStickyNav) {
+        var self = this;
+
+        // TODO this can likely be removed once the theme javascript is broken
+        // out from the RTD assets. This just ensures old projects that are
+        // calling `enable()` get the sticky menu on by default. All other cals
+        // to `enable` should include an argument for enabling the sticky menu.
+        if (typeof(withStickyNav) == 'undefined') {
+            withStickyNav = true;
+        }
+
+        if (self.isRunning) {
+            // Only allow enabling nav logic once
+            return;
+        }
+
+        self.isRunning = true;
+        jQuery(function ($) {
+            self.init($);
+
+            self.reset();
+            self.win.on('hashchange', self.reset);
+
+            if (withStickyNav) {
+                // Set scroll monitor
+                self.win.on('scroll', function () {
+                    if (!self.linkScroll) {
+                        if (!self.winScroll) {
+                            self.winScroll = true;
+                            requestAnimationFrame(function() { self.onScroll(); });
+                        }
+                    }
+                });
+            }
+
+            // Set resize monitor
+            self.win.on('resize', function () {
+                if (!self.winResize) {
+                    self.winResize = true;
+                    requestAnimationFrame(function() { self.onResize(); });
+                }
+            });
+
+            self.onResize();
+        });
+
+    };
+
+    // TODO remove this with a split in theme and Read the Docs JS logic as
+    // well, it's only here to support 0.3.0 installs of our theme.
+    nav.enableSticky = function() {
+        this.enable(true);
+    };
+
+    nav.init = function ($) {
+        var doc = $(document),
+            self = this;
+
+        this.navBar = $('div.wy-side-scroll:first');
+        this.win = $(window);
+
+        // Set up javascript UX bits
+        $(document)
+            // Shift nav in mobile when clicking the menu.
+            .on('click', "[data-toggle='wy-nav-top']", function() {
+                $("[data-toggle='wy-nav-shift']").toggleClass("shift");
+                $("[data-toggle='rst-versions']").toggleClass("shift");
+            })
+
+            // Nav menu link click operations
+            .on('click', ".wy-menu-vertical .current ul li a", function() {
+                var target = $(this);
+                // Close menu when you click a link.
+                $("[data-toggle='wy-nav-shift']").removeClass("shift");
+                $("[data-toggle='rst-versions']").toggleClass("shift");
+                // Handle dynamic display of l3 and l4 nav lists
+                self.toggleCurrent(target);
+                self.hashChange();
+            })
+            .on('click', "[data-toggle='rst-current-version']", function() {
+                $("[data-toggle='rst-versions']").toggleClass("shift-up");
+            })
+
+        // Make tables responsive
+        $("table.docutils:not(.field-list,.footnote,.citation)")
+            .wrap("<div class='wy-table-responsive'></div>");
+
+        // Add extra class to responsive tables that contain
+        // footnotes or citations so that we can target them for styling
+        $("table.docutils.footnote")
+            .wrap("<div class='wy-table-responsive footnote'></div>");
+        $("table.docutils.citation")
+            .wrap("<div class='wy-table-responsive citation'></div>");
+
+        // Add expand links to all parents of nested ul
+        $('.wy-menu-vertical ul').not('.simple').siblings('a').each(function () {
+            var link = $(this);
+                expand =
+                    $('<button class="toctree-expand" title="Open/close menu"></button>');
+            expand.on('click', function (ev) {
+                self.toggleCurrent(link);
+                ev.stopPropagation();
+                return false;
+            });
+            link.prepend(expand);
+        });
+    };
+
+    nav.reset = function () {
+        // Get anchor from URL and open up nested nav
+        var anchor = encodeURI(window.location.hash) || '#';
+
+        try {
+            var vmenu = $('.wy-menu-vertical');
+            var link = vmenu.find('[href="' + anchor + '"]');
+            if (link.length === 0) {
+                // this link was not found in the sidebar.
+                // Find associated id element, then its closest section
+                // in the document and try with that one.
+                var id_elt = $('.document [id="' + anchor.substring(1) + '"]');
+                var closest_section = id_elt.closest('div.section');
+                link = vmenu.find('[href="#' + closest_section.attr("id") + '"]');
+                if (link.length === 0) {
+                    // still not found in the sidebar. fall back to main section
+                    link = vmenu.find('[href="#"]');
+                }
+            }
+            // If we found a matching link then reset current and re-apply
+            // otherwise retain the existing match
+            if (link.length > 0) {
+                $('.wy-menu-vertical .current')
+                    .removeClass('current')
+                    .attr('aria-expanded','false');
+                link.addClass('current')
+                    .attr('aria-expanded','true');
+                link.closest('li.toctree-l1')
+                    .parent()
+                    .addClass('current')
+                    .attr('aria-expanded','true');
+                for (let i = 1; i <= 10; i++) {
+                    link.closest('li.toctree-l' + i)
+                        .addClass('current')
+                        .attr('aria-expanded','true');
+                }
+                link[0].scrollIntoView();
+            }
+        }
+        catch (err) {
+            console.log("Error expanding nav for anchor", err);
+        }
+
+    };
+
+    nav.onScroll = function () {
+        this.winScroll = false;
+        var newWinPosition = this.win.scrollTop(),
+            winBottom = newWinPosition + this.winHeight,
+            navPosition = this.navBar.scrollTop(),
+            newNavPosition = navPosition + (newWinPosition - this.winPosition);
+        if (newWinPosition < 0 || winBottom > this.docHeight) {
+            return;
+        }
+        this.navBar.scrollTop(newNavPosition);
+        this.winPosition = newWinPosition;
+    };
+
+    nav.onResize = function () {
+        this.winResize = false;
+        this.winHeight = this.win.height();
+        this.docHeight = $(document).height();
+    };
+
+    nav.hashChange = function () {
+        this.linkScroll = true;
+        this.win.one('hashchange', function () {
+            this.linkScroll = false;
+        });
+    };
+
+    nav.toggleCurrent = function (elem) {
+        var parent_li = elem.closest('li');
+        parent_li
+            .siblings('li.current')
+            .removeClass('current')
+            .attr('aria-expanded','false');
+        parent_li
+            .siblings()
+            .find('li.current')
+            .removeClass('current')
+            .attr('aria-expanded','false');
+        var children = parent_li.find('> ul li');
+        // Don't toggle terminal elements.
+        if (children.length) {
+            children
+                .removeClass('current')
+                .attr('aria-expanded','false');
+            parent_li
+                .toggleClass('current')
+                .attr('aria-expanded', function(i, old) {
+                    return old == 'true' ? 'false' : 'true';
+                });
+        }
+    }
+
+    return nav;
+};
+
+_ThemeNav = ThemeNav();
+
+if (typeof(window) != 'undefined') {
+    window.SphinxRtdTheme = {
+        Navigation: _ThemeNav,
+        // TODO remove this once static assets are split up between the theme
+        // and Read the Docs. For now, this patches 0.3.0 to be backwards
+        // compatible with a pre-0.3.0 layout.html
+        StickyNav: _ThemeNav,
+    };
+}
+
+
+// requestAnimationFrame polyfill by Erik Möller. fixes from Paul Irish and Tino Zijdel
+// https://gist.github.com/paulirish/1579671
+// MIT license
+
+(function() {
+    var lastTime = 0;
+    var vendors = ['ms', 'moz', 'webkit', 'o'];
+    for(var x = 0; x < vendors.length && !window.requestAnimationFrame; ++x) {
+        window.requestAnimationFrame = window[vendors[x]+'RequestAnimationFrame'];
+        window.cancelAnimationFrame = window[vendors[x]+'CancelAnimationFrame']
+                                   || window[vendors[x]+'CancelRequestAnimationFrame'];
+    }
+
+    if (!window.requestAnimationFrame)
+        window.requestAnimationFrame = function(callback, element) {
+            var currTime = new Date().getTime();
+            var timeToCall = Math.max(0, 16 - (currTime - lastTime));
+            var id = window.setTimeout(function() { callback(currTime + timeToCall); },
+              timeToCall);
+            lastTime = currTime + timeToCall;
+            return id;
+        };
+
+    if (!window.cancelAnimationFrame)
+        window.cancelAnimationFrame = function(id) {
+            clearTimeout(id);
+        };
+}());
diff --git a/_static/language_data.js b/_static/language_data.js
new file mode 100644
index 000000000..863704b31
--- /dev/null
+++ b/_static/language_data.js
@@ -0,0 +1,297 @@
+/*
+ * language_data.js
+ * ~~~~~~~~~~~~~~~~
+ *
+ * This script contains the language-specific data used by searchtools.js,
+ * namely the list of stopwords, stemmer, scorer and splitter.
+ *
+ * :copyright: Copyright 2007-2021 by the Sphinx team, see AUTHORS.
+ * :license: BSD, see LICENSE for details.
+ *
+ */
+
+var stopwords = ["a","and","are","as","at","be","but","by","for","if","in","into","is","it","near","no","not","of","on","or","such","that","the","their","then","there","these","they","this","to","was","will","with"];
+
+
+/* Non-minified version is copied as a separate JS file, is available */
+
+/**
+ * Porter Stemmer
+ */
+var Stemmer = function() {
+
+  var step2list = {
+    ational: 'ate',
+    tional: 'tion',
+    enci: 'ence',
+    anci: 'ance',
+    izer: 'ize',
+    bli: 'ble',
+    alli: 'al',
+    entli: 'ent',
+    eli: 'e',
+    ousli: 'ous',
+    ization: 'ize',
+    ation: 'ate',
+    ator: 'ate',
+    alism: 'al',
+    iveness: 'ive',
+    fulness: 'ful',
+    ousness: 'ous',
+    aliti: 'al',
+    iviti: 'ive',
+    biliti: 'ble',
+    logi: 'log'
+  };
+
+  var step3list = {
+    icate: 'ic',
+    ative: '',
+    alize: 'al',
+    iciti: 'ic',
+    ical: 'ic',
+    ful: '',
+    ness: ''
+  };
+
+  var c = "[^aeiou]";          // consonant
+  var v = "[aeiouy]";          // vowel
+  var C = c + "[^aeiouy]*";    // consonant sequence
+  var V = v + "[aeiou]*";      // vowel sequence
+
+  var mgr0 = "^(" + C + ")?" + V + C;                      // [C]VC... is m>0
+  var meq1 = "^(" + C + ")?" + V + C + "(" + V + ")?$";    // [C]VC[V] is m=1
+  var mgr1 = "^(" + C + ")?" + V + C + V + C;              // [C]VCVC... is m>1
+  var s_v   = "^(" + C + ")?" + v;                         // vowel in stem
+
+  this.stemWord = function (w) {
+    var stem;
+    var suffix;
+    var firstch;
+    var origword = w;
+
+    if (w.length < 3)
+      return w;
+
+    var re;
+    var re2;
+    var re3;
+    var re4;
+
+    firstch = w.substr(0,1);
+    if (firstch == "y")
+      w = firstch.toUpperCase() + w.substr(1);
+
+    // Step 1a
+    re = /^(.+?)(ss|i)es$/;
+    re2 = /^(.+?)([^s])s$/;
+
+    if (re.test(w))
+      w = w.replace(re,"$1$2");
+    else if (re2.test(w))
+      w = w.replace(re2,"$1$2");
+
+    // Step 1b
+    re = /^(.+?)eed$/;
+    re2 = /^(.+?)(ed|ing)$/;
+    if (re.test(w)) {
+      var fp = re.exec(w);
+      re = new RegExp(mgr0);
+      if (re.test(fp[1])) {
+        re = /.$/;
+        w = w.replace(re,"");
+      }
+    }
+    else if (re2.test(w)) {
+      var fp = re2.exec(w);
+      stem = fp[1];
+      re2 = new RegExp(s_v);
+      if (re2.test(stem)) {
+        w = stem;
+        re2 = /(at|bl|iz)$/;
+        re3 = new RegExp("([^aeiouylsz])\\1$");
+        re4 = new RegExp("^" + C + v + "[^aeiouwxy]$");
+        if (re2.test(w))
+          w = w + "e";
+        else if (re3.test(w)) {
+          re = /.$/;
+          w = w.replace(re,"");
+        }
+        else if (re4.test(w))
+          w = w + "e";
+      }
+    }
+
+    // Step 1c
+    re = /^(.+?)y$/;
+    if (re.test(w)) {
+      var fp = re.exec(w);
+      stem = fp[1];
+      re = new RegExp(s_v);
+      if (re.test(stem))
+        w = stem + "i";
+    }
+
+    // Step 2
+    re = /^(.+?)(ational|tional|enci|anci|izer|bli|alli|entli|eli|ousli|ization|ation|ator|alism|iveness|fulness|ousness|aliti|iviti|biliti|logi)$/;
+    if (re.test(w)) {
+      var fp = re.exec(w);
+      stem = fp[1];
+      suffix = fp[2];
+      re = new RegExp(mgr0);
+      if (re.test(stem))
+        w = stem + step2list[suffix];
+    }
+
+    // Step 3
+    re = /^(.+?)(icate|ative|alize|iciti|ical|ful|ness)$/;
+    if (re.test(w)) {
+      var fp = re.exec(w);
+      stem = fp[1];
+      suffix = fp[2];
+      re = new RegExp(mgr0);
+      if (re.test(stem))
+        w = stem + step3list[suffix];
+    }
+
+    // Step 4
+    re = /^(.+?)(al|ance|ence|er|ic|able|ible|ant|ement|ment|ent|ou|ism|ate|iti|ous|ive|ize)$/;
+    re2 = /^(.+?)(s|t)(ion)$/;
+    if (re.test(w)) {
+      var fp = re.exec(w);
+      stem = fp[1];
+      re = new RegExp(mgr1);
+      if (re.test(stem))
+        w = stem;
+    }
+    else if (re2.test(w)) {
+      var fp = re2.exec(w);
+      stem = fp[1] + fp[2];
+      re2 = new RegExp(mgr1);
+      if (re2.test(stem))
+        w = stem;
+    }
+
+    // Step 5
+    re = /^(.+?)e$/;
+    if (re.test(w)) {
+      var fp = re.exec(w);
+      stem = fp[1];
+      re = new RegExp(mgr1);
+      re2 = new RegExp(meq1);
+      re3 = new RegExp("^" + C + v + "[^aeiouwxy]$");
+      if (re.test(stem) || (re2.test(stem) && !(re3.test(stem))))
+        w = stem;
+    }
+    re = /ll$/;
+    re2 = new RegExp(mgr1);
+    if (re.test(w) && re2.test(w)) {
+      re = /.$/;
+      w = w.replace(re,"");
+    }
+
+    // and turn initial Y back to y
+    if (firstch == "y")
+      w = firstch.toLowerCase() + w.substr(1);
+    return w;
+  }
+}
+
+
+
+
+var splitChars = (function() {
+    var result = {};
+    var singles = [96, 180, 187, 191, 215, 247, 749, 885, 903, 907, 909, 930, 1014, 1648,
+         1748, 1809, 2416, 2473, 2481, 2526, 2601, 2609, 2612, 2615, 2653, 2702,
+         2706, 2729, 2737, 2740, 2857, 2865, 2868, 2910, 2928, 2948, 2961, 2971,
+         2973, 3085, 3089, 3113, 3124, 3213, 3217, 3241, 3252, 3295, 3341, 3345,
+         3369, 3506, 3516, 3633, 3715, 3721, 3736, 3744, 3748, 3750, 3756, 3761,
+         3781, 3912, 4239, 4347, 4681, 4695, 4697, 4745, 4785, 4799, 4801, 4823,
+         4881, 5760, 5901, 5997, 6313, 7405, 8024, 8026, 8028, 8030, 8117, 8125,
+         8133, 8181, 8468, 8485, 8487, 8489, 8494, 8527, 11311, 11359, 11687, 11695,
+         11703, 11711, 11719, 11727, 11735, 12448, 12539, 43010, 43014, 43019, 43587,
+         43696, 43713, 64286, 64297, 64311, 64317, 64319, 64322, 64325, 65141];
+    var i, j, start, end;
+    for (i = 0; i < singles.length; i++) {
+        result[singles[i]] = true;
+    }
+    var ranges = [[0, 47], [58, 64], [91, 94], [123, 169], [171, 177], [182, 184], [706, 709],
+         [722, 735], [741, 747], [751, 879], [888, 889], [894, 901], [1154, 1161],
+         [1318, 1328], [1367, 1368], [1370, 1376], [1416, 1487], [1515, 1519], [1523, 1568],
+         [1611, 1631], [1642, 1645], [1750, 1764], [1767, 1773], [1789, 1790], [1792, 1807],
+         [1840, 1868], [1958, 1968], [1970, 1983], [2027, 2035], [2038, 2041], [2043, 2047],
+         [2070, 2073], [2075, 2083], [2085, 2087], [2089, 2307], [2362, 2364], [2366, 2383],
+         [2385, 2391], [2402, 2405], [2419, 2424], [2432, 2436], [2445, 2446], [2449, 2450],
+         [2483, 2485], [2490, 2492], [2494, 2509], [2511, 2523], [2530, 2533], [2546, 2547],
+         [2554, 2564], [2571, 2574], [2577, 2578], [2618, 2648], [2655, 2661], [2672, 2673],
+         [2677, 2692], [2746, 2748], [2750, 2767], [2769, 2783], [2786, 2789], [2800, 2820],
+         [2829, 2830], [2833, 2834], [2874, 2876], [2878, 2907], [2914, 2917], [2930, 2946],
+         [2955, 2957], [2966, 2968], [2976, 2978], [2981, 2983], [2987, 2989], [3002, 3023],
+         [3025, 3045], [3059, 3076], [3130, 3132], [3134, 3159], [3162, 3167], [3170, 3173],
+         [3184, 3191], [3199, 3204], [3258, 3260], [3262, 3293], [3298, 3301], [3312, 3332],
+         [3386, 3388], [3390, 3423], [3426, 3429], [3446, 3449], [3456, 3460], [3479, 3481],
+         [3518, 3519], [3527, 3584], [3636, 3647], [3655, 3663], [3674, 3712], [3717, 3718],
+         [3723, 3724], [3726, 3731], [3752, 3753], [3764, 3772], [3774, 3775], [3783, 3791],
+         [3802, 3803], [3806, 3839], [3841, 3871], [3892, 3903], [3949, 3975], [3980, 4095],
+         [4139, 4158], [4170, 4175], [4182, 4185], [4190, 4192], [4194, 4196], [4199, 4205],
+         [4209, 4212], [4226, 4237], [4250, 4255], [4294, 4303], [4349, 4351], [4686, 4687],
+         [4702, 4703], [4750, 4751], [4790, 4791], [4806, 4807], [4886, 4887], [4955, 4968],
+         [4989, 4991], [5008, 5023], [5109, 5120], [5741, 5742], [5787, 5791], [5867, 5869],
+         [5873, 5887], [5906, 5919], [5938, 5951], [5970, 5983], [6001, 6015], [6068, 6102],
+         [6104, 6107], [6109, 6111], [6122, 6127], [6138, 6159], [6170, 6175], [6264, 6271],
+         [6315, 6319], [6390, 6399], [6429, 6469], [6510, 6511], [6517, 6527], [6572, 6592],
+         [6600, 6607], [6619, 6655], [6679, 6687], [6741, 6783], [6794, 6799], [6810, 6822],
+         [6824, 6916], [6964, 6980], [6988, 6991], [7002, 7042], [7073, 7085], [7098, 7167],
+         [7204, 7231], [7242, 7244], [7294, 7400], [7410, 7423], [7616, 7679], [7958, 7959],
+         [7966, 7967], [8006, 8007], [8014, 8015], [8062, 8063], [8127, 8129], [8141, 8143],
+         [8148, 8149], [8156, 8159], [8173, 8177], [8189, 8303], [8306, 8307], [8314, 8318],
+         [8330, 8335], [8341, 8449], [8451, 8454], [8456, 8457], [8470, 8472], [8478, 8483],
+         [8506, 8507], [8512, 8516], [8522, 8525], [8586, 9311], [9372, 9449], [9472, 10101],
+         [10132, 11263], [11493, 11498], [11503, 11516], [11518, 11519], [11558, 11567],
+         [11622, 11630], [11632, 11647], [11671, 11679], [11743, 11822], [11824, 12292],
+         [12296, 12320], [12330, 12336], [12342, 12343], [12349, 12352], [12439, 12444],
+         [12544, 12548], [12590, 12592], [12687, 12689], [12694, 12703], [12728, 12783],
+         [12800, 12831], [12842, 12880], [12896, 12927], [12938, 12976], [12992, 13311],
+         [19894, 19967], [40908, 40959], [42125, 42191], [42238, 42239], [42509, 42511],
+         [42540, 42559], [42592, 42593], [42607, 42622], [42648, 42655], [42736, 42774],
+         [42784, 42785], [42889, 42890], [42893, 43002], [43043, 43055], [43062, 43071],
+         [43124, 43137], [43188, 43215], [43226, 43249], [43256, 43258], [43260, 43263],
+         [43302, 43311], [43335, 43359], [43389, 43395], [43443, 43470], [43482, 43519],
+         [43561, 43583], [43596, 43599], [43610, 43615], [43639, 43641], [43643, 43647],
+         [43698, 43700], [43703, 43704], [43710, 43711], [43715, 43738], [43742, 43967],
+         [44003, 44015], [44026, 44031], [55204, 55215], [55239, 55242], [55292, 55295],
+         [57344, 63743], [64046, 64047], [64110, 64111], [64218, 64255], [64263, 64274],
+         [64280, 64284], [64434, 64466], [64830, 64847], [64912, 64913], [64968, 65007],
+         [65020, 65135], [65277, 65295], [65306, 65312], [65339, 65344], [65371, 65381],
+         [65471, 65473], [65480, 65481], [65488, 65489], [65496, 65497]];
+    for (i = 0; i < ranges.length; i++) {
+        start = ranges[i][0];
+        end = ranges[i][1];
+        for (j = start; j <= end; j++) {
+            result[j] = true;
+        }
+    }
+    return result;
+})();
+
+function splitQuery(query) {
+    var result = [];
+    var start = -1;
+    for (var i = 0; i < query.length; i++) {
+        if (splitChars[query.charCodeAt(i)]) {
+            if (start !== -1) {
+                result.push(query.slice(start, i));
+                start = -1;
+            }
+        } else if (start === -1) {
+            start = i;
+        }
+    }
+    if (start !== -1) {
+        result.push(query.slice(start));
+    }
+    return result;
+}
+
+
diff --git a/_static/minus.png b/_static/minus.png
new file mode 100644
index 000000000..d96755fda
Binary files /dev/null and b/_static/minus.png differ
diff --git a/_static/plus.png b/_static/plus.png
new file mode 100644
index 000000000..7107cec93
Binary files /dev/null and b/_static/plus.png differ
diff --git a/_static/pygments.css b/_static/pygments.css
new file mode 100644
index 000000000..08bec689d
--- /dev/null
+++ b/_static/pygments.css
@@ -0,0 +1,74 @@
+pre { line-height: 125%; }
+td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
+span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
+td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
+span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
+.highlight .hll { background-color: #ffffcc }
+.highlight { background: #f8f8f8; }
+.highlight .c { color: #3D7B7B; font-style: italic } /* Comment */
+.highlight .err { border: 1px solid #FF0000 } /* Error */
+.highlight .k { color: #008000; font-weight: bold } /* Keyword */
+.highlight .o { color: #666666 } /* Operator */
+.highlight .ch { color: #3D7B7B; font-style: italic } /* Comment.Hashbang */
+.highlight .cm { color: #3D7B7B; font-style: italic } /* Comment.Multiline */
+.highlight .cp { color: #9C6500 } /* Comment.Preproc */
+.highlight .cpf { color: #3D7B7B; font-style: italic } /* Comment.PreprocFile */
+.highlight .c1 { color: #3D7B7B; font-style: italic } /* Comment.Single */
+.highlight .cs { color: #3D7B7B; font-style: italic } /* Comment.Special */
+.highlight .gd { color: #A00000 } /* Generic.Deleted */
+.highlight .ge { font-style: italic } /* Generic.Emph */
+.highlight .gr { color: #E40000 } /* Generic.Error */
+.highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */
+.highlight .gi { color: #008400 } /* Generic.Inserted */
+.highlight .go { color: #717171 } /* Generic.Output */
+.highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */
+.highlight .gs { font-weight: bold } /* Generic.Strong */
+.highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */
+.highlight .gt { color: #0044DD } /* Generic.Traceback */
+.highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */
+.highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */
+.highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */
+.highlight .kp { color: #008000 } /* Keyword.Pseudo */
+.highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */
+.highlight .kt { color: #B00040 } /* Keyword.Type */
+.highlight .m { color: #666666 } /* Literal.Number */
+.highlight .s { color: #BA2121 } /* Literal.String */
+.highlight .na { color: #687822 } /* Name.Attribute */
+.highlight .nb { color: #008000 } /* Name.Builtin */
+.highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */
+.highlight .no { color: #880000 } /* Name.Constant */
+.highlight .nd { color: #AA22FF } /* Name.Decorator */
+.highlight .ni { color: #717171; font-weight: bold } /* Name.Entity */
+.highlight .ne { color: #CB3F38; font-weight: bold } /* Name.Exception */
+.highlight .nf { color: #0000FF } /* Name.Function */
+.highlight .nl { color: #767600 } /* Name.Label */
+.highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */
+.highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */
+.highlight .nv { color: #19177C } /* Name.Variable */
+.highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */
+.highlight .w { color: #bbbbbb } /* Text.Whitespace */
+.highlight .mb { color: #666666 } /* Literal.Number.Bin */
+.highlight .mf { color: #666666 } /* Literal.Number.Float */
+.highlight .mh { color: #666666 } /* Literal.Number.Hex */
+.highlight .mi { color: #666666 } /* Literal.Number.Integer */
+.highlight .mo { color: #666666 } /* Literal.Number.Oct */
+.highlight .sa { color: #BA2121 } /* Literal.String.Affix */
+.highlight .sb { color: #BA2121 } /* Literal.String.Backtick */
+.highlight .sc { color: #BA2121 } /* Literal.String.Char */
+.highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */
+.highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */
+.highlight .s2 { color: #BA2121 } /* Literal.String.Double */
+.highlight .se { color: #AA5D1F; font-weight: bold } /* Literal.String.Escape */
+.highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */
+.highlight .si { color: #A45A77; font-weight: bold } /* Literal.String.Interpol */
+.highlight .sx { color: #008000 } /* Literal.String.Other */
+.highlight .sr { color: #A45A77 } /* Literal.String.Regex */
+.highlight .s1 { color: #BA2121 } /* Literal.String.Single */
+.highlight .ss { color: #19177C } /* Literal.String.Symbol */
+.highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */
+.highlight .fm { color: #0000FF } /* Name.Function.Magic */
+.highlight .vc { color: #19177C } /* Name.Variable.Class */
+.highlight .vg { color: #19177C } /* Name.Variable.Global */
+.highlight .vi { color: #19177C } /* Name.Variable.Instance */
+.highlight .vm { color: #19177C } /* Name.Variable.Magic */
+.highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
\ No newline at end of file
diff --git a/_static/searchtools.js b/_static/searchtools.js
new file mode 100644
index 000000000..7dbc787d3
--- /dev/null
+++ b/_static/searchtools.js
@@ -0,0 +1,532 @@
+/*
+ * searchtools.js
+ * ~~~~~~~~~~~~~~~~
+ *
+ * Sphinx JavaScript utilities for the full-text search.
+ *
+ * :copyright: Copyright 2007-2021 by the Sphinx team, see AUTHORS.
+ * :license: BSD, see LICENSE for details.
+ *
+ */
+
+if (!Scorer) {
+  /**
+   * Simple result scoring code.
+   */
+  var Scorer = {
+    // Implement the following function to further tweak the score for each result
+    // The function takes a result array [filename, title, anchor, descr, score]
+    // and returns the new score.
+    /*
+    score: function(result) {
+      return result[4];
+    },
+    */
+
+    // query matches the full name of an object
+    objNameMatch: 11,
+    // or matches in the last dotted part of the object name
+    objPartialMatch: 6,
+    // Additive scores depending on the priority of the object
+    objPrio: {0:  15,   // used to be importantResults
+              1:  5,   // used to be objectResults
+              2: -5},  // used to be unimportantResults
+    //  Used when the priority is not in the mapping.
+    objPrioDefault: 0,
+
+    // query found in title
+    title: 15,
+    partialTitle: 7,
+    // query found in terms
+    term: 5,
+    partialTerm: 2
+  };
+}
+
+if (!splitQuery) {
+  function splitQuery(query) {
+    return query.split(/\s+/);
+  }
+}
+
+/**
+ * Search Module
+ */
+var Search = {
+
+  _index : null,
+  _queued_query : null,
+  _pulse_status : -1,
+
+  htmlToText : function(htmlString) {
+      var virtualDocument = document.implementation.createHTMLDocument('virtual');
+      var htmlElement = $(htmlString, virtualDocument);
+      htmlElement.find('.headerlink').remove();
+      docContent = htmlElement.find('[role=main]')[0];
+      if(docContent === undefined) {
+          console.warn("Content block not found. Sphinx search tries to obtain it " +
+                       "via '[role=main]'. Could you check your theme or template.");
+          return "";
+      }
+      return docContent.textContent || docContent.innerText;
+  },
+
+  init : function() {
+      var params = $.getQueryParameters();
+      if (params.q) {
+          var query = params.q[0];
+          $('input[name="q"]')[0].value = query;
+          this.performSearch(query);
+      }
+  },
+
+  loadIndex : function(url) {
+    $.ajax({type: "GET", url: url, data: null,
+            dataType: "script", cache: true,
+            complete: function(jqxhr, textstatus) {
+              if (textstatus != "success") {
+                document.getElementById("searchindexloader").src = url;
+              }
+            }});
+  },
+
+  setIndex : function(index) {
+    var q;
+    this._index = index;
+    if ((q = this._queued_query) !== null) {
+      this._queued_query = null;
+      Search.query(q);
+    }
+  },
+
+  hasIndex : function() {
+      return this._index !== null;
+  },
+
+  deferQuery : function(query) {
+      this._queued_query = query;
+  },
+
+  stopPulse : function() {
+      this._pulse_status = 0;
+  },
+
+  startPulse : function() {
+    if (this._pulse_status >= 0)
+        return;
+    function pulse() {
+      var i;
+      Search._pulse_status = (Search._pulse_status + 1) % 4;
+      var dotString = '';
+      for (i = 0; i < Search._pulse_status; i++)
+        dotString += '.';
+      Search.dots.text(dotString);
+      if (Search._pulse_status > -1)
+        window.setTimeout(pulse, 500);
+    }
+    pulse();
+  },
+
+  /**
+   * perform a search for something (or wait until index is loaded)
+   */
+  performSearch : function(query) {
+    // create the required interface elements
+    this.out = $('#search-results');
+    this.title = $('<h2>' + _('Searching') + '</h2>').appendTo(this.out);
+    this.dots = $('<span></span>').appendTo(this.title);
+    this.status = $('<p class="search-summary">&nbsp;</p>').appendTo(this.out);
+    this.output = $('<ul class="search"/>').appendTo(this.out);
+
+    $('#search-progress').text(_('Preparing search...'));
+    this.startPulse();
+
+    // index already loaded, the browser was quick!
+    if (this.hasIndex())
+      this.query(query);
+    else
+      this.deferQuery(query);
+  },
+
+  /**
+   * execute search (requires search index to be loaded)
+   */
+  query : function(query) {
+    var i;
+
+    // stem the searchterms and add them to the correct list
+    var stemmer = new Stemmer();
+    var searchterms = [];
+    var excluded = [];
+    var hlterms = [];
+    var tmp = splitQuery(query);
+    var objectterms = [];
+    for (i = 0; i < tmp.length; i++) {
+      if (tmp[i] !== "") {
+          objectterms.push(tmp[i].toLowerCase());
+      }
+
+      if ($u.indexOf(stopwords, tmp[i].toLowerCase()) != -1 || tmp[i] === "") {
+        // skip this "word"
+        continue;
+      }
+      // stem the word
+      var word = stemmer.stemWord(tmp[i].toLowerCase());
+      // prevent stemmer from cutting word smaller than two chars
+      if(word.length < 3 && tmp[i].length >= 3) {
+        word = tmp[i];
+      }
+      var toAppend;
+      // select the correct list
+      if (word[0] == '-') {
+        toAppend = excluded;
+        word = word.substr(1);
+      }
+      else {
+        toAppend = searchterms;
+        hlterms.push(tmp[i].toLowerCase());
+      }
+      // only add if not already in the list
+      if (!$u.contains(toAppend, word))
+        toAppend.push(word);
+    }
+    var highlightstring = '?highlight=' + $.urlencode(hlterms.join(" "));
+
+    // console.debug('SEARCH: searching for:');
+    // console.info('required: ', searchterms);
+    // console.info('excluded: ', excluded);
+
+    // prepare search
+    var terms = this._index.terms;
+    var titleterms = this._index.titleterms;
+
+    // array of [filename, title, anchor, descr, score]
+    var results = [];
+    $('#search-progress').empty();
+
+    // lookup as object
+    for (i = 0; i < objectterms.length; i++) {
+      var others = [].concat(objectterms.slice(0, i),
+                             objectterms.slice(i+1, objectterms.length));
+      results = results.concat(this.performObjectSearch(objectterms[i], others));
+    }
+
+    // lookup as search terms in fulltext
+    results = results.concat(this.performTermsSearch(searchterms, excluded, terms, titleterms));
+
+    // let the scorer override scores with a custom scoring function
+    if (Scorer.score) {
+      for (i = 0; i < results.length; i++)
+        results[i][4] = Scorer.score(results[i]);
+    }
+
+    // now sort the results by score (in opposite order of appearance, since the
+    // display function below uses pop() to retrieve items) and then
+    // alphabetically
+    results.sort(function(a, b) {
+      var left = a[4];
+      var right = b[4];
+      if (left > right) {
+        return 1;
+      } else if (left < right) {
+        return -1;
+      } else {
+        // same score: sort alphabetically
+        left = a[1].toLowerCase();
+        right = b[1].toLowerCase();
+        return (left > right) ? -1 : ((left < right) ? 1 : 0);
+      }
+    });
+
+    // for debugging
+    //Search.lastresults = results.slice();  // a copy
+    //console.info('search results:', Search.lastresults);
+
+    // print the results
+    var resultCount = results.length;
+    function displayNextItem() {
+      // results left, load the summary and display it
+      if (results.length) {
+        var item = results.pop();
+        var listItem = $('<li></li>');
+        var requestUrl = "";
+        var linkUrl = "";
+        if (DOCUMENTATION_OPTIONS.BUILDER === 'dirhtml') {
+          // dirhtml builder
+          var dirname = item[0] + '/';
+          if (dirname.match(/\/index\/$/)) {
+            dirname = dirname.substring(0, dirname.length-6);
+          } else if (dirname == 'index/') {
+            dirname = '';
+          }
+          requestUrl = DOCUMENTATION_OPTIONS.URL_ROOT + dirname;
+          linkUrl = requestUrl;
+
+        } else {
+          // normal html builders
+          requestUrl = DOCUMENTATION_OPTIONS.URL_ROOT + item[0] + DOCUMENTATION_OPTIONS.FILE_SUFFIX;
+          linkUrl = item[0] + DOCUMENTATION_OPTIONS.LINK_SUFFIX;
+        }
+        listItem.append($('<a/>').attr('href',
+            linkUrl +
+            highlightstring + item[2]).html(item[1]));
+        if (item[3]) {
+          listItem.append($('<span> (' + item[3] + ')</span>'));
+          Search.output.append(listItem);
+          setTimeout(function() {
+            displayNextItem();
+          }, 5);
+        } else if (DOCUMENTATION_OPTIONS.HAS_SOURCE) {
+          $.ajax({url: requestUrl,
+                  dataType: "text",
+                  complete: function(jqxhr, textstatus) {
+                    var data = jqxhr.responseText;
+                    if (data !== '' && data !== undefined) {
+                      var summary = Search.makeSearchSummary(data, searchterms, hlterms);
+                      if (summary) {
+                        listItem.append(summary);
+                      }
+                    }
+                    Search.output.append(listItem);
+                    setTimeout(function() {
+                      displayNextItem();
+                    }, 5);
+                  }});
+        } else {
+          // no source available, just display title
+          Search.output.append(listItem);
+          setTimeout(function() {
+            displayNextItem();
+          }, 5);
+        }
+      }
+      // search finished, update title and status message
+      else {
+        Search.stopPulse();
+        Search.title.text(_('Search Results'));
+        if (!resultCount)
+          Search.status.text(_('Your search did not match any documents. Please make sure that all words are spelled correctly and that you\'ve selected enough categories.'));
+        else
+            Search.status.text(_('Search finished, found %s page(s) matching the search query.').replace('%s', resultCount));
+        Search.status.fadeIn(500);
+      }
+    }
+    displayNextItem();
+  },
+
+  /**
+   * search for object names
+   */
+  performObjectSearch : function(object, otherterms) {
+    var filenames = this._index.filenames;
+    var docnames = this._index.docnames;
+    var objects = this._index.objects;
+    var objnames = this._index.objnames;
+    var titles = this._index.titles;
+
+    var i;
+    var results = [];
+
+    for (var prefix in objects) {
+      if (!(objects[prefix] instanceof Array)) {
+        objects[prefix] = Object.entries(objects[prefix]).map(([name, match]) => [...match, name]);
+      }
+      for (var iMatch = 0; iMatch != objects[prefix].length; ++iMatch) {
+        var match = objects[prefix][iMatch];
+        var name = match[4];
+        var fullname = (prefix ? prefix + '.' : '') + name;
+        var fullnameLower = fullname.toLowerCase()
+        if (fullnameLower.indexOf(object) > -1) {
+          var score = 0;
+          var parts = fullnameLower.split('.');
+          // check for different match types: exact matches of full name or
+          // "last name" (i.e. last dotted part)
+          if (fullnameLower == object || parts[parts.length - 1] == object) {
+            score += Scorer.objNameMatch;
+          // matches in last name
+          } else if (parts[parts.length - 1].indexOf(object) > -1) {
+            score += Scorer.objPartialMatch;
+          }
+          var objname = objnames[match[1]][2];
+          var title = titles[match[0]];
+          // If more than one term searched for, we require other words to be
+          // found in the name/title/description
+          if (otherterms.length > 0) {
+            var haystack = (prefix + ' ' + name + ' ' +
+                            objname + ' ' + title).toLowerCase();
+            var allfound = true;
+            for (i = 0; i < otherterms.length; i++) {
+              if (haystack.indexOf(otherterms[i]) == -1) {
+                allfound = false;
+                break;
+              }
+            }
+            if (!allfound) {
+              continue;
+            }
+          }
+          var descr = objname + _(', in ') + title;
+
+          var anchor = match[3];
+          if (anchor === '')
+            anchor = fullname;
+          else if (anchor == '-')
+            anchor = objnames[match[1]][1] + '-' + fullname;
+          // add custom score for some objects according to scorer
+          if (Scorer.objPrio.hasOwnProperty(match[2])) {
+            score += Scorer.objPrio[match[2]];
+          } else {
+            score += Scorer.objPrioDefault;
+          }
+          results.push([docnames[match[0]], fullname, '#'+anchor, descr, score, filenames[match[0]]]);
+        }
+      }
+    }
+
+    return results;
+  },
+
+  /**
+   * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions
+   */
+  escapeRegExp : function(string) {
+    return string.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+  },
+
+  /**
+   * search for full-text terms in the index
+   */
+  performTermsSearch : function(searchterms, excluded, terms, titleterms) {
+    var docnames = this._index.docnames;
+    var filenames = this._index.filenames;
+    var titles = this._index.titles;
+
+    var i, j, file;
+    var fileMap = {};
+    var scoreMap = {};
+    var results = [];
+
+    // perform the search on the required terms
+    for (i = 0; i < searchterms.length; i++) {
+      var word = searchterms[i];
+      var files = [];
+      var _o = [
+        {files: terms[word], score: Scorer.term},
+        {files: titleterms[word], score: Scorer.title}
+      ];
+      // add support for partial matches
+      if (word.length > 2) {
+        var word_regex = this.escapeRegExp(word);
+        for (var w in terms) {
+          if (w.match(word_regex) && !terms[word]) {
+            _o.push({files: terms[w], score: Scorer.partialTerm})
+          }
+        }
+        for (var w in titleterms) {
+          if (w.match(word_regex) && !titleterms[word]) {
+              _o.push({files: titleterms[w], score: Scorer.partialTitle})
+          }
+        }
+      }
+
+      // no match but word was a required one
+      if ($u.every(_o, function(o){return o.files === undefined;})) {
+        break;
+      }
+      // found search word in contents
+      $u.each(_o, function(o) {
+        var _files = o.files;
+        if (_files === undefined)
+          return
+
+        if (_files.length === undefined)
+          _files = [_files];
+        files = files.concat(_files);
+
+        // set score for the word in each file to Scorer.term
+        for (j = 0; j < _files.length; j++) {
+          file = _files[j];
+          if (!(file in scoreMap))
+            scoreMap[file] = {};
+          scoreMap[file][word] = o.score;
+        }
+      });
+
+      // create the mapping
+      for (j = 0; j < files.length; j++) {
+        file = files[j];
+        if (file in fileMap && fileMap[file].indexOf(word) === -1)
+          fileMap[file].push(word);
+        else
+          fileMap[file] = [word];
+      }
+    }
+
+    // now check if the files don't contain excluded terms
+    for (file in fileMap) {
+      var valid = true;
+
+      // check if all requirements are matched
+      var filteredTermCount = // as search terms with length < 3 are discarded: ignore
+        searchterms.filter(function(term){return term.length > 2}).length
+      if (
+        fileMap[file].length != searchterms.length &&
+        fileMap[file].length != filteredTermCount
+      ) continue;
+
+      // ensure that none of the excluded terms is in the search result
+      for (i = 0; i < excluded.length; i++) {
+        if (terms[excluded[i]] == file ||
+            titleterms[excluded[i]] == file ||
+            $u.contains(terms[excluded[i]] || [], file) ||
+            $u.contains(titleterms[excluded[i]] || [], file)) {
+          valid = false;
+          break;
+        }
+      }
+
+      // if we have still a valid result we can add it to the result list
+      if (valid) {
+        // select one (max) score for the file.
+        // for better ranking, we should calculate ranking by using words statistics like basic tf-idf...
+        var score = $u.max($u.map(fileMap[file], function(w){return scoreMap[file][w]}));
+        results.push([docnames[file], titles[file], '', null, score, filenames[file]]);
+      }
+    }
+    return results;
+  },
+
+  /**
+   * helper function to return a node containing the
+   * search summary for a given text. keywords is a list
+   * of stemmed words, hlwords is the list of normal, unstemmed
+   * words. the first one is used to find the occurrence, the
+   * latter for highlighting it.
+   */
+  makeSearchSummary : function(htmlText, keywords, hlwords) {
+    var text = Search.htmlToText(htmlText);
+    if (text == "") {
+      return null;
+    }
+    var textLower = text.toLowerCase();
+    var start = 0;
+    $.each(keywords, function() {
+      var i = textLower.indexOf(this.toLowerCase());
+      if (i > -1)
+        start = i;
+    });
+    start = Math.max(start - 120, 0);
+    var excerpt = ((start > 0) ? '...' : '') +
+      $.trim(text.substr(start, 240)) +
+      ((start + 240 - text.length) ? '...' : '');
+    var rv = $('<p class="context"></p>').text(excerpt);
+    $.each(hlwords, function() {
+      rv = rv.highlightText(this, 'highlighted');
+    });
+    return rv;
+  }
+};
+
+$(document).ready(function() {
+  Search.init();
+});
diff --git a/_static/underscore.js b/_static/underscore.js
new file mode 100644
index 000000000..b812b3507
--- /dev/null
+++ b/_static/underscore.js
@@ -0,0 +1,2042 @@
+(function (global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+  typeof define === 'function' && define.amd ? define('underscore', factory) :
+  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, (function () {
+    var current = global._;
+    var exports = global._ = factory();
+    exports.noConflict = function () { global._ = current; return exports; };
+  }()));
+}(this, (function () {
+  //     Underscore.js 1.13.2
+  //     https://underscorejs.org
+  //     (c) 2009-2021 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud and Investigative Reporters & Editors
+  //     Underscore may be freely distributed under the MIT license.
+
+  // Current version.
+  var VERSION = '1.13.2';
+
+  // Establish the root object, `window` (`self`) in the browser, `global`
+  // on the server, or `this` in some virtual machines. We use `self`
+  // instead of `window` for `WebWorker` support.
+  var root = typeof self == 'object' && self.self === self && self ||
+            typeof global == 'object' && global.global === global && global ||
+            Function('return this')() ||
+            {};
+
+  // Save bytes in the minified (but not gzipped) version:
+  var ArrayProto = Array.prototype, ObjProto = Object.prototype;
+  var SymbolProto = typeof Symbol !== 'undefined' ? Symbol.prototype : null;
+
+  // Create quick reference variables for speed access to core prototypes.
+  var push = ArrayProto.push,
+      slice = ArrayProto.slice,
+      toString = ObjProto.toString,
+      hasOwnProperty = ObjProto.hasOwnProperty;
+
+  // Modern feature detection.
+  var supportsArrayBuffer = typeof ArrayBuffer !== 'undefined',
+      supportsDataView = typeof DataView !== 'undefined';
+
+  // All **ECMAScript 5+** native function implementations that we hope to use
+  // are declared here.
+  var nativeIsArray = Array.isArray,
+      nativeKeys = Object.keys,
+      nativeCreate = Object.create,
+      nativeIsView = supportsArrayBuffer && ArrayBuffer.isView;
+
+  // Create references to these builtin functions because we override them.
+  var _isNaN = isNaN,
+      _isFinite = isFinite;
+
+  // Keys in IE < 9 that won't be iterated by `for key in ...` and thus missed.
+  var hasEnumBug = !{toString: null}.propertyIsEnumerable('toString');
+  var nonEnumerableProps = ['valueOf', 'isPrototypeOf', 'toString',
+    'propertyIsEnumerable', 'hasOwnProperty', 'toLocaleString'];
+
+  // The largest integer that can be represented exactly.
+  var MAX_ARRAY_INDEX = Math.pow(2, 53) - 1;
+
+  // Some functions take a variable number of arguments, or a few expected
+  // arguments at the beginning and then a variable number of values to operate
+  // on. This helper accumulates all remaining arguments past the function’s
+  // argument length (or an explicit `startIndex`), into an array that becomes
+  // the last argument. Similar to ES6’s "rest parameter".
+  function restArguments(func, startIndex) {
+    startIndex = startIndex == null ? func.length - 1 : +startIndex;
+    return function() {
+      var length = Math.max(arguments.length - startIndex, 0),
+          rest = Array(length),
+          index = 0;
+      for (; index < length; index++) {
+        rest[index] = arguments[index + startIndex];
+      }
+      switch (startIndex) {
+        case 0: return func.call(this, rest);
+        case 1: return func.call(this, arguments[0], rest);
+        case 2: return func.call(this, arguments[0], arguments[1], rest);
+      }
+      var args = Array(startIndex + 1);
+      for (index = 0; index < startIndex; index++) {
+        args[index] = arguments[index];
+      }
+      args[startIndex] = rest;
+      return func.apply(this, args);
+    };
+  }
+
+  // Is a given variable an object?
+  function isObject(obj) {
+    var type = typeof obj;
+    return type === 'function' || type === 'object' && !!obj;
+  }
+
+  // Is a given value equal to null?
+  function isNull(obj) {
+    return obj === null;
+  }
+
+  // Is a given variable undefined?
+  function isUndefined(obj) {
+    return obj === void 0;
+  }
+
+  // Is a given value a boolean?
+  function isBoolean(obj) {
+    return obj === true || obj === false || toString.call(obj) === '[object Boolean]';
+  }
+
+  // Is a given value a DOM element?
+  function isElement(obj) {
+    return !!(obj && obj.nodeType === 1);
+  }
+
+  // Internal function for creating a `toString`-based type tester.
+  function tagTester(name) {
+    var tag = '[object ' + name + ']';
+    return function(obj) {
+      return toString.call(obj) === tag;
+    };
+  }
+
+  var isString = tagTester('String');
+
+  var isNumber = tagTester('Number');
+
+  var isDate = tagTester('Date');
+
+  var isRegExp = tagTester('RegExp');
+
+  var isError = tagTester('Error');
+
+  var isSymbol = tagTester('Symbol');
+
+  var isArrayBuffer = tagTester('ArrayBuffer');
+
+  var isFunction = tagTester('Function');
+
+  // Optimize `isFunction` if appropriate. Work around some `typeof` bugs in old
+  // v8, IE 11 (#1621), Safari 8 (#1929), and PhantomJS (#2236).
+  var nodelist = root.document && root.document.childNodes;
+  if (typeof /./ != 'function' && typeof Int8Array != 'object' && typeof nodelist != 'function') {
+    isFunction = function(obj) {
+      return typeof obj == 'function' || false;
+    };
+  }
+
+  var isFunction$1 = isFunction;
+
+  var hasObjectTag = tagTester('Object');
+
+  // In IE 10 - Edge 13, `DataView` has string tag `'[object Object]'`.
+  // In IE 11, the most common among them, this problem also applies to
+  // `Map`, `WeakMap` and `Set`.
+  var hasStringTagBug = (
+        supportsDataView && hasObjectTag(new DataView(new ArrayBuffer(8)))
+      ),
+      isIE11 = (typeof Map !== 'undefined' && hasObjectTag(new Map));
+
+  var isDataView = tagTester('DataView');
+
+  // In IE 10 - Edge 13, we need a different heuristic
+  // to determine whether an object is a `DataView`.
+  function ie10IsDataView(obj) {
+    return obj != null && isFunction$1(obj.getInt8) && isArrayBuffer(obj.buffer);
+  }
+
+  var isDataView$1 = (hasStringTagBug ? ie10IsDataView : isDataView);
+
+  // Is a given value an array?
+  // Delegates to ECMA5's native `Array.isArray`.
+  var isArray = nativeIsArray || tagTester('Array');
+
+  // Internal function to check whether `key` is an own property name of `obj`.
+  function has$1(obj, key) {
+    return obj != null && hasOwnProperty.call(obj, key);
+  }
+
+  var isArguments = tagTester('Arguments');
+
+  // Define a fallback version of the method in browsers (ahem, IE < 9), where
+  // there isn't any inspectable "Arguments" type.
+  (function() {
+    if (!isArguments(arguments)) {
+      isArguments = function(obj) {
+        return has$1(obj, 'callee');
+      };
+    }
+  }());
+
+  var isArguments$1 = isArguments;
+
+  // Is a given object a finite number?
+  function isFinite$1(obj) {
+    return !isSymbol(obj) && _isFinite(obj) && !isNaN(parseFloat(obj));
+  }
+
+  // Is the given value `NaN`?
+  function isNaN$1(obj) {
+    return isNumber(obj) && _isNaN(obj);
+  }
+
+  // Predicate-generating function. Often useful outside of Underscore.
+  function constant(value) {
+    return function() {
+      return value;
+    };
+  }
+
+  // Common internal logic for `isArrayLike` and `isBufferLike`.
+  function createSizePropertyCheck(getSizeProperty) {
+    return function(collection) {
+      var sizeProperty = getSizeProperty(collection);
+      return typeof sizeProperty == 'number' && sizeProperty >= 0 && sizeProperty <= MAX_ARRAY_INDEX;
+    }
+  }
+
+  // Internal helper to generate a function to obtain property `key` from `obj`.
+  function shallowProperty(key) {
+    return function(obj) {
+      return obj == null ? void 0 : obj[key];
+    };
+  }
+
+  // Internal helper to obtain the `byteLength` property of an object.
+  var getByteLength = shallowProperty('byteLength');
+
+  // Internal helper to determine whether we should spend extensive checks against
+  // `ArrayBuffer` et al.
+  var isBufferLike = createSizePropertyCheck(getByteLength);
+
+  // Is a given value a typed array?
+  var typedArrayPattern = /\[object ((I|Ui)nt(8|16|32)|Float(32|64)|Uint8Clamped|Big(I|Ui)nt64)Array\]/;
+  function isTypedArray(obj) {
+    // `ArrayBuffer.isView` is the most future-proof, so use it when available.
+    // Otherwise, fall back on the above regular expression.
+    return nativeIsView ? (nativeIsView(obj) && !isDataView$1(obj)) :
+                  isBufferLike(obj) && typedArrayPattern.test(toString.call(obj));
+  }
+
+  var isTypedArray$1 = supportsArrayBuffer ? isTypedArray : constant(false);
+
+  // Internal helper to obtain the `length` property of an object.
+  var getLength = shallowProperty('length');
+
+  // Internal helper to create a simple lookup structure.
+  // `collectNonEnumProps` used to depend on `_.contains`, but this led to
+  // circular imports. `emulatedSet` is a one-off solution that only works for
+  // arrays of strings.
+  function emulatedSet(keys) {
+    var hash = {};
+    for (var l = keys.length, i = 0; i < l; ++i) hash[keys[i]] = true;
+    return {
+      contains: function(key) { return hash[key] === true; },
+      push: function(key) {
+        hash[key] = true;
+        return keys.push(key);
+      }
+    };
+  }
+
+  // Internal helper. Checks `keys` for the presence of keys in IE < 9 that won't
+  // be iterated by `for key in ...` and thus missed. Extends `keys` in place if
+  // needed.
+  function collectNonEnumProps(obj, keys) {
+    keys = emulatedSet(keys);
+    var nonEnumIdx = nonEnumerableProps.length;
+    var constructor = obj.constructor;
+    var proto = isFunction$1(constructor) && constructor.prototype || ObjProto;
+
+    // Constructor is a special case.
+    var prop = 'constructor';
+    if (has$1(obj, prop) && !keys.contains(prop)) keys.push(prop);
+
+    while (nonEnumIdx--) {
+      prop = nonEnumerableProps[nonEnumIdx];
+      if (prop in obj && obj[prop] !== proto[prop] && !keys.contains(prop)) {
+        keys.push(prop);
+      }
+    }
+  }
+
+  // Retrieve the names of an object's own properties.
+  // Delegates to **ECMAScript 5**'s native `Object.keys`.
+  function keys(obj) {
+    if (!isObject(obj)) return [];
+    if (nativeKeys) return nativeKeys(obj);
+    var keys = [];
+    for (var key in obj) if (has$1(obj, key)) keys.push(key);
+    // Ahem, IE < 9.
+    if (hasEnumBug) collectNonEnumProps(obj, keys);
+    return keys;
+  }
+
+  // Is a given array, string, or object empty?
+  // An "empty" object has no enumerable own-properties.
+  function isEmpty(obj) {
+    if (obj == null) return true;
+    // Skip the more expensive `toString`-based type checks if `obj` has no
+    // `.length`.
+    var length = getLength(obj);
+    if (typeof length == 'number' && (
+      isArray(obj) || isString(obj) || isArguments$1(obj)
+    )) return length === 0;
+    return getLength(keys(obj)) === 0;
+  }
+
+  // Returns whether an object has a given set of `key:value` pairs.
+  function isMatch(object, attrs) {
+    var _keys = keys(attrs), length = _keys.length;
+    if (object == null) return !length;
+    var obj = Object(object);
+    for (var i = 0; i < length; i++) {
+      var key = _keys[i];
+      if (attrs[key] !== obj[key] || !(key in obj)) return false;
+    }
+    return true;
+  }
+
+  // If Underscore is called as a function, it returns a wrapped object that can
+  // be used OO-style. This wrapper holds altered versions of all functions added
+  // through `_.mixin`. Wrapped objects may be chained.
+  function _$1(obj) {
+    if (obj instanceof _$1) return obj;
+    if (!(this instanceof _$1)) return new _$1(obj);
+    this._wrapped = obj;
+  }
+
+  _$1.VERSION = VERSION;
+
+  // Extracts the result from a wrapped and chained object.
+  _$1.prototype.value = function() {
+    return this._wrapped;
+  };
+
+  // Provide unwrapping proxies for some methods used in engine operations
+  // such as arithmetic and JSON stringification.
+  _$1.prototype.valueOf = _$1.prototype.toJSON = _$1.prototype.value;
+
+  _$1.prototype.toString = function() {
+    return String(this._wrapped);
+  };
+
+  // Internal function to wrap or shallow-copy an ArrayBuffer,
+  // typed array or DataView to a new view, reusing the buffer.
+  function toBufferView(bufferSource) {
+    return new Uint8Array(
+      bufferSource.buffer || bufferSource,
+      bufferSource.byteOffset || 0,
+      getByteLength(bufferSource)
+    );
+  }
+
+  // We use this string twice, so give it a name for minification.
+  var tagDataView = '[object DataView]';
+
+  // Internal recursive comparison function for `_.isEqual`.
+  function eq(a, b, aStack, bStack) {
+    // Identical objects are equal. `0 === -0`, but they aren't identical.
+    // See the [Harmony `egal` proposal](https://wiki.ecmascript.org/doku.php?id=harmony:egal).
+    if (a === b) return a !== 0 || 1 / a === 1 / b;
+    // `null` or `undefined` only equal to itself (strict comparison).
+    if (a == null || b == null) return false;
+    // `NaN`s are equivalent, but non-reflexive.
+    if (a !== a) return b !== b;
+    // Exhaust primitive checks
+    var type = typeof a;
+    if (type !== 'function' && type !== 'object' && typeof b != 'object') return false;
+    return deepEq(a, b, aStack, bStack);
+  }
+
+  // Internal recursive comparison function for `_.isEqual`.
+  function deepEq(a, b, aStack, bStack) {
+    // Unwrap any wrapped objects.
+    if (a instanceof _$1) a = a._wrapped;
+    if (b instanceof _$1) b = b._wrapped;
+    // Compare `[[Class]]` names.
+    var className = toString.call(a);
+    if (className !== toString.call(b)) return false;
+    // Work around a bug in IE 10 - Edge 13.
+    if (hasStringTagBug && className == '[object Object]' && isDataView$1(a)) {
+      if (!isDataView$1(b)) return false;
+      className = tagDataView;
+    }
+    switch (className) {
+      // These types are compared by value.
+      case '[object RegExp]':
+        // RegExps are coerced to strings for comparison (Note: '' + /a/i === '/a/i')
+      case '[object String]':
+        // Primitives and their corresponding object wrappers are equivalent; thus, `"5"` is
+        // equivalent to `new String("5")`.
+        return '' + a === '' + b;
+      case '[object Number]':
+        // `NaN`s are equivalent, but non-reflexive.
+        // Object(NaN) is equivalent to NaN.
+        if (+a !== +a) return +b !== +b;
+        // An `egal` comparison is performed for other numeric values.
+        return +a === 0 ? 1 / +a === 1 / b : +a === +b;
+      case '[object Date]':
+      case '[object Boolean]':
+        // Coerce dates and booleans to numeric primitive values. Dates are compared by their
+        // millisecond representations. Note that invalid dates with millisecond representations
+        // of `NaN` are not equivalent.
+        return +a === +b;
+      case '[object Symbol]':
+        return SymbolProto.valueOf.call(a) === SymbolProto.valueOf.call(b);
+      case '[object ArrayBuffer]':
+      case tagDataView:
+        // Coerce to typed array so we can fall through.
+        return deepEq(toBufferView(a), toBufferView(b), aStack, bStack);
+    }
+
+    var areArrays = className === '[object Array]';
+    if (!areArrays && isTypedArray$1(a)) {
+        var byteLength = getByteLength(a);
+        if (byteLength !== getByteLength(b)) return false;
+        if (a.buffer === b.buffer && a.byteOffset === b.byteOffset) return true;
+        areArrays = true;
+    }
+    if (!areArrays) {
+      if (typeof a != 'object' || typeof b != 'object') return false;
+
+      // Objects with different constructors are not equivalent, but `Object`s or `Array`s
+      // from different frames are.
+      var aCtor = a.constructor, bCtor = b.constructor;
+      if (aCtor !== bCtor && !(isFunction$1(aCtor) && aCtor instanceof aCtor &&
+                               isFunction$1(bCtor) && bCtor instanceof bCtor)
+                          && ('constructor' in a && 'constructor' in b)) {
+        return false;
+      }
+    }
+    // Assume equality for cyclic structures. The algorithm for detecting cyclic
+    // structures is adapted from ES 5.1 section 15.12.3, abstract operation `JO`.
+
+    // Initializing stack of traversed objects.
+    // It's done here since we only need them for objects and arrays comparison.
+    aStack = aStack || [];
+    bStack = bStack || [];
+    var length = aStack.length;
+    while (length--) {
+      // Linear search. Performance is inversely proportional to the number of
+      // unique nested structures.
+      if (aStack[length] === a) return bStack[length] === b;
+    }
+
+    // Add the first object to the stack of traversed objects.
+    aStack.push(a);
+    bStack.push(b);
+
+    // Recursively compare objects and arrays.
+    if (areArrays) {
+      // Compare array lengths to determine if a deep comparison is necessary.
+      length = a.length;
+      if (length !== b.length) return false;
+      // Deep compare the contents, ignoring non-numeric properties.
+      while (length--) {
+        if (!eq(a[length], b[length], aStack, bStack)) return false;
+      }
+    } else {
+      // Deep compare objects.
+      var _keys = keys(a), key;
+      length = _keys.length;
+      // Ensure that both objects contain the same number of properties before comparing deep equality.
+      if (keys(b).length !== length) return false;
+      while (length--) {
+        // Deep compare each member
+        key = _keys[length];
+        if (!(has$1(b, key) && eq(a[key], b[key], aStack, bStack))) return false;
+      }
+    }
+    // Remove the first object from the stack of traversed objects.
+    aStack.pop();
+    bStack.pop();
+    return true;
+  }
+
+  // Perform a deep comparison to check if two objects are equal.
+  function isEqual(a, b) {
+    return eq(a, b);
+  }
+
+  // Retrieve all the enumerable property names of an object.
+  function allKeys(obj) {
+    if (!isObject(obj)) return [];
+    var keys = [];
+    for (var key in obj) keys.push(key);
+    // Ahem, IE < 9.
+    if (hasEnumBug) collectNonEnumProps(obj, keys);
+    return keys;
+  }
+
+  // Since the regular `Object.prototype.toString` type tests don't work for
+  // some types in IE 11, we use a fingerprinting heuristic instead, based
+  // on the methods. It's not great, but it's the best we got.
+  // The fingerprint method lists are defined below.
+  function ie11fingerprint(methods) {
+    var length = getLength(methods);
+    return function(obj) {
+      if (obj == null) return false;
+      // `Map`, `WeakMap` and `Set` have no enumerable keys.
+      var keys = allKeys(obj);
+      if (getLength(keys)) return false;
+      for (var i = 0; i < length; i++) {
+        if (!isFunction$1(obj[methods[i]])) return false;
+      }
+      // If we are testing against `WeakMap`, we need to ensure that
+      // `obj` doesn't have a `forEach` method in order to distinguish
+      // it from a regular `Map`.
+      return methods !== weakMapMethods || !isFunction$1(obj[forEachName]);
+    };
+  }
+
+  // In the interest of compact minification, we write
+  // each string in the fingerprints only once.
+  var forEachName = 'forEach',
+      hasName = 'has',
+      commonInit = ['clear', 'delete'],
+      mapTail = ['get', hasName, 'set'];
+
+  // `Map`, `WeakMap` and `Set` each have slightly different
+  // combinations of the above sublists.
+  var mapMethods = commonInit.concat(forEachName, mapTail),
+      weakMapMethods = commonInit.concat(mapTail),
+      setMethods = ['add'].concat(commonInit, forEachName, hasName);
+
+  var isMap = isIE11 ? ie11fingerprint(mapMethods) : tagTester('Map');
+
+  var isWeakMap = isIE11 ? ie11fingerprint(weakMapMethods) : tagTester('WeakMap');
+
+  var isSet = isIE11 ? ie11fingerprint(setMethods) : tagTester('Set');
+
+  var isWeakSet = tagTester('WeakSet');
+
+  // Retrieve the values of an object's properties.
+  function values(obj) {
+    var _keys = keys(obj);
+    var length = _keys.length;
+    var values = Array(length);
+    for (var i = 0; i < length; i++) {
+      values[i] = obj[_keys[i]];
+    }
+    return values;
+  }
+
+  // Convert an object into a list of `[key, value]` pairs.
+  // The opposite of `_.object` with one argument.
+  function pairs(obj) {
+    var _keys = keys(obj);
+    var length = _keys.length;
+    var pairs = Array(length);
+    for (var i = 0; i < length; i++) {
+      pairs[i] = [_keys[i], obj[_keys[i]]];
+    }
+    return pairs;
+  }
+
+  // Invert the keys and values of an object. The values must be serializable.
+  function invert(obj) {
+    var result = {};
+    var _keys = keys(obj);
+    for (var i = 0, length = _keys.length; i < length; i++) {
+      result[obj[_keys[i]]] = _keys[i];
+    }
+    return result;
+  }
+
+  // Return a sorted list of the function names available on the object.
+  function functions(obj) {
+    var names = [];
+    for (var key in obj) {
+      if (isFunction$1(obj[key])) names.push(key);
+    }
+    return names.sort();
+  }
+
+  // An internal function for creating assigner functions.
+  function createAssigner(keysFunc, defaults) {
+    return function(obj) {
+      var length = arguments.length;
+      if (defaults) obj = Object(obj);
+      if (length < 2 || obj == null) return obj;
+      for (var index = 1; index < length; index++) {
+        var source = arguments[index],
+            keys = keysFunc(source),
+            l = keys.length;
+        for (var i = 0; i < l; i++) {
+          var key = keys[i];
+          if (!defaults || obj[key] === void 0) obj[key] = source[key];
+        }
+      }
+      return obj;
+    };
+  }
+
+  // Extend a given object with all the properties in passed-in object(s).
+  var extend = createAssigner(allKeys);
+
+  // Assigns a given object with all the own properties in the passed-in
+  // object(s).
+  // (https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/assign)
+  var extendOwn = createAssigner(keys);
+
+  // Fill in a given object with default properties.
+  var defaults = createAssigner(allKeys, true);
+
+  // Create a naked function reference for surrogate-prototype-swapping.
+  function ctor() {
+    return function(){};
+  }
+
+  // An internal function for creating a new object that inherits from another.
+  function baseCreate(prototype) {
+    if (!isObject(prototype)) return {};
+    if (nativeCreate) return nativeCreate(prototype);
+    var Ctor = ctor();
+    Ctor.prototype = prototype;
+    var result = new Ctor;
+    Ctor.prototype = null;
+    return result;
+  }
+
+  // Creates an object that inherits from the given prototype object.
+  // If additional properties are provided then they will be added to the
+  // created object.
+  function create(prototype, props) {
+    var result = baseCreate(prototype);
+    if (props) extendOwn(result, props);
+    return result;
+  }
+
+  // Create a (shallow-cloned) duplicate of an object.
+  function clone(obj) {
+    if (!isObject(obj)) return obj;
+    return isArray(obj) ? obj.slice() : extend({}, obj);
+  }
+
+  // Invokes `interceptor` with the `obj` and then returns `obj`.
+  // The primary purpose of this method is to "tap into" a method chain, in
+  // order to perform operations on intermediate results within the chain.
+  function tap(obj, interceptor) {
+    interceptor(obj);
+    return obj;
+  }
+
+  // Normalize a (deep) property `path` to array.
+  // Like `_.iteratee`, this function can be customized.
+  function toPath$1(path) {
+    return isArray(path) ? path : [path];
+  }
+  _$1.toPath = toPath$1;
+
+  // Internal wrapper for `_.toPath` to enable minification.
+  // Similar to `cb` for `_.iteratee`.
+  function toPath(path) {
+    return _$1.toPath(path);
+  }
+
+  // Internal function to obtain a nested property in `obj` along `path`.
+  function deepGet(obj, path) {
+    var length = path.length;
+    for (var i = 0; i < length; i++) {
+      if (obj == null) return void 0;
+      obj = obj[path[i]];
+    }
+    return length ? obj : void 0;
+  }
+
+  // Get the value of the (deep) property on `path` from `object`.
+  // If any property in `path` does not exist or if the value is
+  // `undefined`, return `defaultValue` instead.
+  // The `path` is normalized through `_.toPath`.
+  function get(object, path, defaultValue) {
+    var value = deepGet(object, toPath(path));
+    return isUndefined(value) ? defaultValue : value;
+  }
+
+  // Shortcut function for checking if an object has a given property directly on
+  // itself (in other words, not on a prototype). Unlike the internal `has`
+  // function, this public version can also traverse nested properties.
+  function has(obj, path) {
+    path = toPath(path);
+    var length = path.length;
+    for (var i = 0; i < length; i++) {
+      var key = path[i];
+      if (!has$1(obj, key)) return false;
+      obj = obj[key];
+    }
+    return !!length;
+  }
+
+  // Keep the identity function around for default iteratees.
+  function identity(value) {
+    return value;
+  }
+
+  // Returns a predicate for checking whether an object has a given set of
+  // `key:value` pairs.
+  function matcher(attrs) {
+    attrs = extendOwn({}, attrs);
+    return function(obj) {
+      return isMatch(obj, attrs);
+    };
+  }
+
+  // Creates a function that, when passed an object, will traverse that object’s
+  // properties down the given `path`, specified as an array of keys or indices.
+  function property(path) {
+    path = toPath(path);
+    return function(obj) {
+      return deepGet(obj, path);
+    };
+  }
+
+  // Internal function that returns an efficient (for current engines) version
+  // of the passed-in callback, to be repeatedly applied in other Underscore
+  // functions.
+  function optimizeCb(func, context, argCount) {
+    if (context === void 0) return func;
+    switch (argCount == null ? 3 : argCount) {
+      case 1: return function(value) {
+        return func.call(context, value);
+      };
+      // The 2-argument case is omitted because we’re not using it.
+      case 3: return function(value, index, collection) {
+        return func.call(context, value, index, collection);
+      };
+      case 4: return function(accumulator, value, index, collection) {
+        return func.call(context, accumulator, value, index, collection);
+      };
+    }
+    return function() {
+      return func.apply(context, arguments);
+    };
+  }
+
+  // An internal function to generate callbacks that can be applied to each
+  // element in a collection, returning the desired result — either `_.identity`,
+  // an arbitrary callback, a property matcher, or a property accessor.
+  function baseIteratee(value, context, argCount) {
+    if (value == null) return identity;
+    if (isFunction$1(value)) return optimizeCb(value, context, argCount);
+    if (isObject(value) && !isArray(value)) return matcher(value);
+    return property(value);
+  }
+
+  // External wrapper for our callback generator. Users may customize
+  // `_.iteratee` if they want additional predicate/iteratee shorthand styles.
+  // This abstraction hides the internal-only `argCount` argument.
+  function iteratee(value, context) {
+    return baseIteratee(value, context, Infinity);
+  }
+  _$1.iteratee = iteratee;
+
+  // The function we call internally to generate a callback. It invokes
+  // `_.iteratee` if overridden, otherwise `baseIteratee`.
+  function cb(value, context, argCount) {
+    if (_$1.iteratee !== iteratee) return _$1.iteratee(value, context);
+    return baseIteratee(value, context, argCount);
+  }
+
+  // Returns the results of applying the `iteratee` to each element of `obj`.
+  // In contrast to `_.map` it returns an object.
+  function mapObject(obj, iteratee, context) {
+    iteratee = cb(iteratee, context);
+    var _keys = keys(obj),
+        length = _keys.length,
+        results = {};
+    for (var index = 0; index < length; index++) {
+      var currentKey = _keys[index];
+      results[currentKey] = iteratee(obj[currentKey], currentKey, obj);
+    }
+    return results;
+  }
+
+  // Predicate-generating function. Often useful outside of Underscore.
+  function noop(){}
+
+  // Generates a function for a given object that returns a given property.
+  function propertyOf(obj) {
+    if (obj == null) return noop;
+    return function(path) {
+      return get(obj, path);
+    };
+  }
+
+  // Run a function **n** times.
+  function times(n, iteratee, context) {
+    var accum = Array(Math.max(0, n));
+    iteratee = optimizeCb(iteratee, context, 1);
+    for (var i = 0; i < n; i++) accum[i] = iteratee(i);
+    return accum;
+  }
+
+  // Return a random integer between `min` and `max` (inclusive).
+  function random(min, max) {
+    if (max == null) {
+      max = min;
+      min = 0;
+    }
+    return min + Math.floor(Math.random() * (max - min + 1));
+  }
+
+  // A (possibly faster) way to get the current timestamp as an integer.
+  var now = Date.now || function() {
+    return new Date().getTime();
+  };
+
+  // Internal helper to generate functions for escaping and unescaping strings
+  // to/from HTML interpolation.
+  function createEscaper(map) {
+    var escaper = function(match) {
+      return map[match];
+    };
+    // Regexes for identifying a key that needs to be escaped.
+    var source = '(?:' + keys(map).join('|') + ')';
+    var testRegexp = RegExp(source);
+    var replaceRegexp = RegExp(source, 'g');
+    return function(string) {
+      string = string == null ? '' : '' + string;
+      return testRegexp.test(string) ? string.replace(replaceRegexp, escaper) : string;
+    };
+  }
+
+  // Internal list of HTML entities for escaping.
+  var escapeMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '`': '&#x60;'
+  };
+
+  // Function for escaping strings to HTML interpolation.
+  var _escape = createEscaper(escapeMap);
+
+  // Internal list of HTML entities for unescaping.
+  var unescapeMap = invert(escapeMap);
+
+  // Function for unescaping strings from HTML interpolation.
+  var _unescape = createEscaper(unescapeMap);
+
+  // By default, Underscore uses ERB-style template delimiters. Change the
+  // following template settings to use alternative delimiters.
+  var templateSettings = _$1.templateSettings = {
+    evaluate: /<%([\s\S]+?)%>/g,
+    interpolate: /<%=([\s\S]+?)%>/g,
+    escape: /<%-([\s\S]+?)%>/g
+  };
+
+  // When customizing `_.templateSettings`, if you don't want to define an
+  // interpolation, evaluation or escaping regex, we need one that is
+  // guaranteed not to match.
+  var noMatch = /(.)^/;
+
+  // Certain characters need to be escaped so that they can be put into a
+  // string literal.
+  var escapes = {
+    "'": "'",
+    '\\': '\\',
+    '\r': 'r',
+    '\n': 'n',
+    '\u2028': 'u2028',
+    '\u2029': 'u2029'
+  };
+
+  var escapeRegExp = /\\|'|\r|\n|\u2028|\u2029/g;
+
+  function escapeChar(match) {
+    return '\\' + escapes[match];
+  }
+
+  // In order to prevent third-party code injection through
+  // `_.templateSettings.variable`, we test it against the following regular
+  // expression. It is intentionally a bit more liberal than just matching valid
+  // identifiers, but still prevents possible loopholes through defaults or
+  // destructuring assignment.
+  var bareIdentifier = /^\s*(\w|\$)+\s*$/;
+
+  // JavaScript micro-templating, similar to John Resig's implementation.
+  // Underscore templating handles arbitrary delimiters, preserves whitespace,
+  // and correctly escapes quotes within interpolated code.
+  // NB: `oldSettings` only exists for backwards compatibility.
+  function template(text, settings, oldSettings) {
+    if (!settings && oldSettings) settings = oldSettings;
+    settings = defaults({}, settings, _$1.templateSettings);
+
+    // Combine delimiters into one regular expression via alternation.
+    var matcher = RegExp([
+      (settings.escape || noMatch).source,
+      (settings.interpolate || noMatch).source,
+      (settings.evaluate || noMatch).source
+    ].join('|') + '|$', 'g');
+
+    // Compile the template source, escaping string literals appropriately.
+    var index = 0;
+    var source = "__p+='";
+    text.replace(matcher, function(match, escape, interpolate, evaluate, offset) {
+      source += text.slice(index, offset).replace(escapeRegExp, escapeChar);
+      index = offset + match.length;
+
+      if (escape) {
+        source += "'+\n((__t=(" + escape + "))==null?'':_.escape(__t))+\n'";
+      } else if (interpolate) {
+        source += "'+\n((__t=(" + interpolate + "))==null?'':__t)+\n'";
+      } else if (evaluate) {
+        source += "';\n" + evaluate + "\n__p+='";
+      }
+
+      // Adobe VMs need the match returned to produce the correct offset.
+      return match;
+    });
+    source += "';\n";
+
+    var argument = settings.variable;
+    if (argument) {
+      // Insure against third-party code injection. (CVE-2021-23358)
+      if (!bareIdentifier.test(argument)) throw new Error(
+        'variable is not a bare identifier: ' + argument
+      );
+    } else {
+      // If a variable is not specified, place data values in local scope.
+      source = 'with(obj||{}){\n' + source + '}\n';
+      argument = 'obj';
+    }
+
+    source = "var __t,__p='',__j=Array.prototype.join," +
+      "print=function(){__p+=__j.call(arguments,'');};\n" +
+      source + 'return __p;\n';
+
+    var render;
+    try {
+      render = new Function(argument, '_', source);
+    } catch (e) {
+      e.source = source;
+      throw e;
+    }
+
+    var template = function(data) {
+      return render.call(this, data, _$1);
+    };
+
+    // Provide the compiled source as a convenience for precompilation.
+    template.source = 'function(' + argument + '){\n' + source + '}';
+
+    return template;
+  }
+
+  // Traverses the children of `obj` along `path`. If a child is a function, it
+  // is invoked with its parent as context. Returns the value of the final
+  // child, or `fallback` if any child is undefined.
+  function result(obj, path, fallback) {
+    path = toPath(path);
+    var length = path.length;
+    if (!length) {
+      return isFunction$1(fallback) ? fallback.call(obj) : fallback;
+    }
+    for (var i = 0; i < length; i++) {
+      var prop = obj == null ? void 0 : obj[path[i]];
+      if (prop === void 0) {
+        prop = fallback;
+        i = length; // Ensure we don't continue iterating.
+      }
+      obj = isFunction$1(prop) ? prop.call(obj) : prop;
+    }
+    return obj;
+  }
+
+  // Generate a unique integer id (unique within the entire client session).
+  // Useful for temporary DOM ids.
+  var idCounter = 0;
+  function uniqueId(prefix) {
+    var id = ++idCounter + '';
+    return prefix ? prefix + id : id;
+  }
+
+  // Start chaining a wrapped Underscore object.
+  function chain(obj) {
+    var instance = _$1(obj);
+    instance._chain = true;
+    return instance;
+  }
+
+  // Internal function to execute `sourceFunc` bound to `context` with optional
+  // `args`. Determines whether to execute a function as a constructor or as a
+  // normal function.
+  function executeBound(sourceFunc, boundFunc, context, callingContext, args) {
+    if (!(callingContext instanceof boundFunc)) return sourceFunc.apply(context, args);
+    var self = baseCreate(sourceFunc.prototype);
+    var result = sourceFunc.apply(self, args);
+    if (isObject(result)) return result;
+    return self;
+  }
+
+  // Partially apply a function by creating a version that has had some of its
+  // arguments pre-filled, without changing its dynamic `this` context. `_` acts
+  // as a placeholder by default, allowing any combination of arguments to be
+  // pre-filled. Set `_.partial.placeholder` for a custom placeholder argument.
+  var partial = restArguments(function(func, boundArgs) {
+    var placeholder = partial.placeholder;
+    var bound = function() {
+      var position = 0, length = boundArgs.length;
+      var args = Array(length);
+      for (var i = 0; i < length; i++) {
+        args[i] = boundArgs[i] === placeholder ? arguments[position++] : boundArgs[i];
+      }
+      while (position < arguments.length) args.push(arguments[position++]);
+      return executeBound(func, bound, this, this, args);
+    };
+    return bound;
+  });
+
+  partial.placeholder = _$1;
+
+  // Create a function bound to a given object (assigning `this`, and arguments,
+  // optionally).
+  var bind = restArguments(function(func, context, args) {
+    if (!isFunction$1(func)) throw new TypeError('Bind must be called on a function');
+    var bound = restArguments(function(callArgs) {
+      return executeBound(func, bound, context, this, args.concat(callArgs));
+    });
+    return bound;
+  });
+
+  // Internal helper for collection methods to determine whether a collection
+  // should be iterated as an array or as an object.
+  // Related: https://people.mozilla.org/~jorendorff/es6-draft.html#sec-tolength
+  // Avoids a very nasty iOS 8 JIT bug on ARM-64. #2094
+  var isArrayLike = createSizePropertyCheck(getLength);
+
+  // Internal implementation of a recursive `flatten` function.
+  function flatten$1(input, depth, strict, output) {
+    output = output || [];
+    if (!depth && depth !== 0) {
+      depth = Infinity;
+    } else if (depth <= 0) {
+      return output.concat(input);
+    }
+    var idx = output.length;
+    for (var i = 0, length = getLength(input); i < length; i++) {
+      var value = input[i];
+      if (isArrayLike(value) && (isArray(value) || isArguments$1(value))) {
+        // Flatten current level of array or arguments object.
+        if (depth > 1) {
+          flatten$1(value, depth - 1, strict, output);
+          idx = output.length;
+        } else {
+          var j = 0, len = value.length;
+          while (j < len) output[idx++] = value[j++];
+        }
+      } else if (!strict) {
+        output[idx++] = value;
+      }
+    }
+    return output;
+  }
+
+  // Bind a number of an object's methods to that object. Remaining arguments
+  // are the method names to be bound. Useful for ensuring that all callbacks
+  // defined on an object belong to it.
+  var bindAll = restArguments(function(obj, keys) {
+    keys = flatten$1(keys, false, false);
+    var index = keys.length;
+    if (index < 1) throw new Error('bindAll must be passed function names');
+    while (index--) {
+      var key = keys[index];
+      obj[key] = bind(obj[key], obj);
+    }
+    return obj;
+  });
+
+  // Memoize an expensive function by storing its results.
+  function memoize(func, hasher) {
+    var memoize = function(key) {
+      var cache = memoize.cache;
+      var address = '' + (hasher ? hasher.apply(this, arguments) : key);
+      if (!has$1(cache, address)) cache[address] = func.apply(this, arguments);
+      return cache[address];
+    };
+    memoize.cache = {};
+    return memoize;
+  }
+
+  // Delays a function for the given number of milliseconds, and then calls
+  // it with the arguments supplied.
+  var delay = restArguments(function(func, wait, args) {
+    return setTimeout(function() {
+      return func.apply(null, args);
+    }, wait);
+  });
+
+  // Defers a function, scheduling it to run after the current call stack has
+  // cleared.
+  var defer = partial(delay, _$1, 1);
+
+  // Returns a function, that, when invoked, will only be triggered at most once
+  // during a given window of time. Normally, the throttled function will run
+  // as much as it can, without ever going more than once per `wait` duration;
+  // but if you'd like to disable the execution on the leading edge, pass
+  // `{leading: false}`. To disable execution on the trailing edge, ditto.
+  function throttle(func, wait, options) {
+    var timeout, context, args, result;
+    var previous = 0;
+    if (!options) options = {};
+
+    var later = function() {
+      previous = options.leading === false ? 0 : now();
+      timeout = null;
+      result = func.apply(context, args);
+      if (!timeout) context = args = null;
+    };
+
+    var throttled = function() {
+      var _now = now();
+      if (!previous && options.leading === false) previous = _now;
+      var remaining = wait - (_now - previous);
+      context = this;
+      args = arguments;
+      if (remaining <= 0 || remaining > wait) {
+        if (timeout) {
+          clearTimeout(timeout);
+          timeout = null;
+        }
+        previous = _now;
+        result = func.apply(context, args);
+        if (!timeout) context = args = null;
+      } else if (!timeout && options.trailing !== false) {
+        timeout = setTimeout(later, remaining);
+      }
+      return result;
+    };
+
+    throttled.cancel = function() {
+      clearTimeout(timeout);
+      previous = 0;
+      timeout = context = args = null;
+    };
+
+    return throttled;
+  }
+
+  // When a sequence of calls of the returned function ends, the argument
+  // function is triggered. The end of a sequence is defined by the `wait`
+  // parameter. If `immediate` is passed, the argument function will be
+  // triggered at the beginning of the sequence instead of at the end.
+  function debounce(func, wait, immediate) {
+    var timeout, previous, args, result, context;
+
+    var later = function() {
+      var passed = now() - previous;
+      if (wait > passed) {
+        timeout = setTimeout(later, wait - passed);
+      } else {
+        timeout = null;
+        if (!immediate) result = func.apply(context, args);
+        // This check is needed because `func` can recursively invoke `debounced`.
+        if (!timeout) args = context = null;
+      }
+    };
+
+    var debounced = restArguments(function(_args) {
+      context = this;
+      args = _args;
+      previous = now();
+      if (!timeout) {
+        timeout = setTimeout(later, wait);
+        if (immediate) result = func.apply(context, args);
+      }
+      return result;
+    });
+
+    debounced.cancel = function() {
+      clearTimeout(timeout);
+      timeout = args = context = null;
+    };
+
+    return debounced;
+  }
+
+  // Returns the first function passed as an argument to the second,
+  // allowing you to adjust arguments, run code before and after, and
+  // conditionally execute the original function.
+  function wrap(func, wrapper) {
+    return partial(wrapper, func);
+  }
+
+  // Returns a negated version of the passed-in predicate.
+  function negate(predicate) {
+    return function() {
+      return !predicate.apply(this, arguments);
+    };
+  }
+
+  // Returns a function that is the composition of a list of functions, each
+  // consuming the return value of the function that follows.
+  function compose() {
+    var args = arguments;
+    var start = args.length - 1;
+    return function() {
+      var i = start;
+      var result = args[start].apply(this, arguments);
+      while (i--) result = args[i].call(this, result);
+      return result;
+    };
+  }
+
+  // Returns a function that will only be executed on and after the Nth call.
+  function after(times, func) {
+    return function() {
+      if (--times < 1) {
+        return func.apply(this, arguments);
+      }
+    };
+  }
+
+  // Returns a function that will only be executed up to (but not including) the
+  // Nth call.
+  function before(times, func) {
+    var memo;
+    return function() {
+      if (--times > 0) {
+        memo = func.apply(this, arguments);
+      }
+      if (times <= 1) func = null;
+      return memo;
+    };
+  }
+
+  // Returns a function that will be executed at most one time, no matter how
+  // often you call it. Useful for lazy initialization.
+  var once = partial(before, 2);
+
+  // Returns the first key on an object that passes a truth test.
+  function findKey(obj, predicate, context) {
+    predicate = cb(predicate, context);
+    var _keys = keys(obj), key;
+    for (var i = 0, length = _keys.length; i < length; i++) {
+      key = _keys[i];
+      if (predicate(obj[key], key, obj)) return key;
+    }
+  }
+
+  // Internal function to generate `_.findIndex` and `_.findLastIndex`.
+  function createPredicateIndexFinder(dir) {
+    return function(array, predicate, context) {
+      predicate = cb(predicate, context);
+      var length = getLength(array);
+      var index = dir > 0 ? 0 : length - 1;
+      for (; index >= 0 && index < length; index += dir) {
+        if (predicate(array[index], index, array)) return index;
+      }
+      return -1;
+    };
+  }
+
+  // Returns the first index on an array-like that passes a truth test.
+  var findIndex = createPredicateIndexFinder(1);
+
+  // Returns the last index on an array-like that passes a truth test.
+  var findLastIndex = createPredicateIndexFinder(-1);
+
+  // Use a comparator function to figure out the smallest index at which
+  // an object should be inserted so as to maintain order. Uses binary search.
+  function sortedIndex(array, obj, iteratee, context) {
+    iteratee = cb(iteratee, context, 1);
+    var value = iteratee(obj);
+    var low = 0, high = getLength(array);
+    while (low < high) {
+      var mid = Math.floor((low + high) / 2);
+      if (iteratee(array[mid]) < value) low = mid + 1; else high = mid;
+    }
+    return low;
+  }
+
+  // Internal function to generate the `_.indexOf` and `_.lastIndexOf` functions.
+  function createIndexFinder(dir, predicateFind, sortedIndex) {
+    return function(array, item, idx) {
+      var i = 0, length = getLength(array);
+      if (typeof idx == 'number') {
+        if (dir > 0) {
+          i = idx >= 0 ? idx : Math.max(idx + length, i);
+        } else {
+          length = idx >= 0 ? Math.min(idx + 1, length) : idx + length + 1;
+        }
+      } else if (sortedIndex && idx && length) {
+        idx = sortedIndex(array, item);
+        return array[idx] === item ? idx : -1;
+      }
+      if (item !== item) {
+        idx = predicateFind(slice.call(array, i, length), isNaN$1);
+        return idx >= 0 ? idx + i : -1;
+      }
+      for (idx = dir > 0 ? i : length - 1; idx >= 0 && idx < length; idx += dir) {
+        if (array[idx] === item) return idx;
+      }
+      return -1;
+    };
+  }
+
+  // Return the position of the first occurrence of an item in an array,
+  // or -1 if the item is not included in the array.
+  // If the array is large and already in sort order, pass `true`
+  // for **isSorted** to use binary search.
+  var indexOf = createIndexFinder(1, findIndex, sortedIndex);
+
+  // Return the position of the last occurrence of an item in an array,
+  // or -1 if the item is not included in the array.
+  var lastIndexOf = createIndexFinder(-1, findLastIndex);
+
+  // Return the first value which passes a truth test.
+  function find(obj, predicate, context) {
+    var keyFinder = isArrayLike(obj) ? findIndex : findKey;
+    var key = keyFinder(obj, predicate, context);
+    if (key !== void 0 && key !== -1) return obj[key];
+  }
+
+  // Convenience version of a common use case of `_.find`: getting the first
+  // object containing specific `key:value` pairs.
+  function findWhere(obj, attrs) {
+    return find(obj, matcher(attrs));
+  }
+
+  // The cornerstone for collection functions, an `each`
+  // implementation, aka `forEach`.
+  // Handles raw objects in addition to array-likes. Treats all
+  // sparse array-likes as if they were dense.
+  function each(obj, iteratee, context) {
+    iteratee = optimizeCb(iteratee, context);
+    var i, length;
+    if (isArrayLike(obj)) {
+      for (i = 0, length = obj.length; i < length; i++) {
+        iteratee(obj[i], i, obj);
+      }
+    } else {
+      var _keys = keys(obj);
+      for (i = 0, length = _keys.length; i < length; i++) {
+        iteratee(obj[_keys[i]], _keys[i], obj);
+      }
+    }
+    return obj;
+  }
+
+  // Return the results of applying the iteratee to each element.
+  function map(obj, iteratee, context) {
+    iteratee = cb(iteratee, context);
+    var _keys = !isArrayLike(obj) && keys(obj),
+        length = (_keys || obj).length,
+        results = Array(length);
+    for (var index = 0; index < length; index++) {
+      var currentKey = _keys ? _keys[index] : index;
+      results[index] = iteratee(obj[currentKey], currentKey, obj);
+    }
+    return results;
+  }
+
+  // Internal helper to create a reducing function, iterating left or right.
+  function createReduce(dir) {
+    // Wrap code that reassigns argument variables in a separate function than
+    // the one that accesses `arguments.length` to avoid a perf hit. (#1991)
+    var reducer = function(obj, iteratee, memo, initial) {
+      var _keys = !isArrayLike(obj) && keys(obj),
+          length = (_keys || obj).length,
+          index = dir > 0 ? 0 : length - 1;
+      if (!initial) {
+        memo = obj[_keys ? _keys[index] : index];
+        index += dir;
+      }
+      for (; index >= 0 && index < length; index += dir) {
+        var currentKey = _keys ? _keys[index] : index;
+        memo = iteratee(memo, obj[currentKey], currentKey, obj);
+      }
+      return memo;
+    };
+
+    return function(obj, iteratee, memo, context) {
+      var initial = arguments.length >= 3;
+      return reducer(obj, optimizeCb(iteratee, context, 4), memo, initial);
+    };
+  }
+
+  // **Reduce** builds up a single result from a list of values, aka `inject`,
+  // or `foldl`.
+  var reduce = createReduce(1);
+
+  // The right-associative version of reduce, also known as `foldr`.
+  var reduceRight = createReduce(-1);
+
+  // Return all the elements that pass a truth test.
+  function filter(obj, predicate, context) {
+    var results = [];
+    predicate = cb(predicate, context);
+    each(obj, function(value, index, list) {
+      if (predicate(value, index, list)) results.push(value);
+    });
+    return results;
+  }
+
+  // Return all the elements for which a truth test fails.
+  function reject(obj, predicate, context) {
+    return filter(obj, negate(cb(predicate)), context);
+  }
+
+  // Determine whether all of the elements pass a truth test.
+  function every(obj, predicate, context) {
+    predicate = cb(predicate, context);
+    var _keys = !isArrayLike(obj) && keys(obj),
+        length = (_keys || obj).length;
+    for (var index = 0; index < length; index++) {
+      var currentKey = _keys ? _keys[index] : index;
+      if (!predicate(obj[currentKey], currentKey, obj)) return false;
+    }
+    return true;
+  }
+
+  // Determine if at least one element in the object passes a truth test.
+  function some(obj, predicate, context) {
+    predicate = cb(predicate, context);
+    var _keys = !isArrayLike(obj) && keys(obj),
+        length = (_keys || obj).length;
+    for (var index = 0; index < length; index++) {
+      var currentKey = _keys ? _keys[index] : index;
+      if (predicate(obj[currentKey], currentKey, obj)) return true;
+    }
+    return false;
+  }
+
+  // Determine if the array or object contains a given item (using `===`).
+  function contains(obj, item, fromIndex, guard) {
+    if (!isArrayLike(obj)) obj = values(obj);
+    if (typeof fromIndex != 'number' || guard) fromIndex = 0;
+    return indexOf(obj, item, fromIndex) >= 0;
+  }
+
+  // Invoke a method (with arguments) on every item in a collection.
+  var invoke = restArguments(function(obj, path, args) {
+    var contextPath, func;
+    if (isFunction$1(path)) {
+      func = path;
+    } else {
+      path = toPath(path);
+      contextPath = path.slice(0, -1);
+      path = path[path.length - 1];
+    }
+    return map(obj, function(context) {
+      var method = func;
+      if (!method) {
+        if (contextPath && contextPath.length) {
+          context = deepGet(context, contextPath);
+        }
+        if (context == null) return void 0;
+        method = context[path];
+      }
+      return method == null ? method : method.apply(context, args);
+    });
+  });
+
+  // Convenience version of a common use case of `_.map`: fetching a property.
+  function pluck(obj, key) {
+    return map(obj, property(key));
+  }
+
+  // Convenience version of a common use case of `_.filter`: selecting only
+  // objects containing specific `key:value` pairs.
+  function where(obj, attrs) {
+    return filter(obj, matcher(attrs));
+  }
+
+  // Return the maximum element (or element-based computation).
+  function max(obj, iteratee, context) {
+    var result = -Infinity, lastComputed = -Infinity,
+        value, computed;
+    if (iteratee == null || typeof iteratee == 'number' && typeof obj[0] != 'object' && obj != null) {
+      obj = isArrayLike(obj) ? obj : values(obj);
+      for (var i = 0, length = obj.length; i < length; i++) {
+        value = obj[i];
+        if (value != null && value > result) {
+          result = value;
+        }
+      }
+    } else {
+      iteratee = cb(iteratee, context);
+      each(obj, function(v, index, list) {
+        computed = iteratee(v, index, list);
+        if (computed > lastComputed || computed === -Infinity && result === -Infinity) {
+          result = v;
+          lastComputed = computed;
+        }
+      });
+    }
+    return result;
+  }
+
+  // Return the minimum element (or element-based computation).
+  function min(obj, iteratee, context) {
+    var result = Infinity, lastComputed = Infinity,
+        value, computed;
+    if (iteratee == null || typeof iteratee == 'number' && typeof obj[0] != 'object' && obj != null) {
+      obj = isArrayLike(obj) ? obj : values(obj);
+      for (var i = 0, length = obj.length; i < length; i++) {
+        value = obj[i];
+        if (value != null && value < result) {
+          result = value;
+        }
+      }
+    } else {
+      iteratee = cb(iteratee, context);
+      each(obj, function(v, index, list) {
+        computed = iteratee(v, index, list);
+        if (computed < lastComputed || computed === Infinity && result === Infinity) {
+          result = v;
+          lastComputed = computed;
+        }
+      });
+    }
+    return result;
+  }
+
+  // Safely create a real, live array from anything iterable.
+  var reStrSymbol = /[^\ud800-\udfff]|[\ud800-\udbff][\udc00-\udfff]|[\ud800-\udfff]/g;
+  function toArray(obj) {
+    if (!obj) return [];
+    if (isArray(obj)) return slice.call(obj);
+    if (isString(obj)) {
+      // Keep surrogate pair characters together.
+      return obj.match(reStrSymbol);
+    }
+    if (isArrayLike(obj)) return map(obj, identity);
+    return values(obj);
+  }
+
+  // Sample **n** random values from a collection using the modern version of the
+  // [Fisher-Yates shuffle](https://en.wikipedia.org/wiki/Fisher–Yates_shuffle).
+  // If **n** is not specified, returns a single random element.
+  // The internal `guard` argument allows it to work with `_.map`.
+  function sample(obj, n, guard) {
+    if (n == null || guard) {
+      if (!isArrayLike(obj)) obj = values(obj);
+      return obj[random(obj.length - 1)];
+    }
+    var sample = toArray(obj);
+    var length = getLength(sample);
+    n = Math.max(Math.min(n, length), 0);
+    var last = length - 1;
+    for (var index = 0; index < n; index++) {
+      var rand = random(index, last);
+      var temp = sample[index];
+      sample[index] = sample[rand];
+      sample[rand] = temp;
+    }
+    return sample.slice(0, n);
+  }
+
+  // Shuffle a collection.
+  function shuffle(obj) {
+    return sample(obj, Infinity);
+  }
+
+  // Sort the object's values by a criterion produced by an iteratee.
+  function sortBy(obj, iteratee, context) {
+    var index = 0;
+    iteratee = cb(iteratee, context);
+    return pluck(map(obj, function(value, key, list) {
+      return {
+        value: value,
+        index: index++,
+        criteria: iteratee(value, key, list)
+      };
+    }).sort(function(left, right) {
+      var a = left.criteria;
+      var b = right.criteria;
+      if (a !== b) {
+        if (a > b || a === void 0) return 1;
+        if (a < b || b === void 0) return -1;
+      }
+      return left.index - right.index;
+    }), 'value');
+  }
+
+  // An internal function used for aggregate "group by" operations.
+  function group(behavior, partition) {
+    return function(obj, iteratee, context) {
+      var result = partition ? [[], []] : {};
+      iteratee = cb(iteratee, context);
+      each(obj, function(value, index) {
+        var key = iteratee(value, index, obj);
+        behavior(result, value, key);
+      });
+      return result;
+    };
+  }
+
+  // Groups the object's values by a criterion. Pass either a string attribute
+  // to group by, or a function that returns the criterion.
+  var groupBy = group(function(result, value, key) {
+    if (has$1(result, key)) result[key].push(value); else result[key] = [value];
+  });
+
+  // Indexes the object's values by a criterion, similar to `_.groupBy`, but for
+  // when you know that your index values will be unique.
+  var indexBy = group(function(result, value, key) {
+    result[key] = value;
+  });
+
+  // Counts instances of an object that group by a certain criterion. Pass
+  // either a string attribute to count by, or a function that returns the
+  // criterion.
+  var countBy = group(function(result, value, key) {
+    if (has$1(result, key)) result[key]++; else result[key] = 1;
+  });
+
+  // Split a collection into two arrays: one whose elements all pass the given
+  // truth test, and one whose elements all do not pass the truth test.
+  var partition = group(function(result, value, pass) {
+    result[pass ? 0 : 1].push(value);
+  }, true);
+
+  // Return the number of elements in a collection.
+  function size(obj) {
+    if (obj == null) return 0;
+    return isArrayLike(obj) ? obj.length : keys(obj).length;
+  }
+
+  // Internal `_.pick` helper function to determine whether `key` is an enumerable
+  // property name of `obj`.
+  function keyInObj(value, key, obj) {
+    return key in obj;
+  }
+
+  // Return a copy of the object only containing the allowed properties.
+  var pick = restArguments(function(obj, keys) {
+    var result = {}, iteratee = keys[0];
+    if (obj == null) return result;
+    if (isFunction$1(iteratee)) {
+      if (keys.length > 1) iteratee = optimizeCb(iteratee, keys[1]);
+      keys = allKeys(obj);
+    } else {
+      iteratee = keyInObj;
+      keys = flatten$1(keys, false, false);
+      obj = Object(obj);
+    }
+    for (var i = 0, length = keys.length; i < length; i++) {
+      var key = keys[i];
+      var value = obj[key];
+      if (iteratee(value, key, obj)) result[key] = value;
+    }
+    return result;
+  });
+
+  // Return a copy of the object without the disallowed properties.
+  var omit = restArguments(function(obj, keys) {
+    var iteratee = keys[0], context;
+    if (isFunction$1(iteratee)) {
+      iteratee = negate(iteratee);
+      if (keys.length > 1) context = keys[1];
+    } else {
+      keys = map(flatten$1(keys, false, false), String);
+      iteratee = function(value, key) {
+        return !contains(keys, key);
+      };
+    }
+    return pick(obj, iteratee, context);
+  });
+
+  // Returns everything but the last entry of the array. Especially useful on
+  // the arguments object. Passing **n** will return all the values in
+  // the array, excluding the last N.
+  function initial(array, n, guard) {
+    return slice.call(array, 0, Math.max(0, array.length - (n == null || guard ? 1 : n)));
+  }
+
+  // Get the first element of an array. Passing **n** will return the first N
+  // values in the array. The **guard** check allows it to work with `_.map`.
+  function first(array, n, guard) {
+    if (array == null || array.length < 1) return n == null || guard ? void 0 : [];
+    if (n == null || guard) return array[0];
+    return initial(array, array.length - n);
+  }
+
+  // Returns everything but the first entry of the `array`. Especially useful on
+  // the `arguments` object. Passing an **n** will return the rest N values in the
+  // `array`.
+  function rest(array, n, guard) {
+    return slice.call(array, n == null || guard ? 1 : n);
+  }
+
+  // Get the last element of an array. Passing **n** will return the last N
+  // values in the array.
+  function last(array, n, guard) {
+    if (array == null || array.length < 1) return n == null || guard ? void 0 : [];
+    if (n == null || guard) return array[array.length - 1];
+    return rest(array, Math.max(0, array.length - n));
+  }
+
+  // Trim out all falsy values from an array.
+  function compact(array) {
+    return filter(array, Boolean);
+  }
+
+  // Flatten out an array, either recursively (by default), or up to `depth`.
+  // Passing `true` or `false` as `depth` means `1` or `Infinity`, respectively.
+  function flatten(array, depth) {
+    return flatten$1(array, depth, false);
+  }
+
+  // Take the difference between one array and a number of other arrays.
+  // Only the elements present in just the first array will remain.
+  var difference = restArguments(function(array, rest) {
+    rest = flatten$1(rest, true, true);
+    return filter(array, function(value){
+      return !contains(rest, value);
+    });
+  });
+
+  // Return a version of the array that does not contain the specified value(s).
+  var without = restArguments(function(array, otherArrays) {
+    return difference(array, otherArrays);
+  });
+
+  // Produce a duplicate-free version of the array. If the array has already
+  // been sorted, you have the option of using a faster algorithm.
+  // The faster algorithm will not work with an iteratee if the iteratee
+  // is not a one-to-one function, so providing an iteratee will disable
+  // the faster algorithm.
+  function uniq(array, isSorted, iteratee, context) {
+    if (!isBoolean(isSorted)) {
+      context = iteratee;
+      iteratee = isSorted;
+      isSorted = false;
+    }
+    if (iteratee != null) iteratee = cb(iteratee, context);
+    var result = [];
+    var seen = [];
+    for (var i = 0, length = getLength(array); i < length; i++) {
+      var value = array[i],
+          computed = iteratee ? iteratee(value, i, array) : value;
+      if (isSorted && !iteratee) {
+        if (!i || seen !== computed) result.push(value);
+        seen = computed;
+      } else if (iteratee) {
+        if (!contains(seen, computed)) {
+          seen.push(computed);
+          result.push(value);
+        }
+      } else if (!contains(result, value)) {
+        result.push(value);
+      }
+    }
+    return result;
+  }
+
+  // Produce an array that contains the union: each distinct element from all of
+  // the passed-in arrays.
+  var union = restArguments(function(arrays) {
+    return uniq(flatten$1(arrays, true, true));
+  });
+
+  // Produce an array that contains every item shared between all the
+  // passed-in arrays.
+  function intersection(array) {
+    var result = [];
+    var argsLength = arguments.length;
+    for (var i = 0, length = getLength(array); i < length; i++) {
+      var item = array[i];
+      if (contains(result, item)) continue;
+      var j;
+      for (j = 1; j < argsLength; j++) {
+        if (!contains(arguments[j], item)) break;
+      }
+      if (j === argsLength) result.push(item);
+    }
+    return result;
+  }
+
+  // Complement of zip. Unzip accepts an array of arrays and groups
+  // each array's elements on shared indices.
+  function unzip(array) {
+    var length = array && max(array, getLength).length || 0;
+    var result = Array(length);
+
+    for (var index = 0; index < length; index++) {
+      result[index] = pluck(array, index);
+    }
+    return result;
+  }
+
+  // Zip together multiple lists into a single array -- elements that share
+  // an index go together.
+  var zip = restArguments(unzip);
+
+  // Converts lists into objects. Pass either a single array of `[key, value]`
+  // pairs, or two parallel arrays of the same length -- one of keys, and one of
+  // the corresponding values. Passing by pairs is the reverse of `_.pairs`.
+  function object(list, values) {
+    var result = {};
+    for (var i = 0, length = getLength(list); i < length; i++) {
+      if (values) {
+        result[list[i]] = values[i];
+      } else {
+        result[list[i][0]] = list[i][1];
+      }
+    }
+    return result;
+  }
+
+  // Generate an integer Array containing an arithmetic progression. A port of
+  // the native Python `range()` function. See
+  // [the Python documentation](https://docs.python.org/library/functions.html#range).
+  function range(start, stop, step) {
+    if (stop == null) {
+      stop = start || 0;
+      start = 0;
+    }
+    if (!step) {
+      step = stop < start ? -1 : 1;
+    }
+
+    var length = Math.max(Math.ceil((stop - start) / step), 0);
+    var range = Array(length);
+
+    for (var idx = 0; idx < length; idx++, start += step) {
+      range[idx] = start;
+    }
+
+    return range;
+  }
+
+  // Chunk a single array into multiple arrays, each containing `count` or fewer
+  // items.
+  function chunk(array, count) {
+    if (count == null || count < 1) return [];
+    var result = [];
+    var i = 0, length = array.length;
+    while (i < length) {
+      result.push(slice.call(array, i, i += count));
+    }
+    return result;
+  }
+
+  // Helper function to continue chaining intermediate results.
+  function chainResult(instance, obj) {
+    return instance._chain ? _$1(obj).chain() : obj;
+  }
+
+  // Add your own custom functions to the Underscore object.
+  function mixin(obj) {
+    each(functions(obj), function(name) {
+      var func = _$1[name] = obj[name];
+      _$1.prototype[name] = function() {
+        var args = [this._wrapped];
+        push.apply(args, arguments);
+        return chainResult(this, func.apply(_$1, args));
+      };
+    });
+    return _$1;
+  }
+
+  // Add all mutator `Array` functions to the wrapper.
+  each(['pop', 'push', 'reverse', 'shift', 'sort', 'splice', 'unshift'], function(name) {
+    var method = ArrayProto[name];
+    _$1.prototype[name] = function() {
+      var obj = this._wrapped;
+      if (obj != null) {
+        method.apply(obj, arguments);
+        if ((name === 'shift' || name === 'splice') && obj.length === 0) {
+          delete obj[0];
+        }
+      }
+      return chainResult(this, obj);
+    };
+  });
+
+  // Add all accessor `Array` functions to the wrapper.
+  each(['concat', 'join', 'slice'], function(name) {
+    var method = ArrayProto[name];
+    _$1.prototype[name] = function() {
+      var obj = this._wrapped;
+      if (obj != null) obj = method.apply(obj, arguments);
+      return chainResult(this, obj);
+    };
+  });
+
+  // Named Exports
+
+  var allExports = {
+    __proto__: null,
+    VERSION: VERSION,
+    restArguments: restArguments,
+    isObject: isObject,
+    isNull: isNull,
+    isUndefined: isUndefined,
+    isBoolean: isBoolean,
+    isElement: isElement,
+    isString: isString,
+    isNumber: isNumber,
+    isDate: isDate,
+    isRegExp: isRegExp,
+    isError: isError,
+    isSymbol: isSymbol,
+    isArrayBuffer: isArrayBuffer,
+    isDataView: isDataView$1,
+    isArray: isArray,
+    isFunction: isFunction$1,
+    isArguments: isArguments$1,
+    isFinite: isFinite$1,
+    isNaN: isNaN$1,
+    isTypedArray: isTypedArray$1,
+    isEmpty: isEmpty,
+    isMatch: isMatch,
+    isEqual: isEqual,
+    isMap: isMap,
+    isWeakMap: isWeakMap,
+    isSet: isSet,
+    isWeakSet: isWeakSet,
+    keys: keys,
+    allKeys: allKeys,
+    values: values,
+    pairs: pairs,
+    invert: invert,
+    functions: functions,
+    methods: functions,
+    extend: extend,
+    extendOwn: extendOwn,
+    assign: extendOwn,
+    defaults: defaults,
+    create: create,
+    clone: clone,
+    tap: tap,
+    get: get,
+    has: has,
+    mapObject: mapObject,
+    identity: identity,
+    constant: constant,
+    noop: noop,
+    toPath: toPath$1,
+    property: property,
+    propertyOf: propertyOf,
+    matcher: matcher,
+    matches: matcher,
+    times: times,
+    random: random,
+    now: now,
+    escape: _escape,
+    unescape: _unescape,
+    templateSettings: templateSettings,
+    template: template,
+    result: result,
+    uniqueId: uniqueId,
+    chain: chain,
+    iteratee: iteratee,
+    partial: partial,
+    bind: bind,
+    bindAll: bindAll,
+    memoize: memoize,
+    delay: delay,
+    defer: defer,
+    throttle: throttle,
+    debounce: debounce,
+    wrap: wrap,
+    negate: negate,
+    compose: compose,
+    after: after,
+    before: before,
+    once: once,
+    findKey: findKey,
+    findIndex: findIndex,
+    findLastIndex: findLastIndex,
+    sortedIndex: sortedIndex,
+    indexOf: indexOf,
+    lastIndexOf: lastIndexOf,
+    find: find,
+    detect: find,
+    findWhere: findWhere,
+    each: each,
+    forEach: each,
+    map: map,
+    collect: map,
+    reduce: reduce,
+    foldl: reduce,
+    inject: reduce,
+    reduceRight: reduceRight,
+    foldr: reduceRight,
+    filter: filter,
+    select: filter,
+    reject: reject,
+    every: every,
+    all: every,
+    some: some,
+    any: some,
+    contains: contains,
+    includes: contains,
+    include: contains,
+    invoke: invoke,
+    pluck: pluck,
+    where: where,
+    max: max,
+    min: min,
+    shuffle: shuffle,
+    sample: sample,
+    sortBy: sortBy,
+    groupBy: groupBy,
+    indexBy: indexBy,
+    countBy: countBy,
+    partition: partition,
+    toArray: toArray,
+    size: size,
+    pick: pick,
+    omit: omit,
+    first: first,
+    head: first,
+    take: first,
+    initial: initial,
+    last: last,
+    rest: rest,
+    tail: rest,
+    drop: rest,
+    compact: compact,
+    flatten: flatten,
+    without: without,
+    uniq: uniq,
+    unique: uniq,
+    union: union,
+    intersection: intersection,
+    difference: difference,
+    unzip: unzip,
+    transpose: unzip,
+    zip: zip,
+    object: object,
+    range: range,
+    chunk: chunk,
+    mixin: mixin,
+    'default': _$1
+  };
+
+  // Default Export
+
+  // Add all of the Underscore functions to the wrapper object.
+  var _ = mixin(allExports);
+  // Legacy Node.js API.
+  _._ = _;
+
+  return _;
+
+})));
+//# sourceMappingURL=underscore-umd.js.map
diff --git a/administration/configuration/bastion_conf.html b/administration/configuration/bastion_conf.html
new file mode 100644
index 000000000..cf1071004
--- /dev/null
+++ b/administration/configuration/bastion_conf.html
@@ -0,0 +1,1278 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>bastion.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-backup-acl-keys.conf" href="osh-backup-acl-keys_conf.html" />
+    <link rel="prev" title="Configuration files" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a><ul class="current">
+<li class="toctree-l3 current"><a class="current reference internal" href="#">bastion.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-backup-acl-keys_conf.html">osh-backup-acl-keys.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-encrypt-rsync_conf.html">osh-encrypt-rsync.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-sync-watcher_sh.html">osh-sync-watcher.sh</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-http-proxy_conf.html">osh-http-proxy.conf</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>bastion.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/bastion_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="bastion-conf">
+<h1>bastion.conf<a class="headerlink" href="#bastion-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>The Bastion has a lot of configuration options so that you can tailor it
+to your needs. However, if you're just beggining and would like to get
+started quickly, just configure the <code class="docutils literal notranslate"><span class="pre">Main</span> <span class="pre">Options</span></code>.
+All the other options have sane defaults that can still be customized
+at a later time.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="main-options-options">
+<h3>Main Options options<a class="headerlink" href="#main-options-options" title="Permalink to this headline"></a></h3>
+<p>Those are the options you should customize when first setting up a bastion. All the other options have sane defaults and can be customized later if needed.</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#bastionname">bastionName</a></p></li>
+<li><p><a class="reference internal" href="#bastioncommand">bastionCommand</a></p></li>
+<li><p><a class="reference internal" href="#readonlyslavemode">readOnlySlaveMode</a></p></li>
+<li><p><a class="reference internal" href="#adminaccounts">adminAccounts</a></p></li>
+<li><p><a class="reference internal" href="#superowneraccounts">superOwnerAccounts</a></p></li>
+</ul>
+</section>
+<section id="ssh-policies-options">
+<h3>SSH Policies options<a class="headerlink" href="#ssh-policies-options" title="Permalink to this headline"></a></h3>
+<p>All the options related to the SSH configuration and policies, both for ingress and egress connections.</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#allowedingresssshalgorithms">allowedIngressSshAlgorithms</a></p></li>
+<li><p><a class="reference internal" href="#allowedegresssshalgorithms">allowedEgressSshAlgorithms</a></p></li>
+<li><p><a class="reference internal" href="#minimumingressrsakeysize">minimumIngressRsaKeySize</a></p></li>
+<li><p><a class="reference internal" href="#maximumingressrsakeysize">maximumIngressRsaKeySize</a></p></li>
+<li><p><a class="reference internal" href="#minimumegressrsakeysize">minimumEgressRsaKeySize</a></p></li>
+<li><p><a class="reference internal" href="#maximumegressrsakeysize">maximumEgressRsaKeySize</a></p></li>
+<li><p><a class="reference internal" href="#defaultaccountegresskeyalgorithm">defaultAccountEgressKeyAlgorithm</a></p></li>
+<li><p><a class="reference internal" href="#defaultaccountegresskeysize">defaultAccountEgressKeySize</a></p></li>
+<li><p><a class="reference internal" href="#moshallowed">moshAllowed</a></p></li>
+<li><p><a class="reference internal" href="#moshtimeoutnetwork">moshTimeoutNetwork</a></p></li>
+<li><p><a class="reference internal" href="#moshtimeoutsignal">moshTimeoutSignal</a></p></li>
+<li><p><a class="reference internal" href="#moshcommandline">moshCommandLine</a></p></li>
+</ul>
+</section>
+<section id="global-network-policies-options">
+<h3>Global network policies options<a class="headerlink" href="#global-network-policies-options" title="Permalink to this headline"></a></h3>
+<p>Those options can set a few global network policies to be applied bastion-wide.</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#dnssupportlevel">dnsSupportLevel</a></p></li>
+<li><p><a class="reference internal" href="#allowednetworks">allowedNetworks</a></p></li>
+<li><p><a class="reference internal" href="#forbiddennetworks">forbiddenNetworks</a></p></li>
+<li><p><a class="reference internal" href="#ingresstoegressrules">ingressToEgressRules</a></p></li>
+</ul>
+</section>
+<section id="logging-options">
+<h3>Logging options<a class="headerlink" href="#logging-options" title="Permalink to this headline"></a></h3>
+<p>Options to customize how logs should be produced.</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#enablesyslog">enableSyslog</a></p></li>
+<li><p><a class="reference internal" href="#syslogfacility">syslogFacility</a></p></li>
+<li><p><a class="reference internal" href="#syslogdescription">syslogDescription</a></p></li>
+<li><p><a class="reference internal" href="#enableglobalaccesslog">enableGlobalAccessLog</a></p></li>
+<li><p><a class="reference internal" href="#enableaccountaccesslog">enableAccountAccessLog</a></p></li>
+<li><p><a class="reference internal" href="#enableglobalsqllog">enableGlobalSqlLog</a></p></li>
+<li><p><a class="reference internal" href="#enableaccountsqllog">enableAccountSqlLog</a></p></li>
+<li><p><a class="reference internal" href="#ttyrecfilenameformat">ttyrecFilenameFormat</a></p></li>
+<li><p><a class="reference internal" href="#ttyrecadditionalparameters">ttyrecAdditionalParameters</a></p></li>
+<li><p><a class="reference internal" href="#ttyrecstealthstdoutpattern">ttyrecStealthStdoutPattern</a></p></li>
+</ul>
+</section>
+<section id="other-ingress-policies-options">
+<h3>Other ingress policies options<a class="headerlink" href="#other-ingress-policies-options" title="Permalink to this headline"></a></h3>
+<p>Policies applying to the ingress connections</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#ingresskeysfrom">ingressKeysFrom</a></p></li>
+<li><p><a class="reference internal" href="#ingresskeysfromallowoverride">ingressKeysFromAllowOverride</a></p></li>
+</ul>
+</section>
+<section id="other-egress-policies-options">
+<h3>Other egress policies options<a class="headerlink" href="#other-egress-policies-options" title="Permalink to this headline"></a></h3>
+<p>Policies applying to the egress connections</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#defaultlogin">defaultLogin</a></p></li>
+<li><p><a class="reference internal" href="#egresskeysfrom">egressKeysFrom</a></p></li>
+<li><p><a class="reference internal" href="#keyboardinteractiveallowed">keyboardInteractiveAllowed</a></p></li>
+<li><p><a class="reference internal" href="#passwordallowed">passwordAllowed</a></p></li>
+<li><p><a class="reference internal" href="#telnetallowed">telnetAllowed</a></p></li>
+</ul>
+</section>
+<section id="session-policies-options">
+<h3>Session policies options<a class="headerlink" href="#session-policies-options" title="Permalink to this headline"></a></h3>
+<p>Options to customize the established sessions behaviour</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#displaylastlogin">displayLastLogin</a></p></li>
+<li><p><a class="reference internal" href="#fanciness">fanciness</a></p></li>
+<li><p><a class="reference internal" href="#interactivemodeallowed">interactiveModeAllowed</a></p></li>
+<li><p><a class="reference internal" href="#interactivemodetimeout">interactiveModeTimeout</a></p></li>
+<li><p><a class="reference internal" href="#interactivemodebydefault">interactiveModeByDefault</a></p></li>
+<li><p><a class="reference internal" href="#interactivemodeproactivemfaenabled">interactiveModeProactiveMFAenabled</a></p></li>
+<li><p><a class="reference internal" href="#interactivemodeproactivemfaexpiration">interactiveModeProactiveMFAexpiration</a></p></li>
+<li><p><a class="reference internal" href="#idlelocktimeout">idleLockTimeout</a></p></li>
+<li><p><a class="reference internal" href="#idlekilltimeout">idleKillTimeout</a></p></li>
+<li><p><a class="reference internal" href="#warnbeforelockseconds">warnBeforeLockSeconds</a></p></li>
+<li><p><a class="reference internal" href="#warnbeforekillseconds">warnBeforeKillSeconds</a></p></li>
+<li><p><a class="reference internal" href="#accountexternalvalidationprogram">accountExternalValidationProgram</a></p></li>
+<li><p><a class="reference internal" href="#accountexternalvalidationdenyonfailure">accountExternalValidationDenyOnFailure</a></p></li>
+<li><p><a class="reference internal" href="#alwaysactiveaccounts">alwaysActiveAccounts</a></p></li>
+</ul>
+</section>
+<section id="account-policies-options">
+<h3>Account policies options<a class="headerlink" href="#account-policies-options" title="Permalink to this headline"></a></h3>
+<p>Policies applying to the bastion accounts themselves</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#accountmaxinactivedays">accountMaxInactiveDays</a></p></li>
+<li><p><a class="reference internal" href="#accountexpiredmessage">accountExpiredMessage</a></p></li>
+<li><p><a class="reference internal" href="#accountcreatesupplementarygroups">accountCreateSupplementaryGroups</a></p></li>
+<li><p><a class="reference internal" href="#accountcreatedefaultpersonalaccesses">accountCreateDefaultPersonalAccesses</a></p></li>
+<li><p><a class="reference internal" href="#ingressrequirepiv">ingressRequirePIV</a></p></li>
+<li><p><a class="reference internal" href="#accountmfapolicy">accountMFAPolicy</a></p></li>
+<li><p><a class="reference internal" href="#mfapasswordmindays">MFAPasswordMinDays</a></p></li>
+<li><p><a class="reference internal" href="#mfapasswordmaxdays">MFAPasswordMaxDays</a></p></li>
+<li><p><a class="reference internal" href="#mfapasswordwarndays">MFAPasswordWarnDays</a></p></li>
+<li><p><a class="reference internal" href="#mfapasswordinactivedays">MFAPasswordInactiveDays</a></p></li>
+<li><p><a class="reference internal" href="#mfapostcommand">MFAPostCommand</a></p></li>
+<li><p><a class="reference internal" href="#totpprovider">TOTPProvider</a></p></li>
+</ul>
+</section>
+<section id="other-options-options">
+<h3>Other options options<a class="headerlink" href="#other-options-options" title="Permalink to this headline"></a></h3>
+<p>These options are either discouraged (in which case this is explained in the description) or rarely need to be modified.</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#accountuidmin">accountUidMin</a></p></li>
+<li><p><a class="reference internal" href="#accountuidmax">accountUidMax</a></p></li>
+<li><p><a class="reference internal" href="#ttyrecgroupidoffset">ttyrecGroupIdOffset</a></p></li>
+<li><p><a class="reference internal" href="#documentationurl">documentationURL</a></p></li>
+<li><p><a class="reference internal" href="#debug">debug</a></p></li>
+<li><p><a class="reference internal" href="#remotecommandescapebydefault">remoteCommandEscapeByDefault</a></p></li>
+<li><p><a class="reference internal" href="#sshclientdebuglevel">sshClientDebugLevel</a></p></li>
+<li><p><a class="reference internal" href="#sshclienthasoptione">sshClientHasOptionE</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="main-options">
+<h3>Main Options<a class="headerlink" href="#main-options" title="Permalink to this headline"></a></h3>
+<section id="bastionname">
+<span id="id1"></span><h4>bastionName<a class="headerlink" href="#bastionname" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;fix-my-config-please-missing-bastion-name&quot;</span></code></p>
+</dd>
+</dl>
+<p>This will be the name advertised in the aliases admins will give to bastion users, and also in the banner of the plugins output. You can see it as a friendly name everybody will use to refer to this machine: something more friendly than just its full hostname.</p>
+</section>
+<section id="bastioncommand">
+<span id="id2"></span><h4>bastionCommand<a class="headerlink" href="#bastioncommand" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;ssh</span> <span class="pre">USER&#64;HOSTNAME</span> <span class="pre">-t</span> <span class="pre">--&quot;</span></code></p>
+</dd>
+</dl>
+<p>The <code class="docutils literal notranslate"><span class="pre">ssh</span></code> command to launch to connect to this bastion as a user. This will be printed on <code class="docutils literal notranslate"><span class="pre">accountCreate</span></code>, so that the new user knows how to connect. Magic tokens are:</p>
+<ul class="simple">
+<li><p>ACCOUNT or USER: replaced at runtime by the account name</p></li>
+<li><p>BASTIONNAME: replaced at runtime by the name defined in <code class="docutils literal notranslate"><span class="pre">bastionName</span></code></p></li>
+<li><p>HOSTNAME: replaced at runtime by the hostname of the system</p></li>
+</ul>
+<p>So, for example if your specify <code class="docutils literal notranslate"><span class="pre">ssh</span> <span class="pre">USER&#64;HOSTNAME</span> <span class="pre">-t</span> <span class="pre">--</span></code>, it'll give <code class="docutils literal notranslate"><span class="pre">johndoe&#64;bastion1.example.org</span> <span class="pre">-t</span> <span class="pre">--</span></code> as a bastion alias to <em>johndoe</em></p>
+</section>
+<section id="readonlyslavemode">
+<span id="id3"></span><h4>readOnlySlaveMode<a class="headerlink" href="#readonlyslavemode" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">false</span></code>, this bastion will work in standalone mode, or will be the master in a master/slave mode. If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, this'll be the slave which means all plugins that modify groups, accounts, or access rights will be disabled, and the master bastion will push its modifications using inotify/rsync, please refer do the documentation to set this up.</p>
+</section>
+<section id="adminaccounts">
+<span id="id4"></span><h4>adminAccounts<a class="headerlink" href="#adminaccounts" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(account</span> <span class="pre">names)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>The list of accounts that are Admins of the bastion. Admins can't be deleted or otherwise modified by non-admins. They also gain access to special dangerous/sensitive <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands, such as being able to impersonate anybody else. Note that an Admin is also always considered as a Super Owner, which means they also override all checks of group administrative commands. Don't forget to add them to the <code class="docutils literal notranslate"><span class="pre">osh-admin</span></code> group too (system-wise), or they won't really be considered as Admins: this is an additional security measure against privilege escalation. Rule of thumb: it's probably a good idea to only add here people that have <code class="docutils literal notranslate"><span class="pre">root</span></code> access to the bastion machine itself.</p>
+</section>
+<section id="superowneraccounts">
+<span id="id5"></span><h4>superOwnerAccounts<a class="headerlink" href="#superowneraccounts" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(account</span> <span class="pre">names)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>The list of accounts that are &quot;Super Owners&quot;. They can run all group administrative commands, exactly as if they were implicitly owners of all the groups. Super Owners are only here as a last resort when the owners/gatekeepers/aclkeepers of a group are not available. Every command run by a Super Owner that would have failed if the account was not a Super Owner is logged explicitly as &quot;Super Owner Override&quot;, you might want to add a rule for those in your SIEM. You can consider than the Super Owners have an implicit <em>sudo</em> for group management. Don't add here accounts that are bastion Admins, as they already inherit the Super Owner role. Don't forget to add them to the <code class="docutils literal notranslate"><span class="pre">osh-superowner</span></code> group too (system-wise), or they won't really be considered as &quot;Super Owners&quot;: this is an additional security measure against privilege escalation.</p>
+</section>
+</section>
+<section id="ssh-policies">
+<h3>SSH Policies<a class="headerlink" href="#ssh-policies" title="Permalink to this headline"></a></h3>
+<section id="allowedingresssshalgorithms">
+<span id="id6"></span><h4>allowedIngressSshAlgorithms<a class="headerlink" href="#allowedingresssshalgorithms" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(algorithm</span> <span class="pre">names)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[</span> <span class="pre">&quot;rsa&quot;,</span> <span class="pre">&quot;ecdsa&quot;,</span> <span class="pre">&quot;ed25519&quot;</span> <span class="pre">]</span></code></p>
+</dd>
+</dl>
+<p>The algorithms authorized for ingress ssh public keys added to this bastion. Possible values: <code class="docutils literal notranslate"><span class="pre">rsa</span></code>, <code class="docutils literal notranslate"><span class="pre">ecdsa</span></code>, <code class="docutils literal notranslate"><span class="pre">ed25519</span></code>, <code class="docutils literal notranslate"><span class="pre">ecdsa-sk</span></code>, <code class="docutils literal notranslate"><span class="pre">ed25519-sk</span></code>, note that some of those might not be supported by your current version of <code class="docutils literal notranslate"><span class="pre">OpenSSH</span></code>: unsupported algorithms are automatically omitted at runtime.</p>
+</section>
+<section id="allowedegresssshalgorithms">
+<span id="id7"></span><h4>allowedEgressSshAlgorithms<a class="headerlink" href="#allowedegresssshalgorithms" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(algorithm</span> <span class="pre">names)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[</span> <span class="pre">&quot;rsa&quot;,</span> <span class="pre">&quot;ecdsa&quot;,</span> <span class="pre">&quot;ed25519&quot;</span> <span class="pre">]</span></code></p>
+</dd>
+</dl>
+<p>The algorithms authorized for egress ssh public keys generated on this bastion. Possible values: <code class="docutils literal notranslate"><span class="pre">rsa</span></code>, <code class="docutils literal notranslate"><span class="pre">ecdsa</span></code>, <code class="docutils literal notranslate"><span class="pre">ed25519</span></code>, note that some of those might not be supported by your current version of <code class="docutils literal notranslate"><span class="pre">OpenSSH</span></code>, unsupported algorithms are automatically omitted at runtime.</p>
+</section>
+<section id="minimumingressrsakeysize">
+<span id="id8"></span><h4>minimumIngressRsaKeySize<a class="headerlink" href="#minimumingressrsakeysize" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">2048</span></code></p>
+</dd>
+</dl>
+<p>The minimum allowed size for ingress RSA keys (user-&gt;bastion). Sane values range from 2048 to 4096.</p>
+</section>
+<section id="maximumingressrsakeysize">
+<span id="id9"></span><h4>maximumIngressRsaKeySize<a class="headerlink" href="#maximumingressrsakeysize" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">8192</span></code></p>
+</dd>
+</dl>
+<p>The maximum allowed size for ingress RSA keys (user-&gt;bastion). Too big values (&gt;8192) are extremely CPU intensive and don't really add that much security.</p>
+</section>
+<section id="minimumegressrsakeysize">
+<span id="id10"></span><h4>minimumEgressRsaKeySize<a class="headerlink" href="#minimumegressrsakeysize" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">2048</span></code></p>
+</dd>
+</dl>
+<p>The minimum allowed size for egress RSA keys (bastion-&gt;server). Sane values range from 2048 to 4096.</p>
+</section>
+<section id="maximumegressrsakeysize">
+<span id="id11"></span><h4>maximumEgressRsaKeySize<a class="headerlink" href="#maximumegressrsakeysize" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">8192</span></code></p>
+</dd>
+</dl>
+<p>The maximum allowed size for ingress RSA keys (bastion-&gt;server). Too big values (&gt;8192) are extremely CPU intensive and don't really add that much security.</p>
+</section>
+<section id="defaultaccountegresskeyalgorithm">
+<span id="id12"></span><h4>defaultAccountEgressKeyAlgorithm<a class="headerlink" href="#defaultaccountegresskeyalgorithm" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;rsa&quot;</span></code></p>
+</dd>
+</dl>
+<p>The default algorithm to use to create the egress key of a newly created account</p>
+</section>
+<section id="defaultaccountegresskeysize">
+<span id="id13"></span><h4>defaultAccountEgressKeySize<a class="headerlink" href="#defaultaccountegresskeysize" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">4096</span></code></p>
+</dd>
+</dl>
+<p>The default size to use to create the egress key of a newly created account (also see <code class="docutils literal notranslate"><span class="pre">defaultAccountEgressKeyAlgorithm</span></code>)</p>
+</section>
+<section id="moshallowed">
+<span id="id14"></span><h4>moshAllowed<a class="headerlink" href="#moshallowed" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, mosh usage is allowed (mosh needs to be installed on serverside, obviously). Otherwise, this feature is disabled.</p>
+</section>
+<section id="moshtimeoutnetwork">
+<span id="id15"></span><h4>moshTimeoutNetwork<a class="headerlink" href="#moshtimeoutnetwork" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">86400</span></code></p>
+</dd>
+</dl>
+<p>Number of seconds of inactivity (network-wise) after a mosh-server will exit. By design even if the client is disconnected &quot;for good&quot;, mosh-server would wait forever. If mosh is meant to handle shaky connections but not mobility, you can set this to a low value. It sets the <code class="docutils literal notranslate"><span class="pre">MOSH_SERVER_NETWORK_TMOUT</span></code> envvar for mosh, see <code class="docutils literal notranslate"><span class="pre">man</span> <span class="pre">mosh-server</span></code> for more information (mosh 1.2.6+).</p>
+</section>
+<section id="moshtimeoutsignal">
+<span id="id16"></span><h4>moshTimeoutSignal<a class="headerlink" href="#moshtimeoutsignal" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">30</span></code></p>
+</dd>
+</dl>
+<p>Number of seconds of inactivity (network-wise) a mosh-server will wait after receiving a <code class="docutils literal notranslate"><span class="pre">SIGUSR1</span></code> before exiting. It sets the <code class="docutils literal notranslate"><span class="pre">MOSH_SERVER_SIGNAL_TMOUT</span></code> envvar for mosh, see <code class="docutils literal notranslate"><span class="pre">man</span> <span class="pre">mosh-server</span></code> for more information (mosh 1.2.6+).</p>
+</section>
+<section id="moshcommandline">
+<span id="id17"></span><h4>moshCommandLine<a class="headerlink" href="#moshcommandline" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;-s</span> <span class="pre">-p</span> <span class="pre">40000:49999&quot;</span></code></p>
+</dd>
+</dl>
+<p>Additional parameters that will be passed as-is to mosh-server. See <code class="docutils literal notranslate"><span class="pre">man</span> <span class="pre">mosh-server</span></code>, you should at least add the <code class="docutils literal notranslate"><span class="pre">-p</span></code> option to specify a fixed number of ports (easier for firewall configuration).</p>
+</section>
+</section>
+<section id="global-network-policies">
+<h3>Global network policies<a class="headerlink" href="#global-network-policies" title="Permalink to this headline"></a></h3>
+<section id="dnssupportlevel">
+<span id="id18"></span><h4>dnsSupportLevel<a class="headerlink" href="#dnssupportlevel" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">integer</span> <span class="pre">between</span> <span class="pre">0</span> <span class="pre">and</span> <span class="pre">2</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">2</span></code></p>
+</dd>
+</dl>
+<dl class="simple">
+<dt>If set to 0, The Bastion will never attempt to do DNS or reverse-DNS resolutions, and return an error if you request connection to a hostname instead of an IP. Use this if you know there's no working DNS in your environment and only use IPs everywhere.</dt><dd><p>If set to 1, The Bastion will not attempt to do DNS or reverse-DNS resolutions unless you force it to (i.e. by requesting connection to a hostname instead of an IP). You may use this if for example you have well-known hostnames in /etc/hosts, but don't have a working DNS (which would imply that reverse-DNS resolutions will always fail).
+If set to 2, The Bastion will make the assumption that you have a working DNS setup, and will do DNS and reverse-DNS resolutions normally.</p>
+</dd>
+</dl>
+</section>
+<section id="allowednetworks">
+<span id="id19"></span><h4>allowedNetworks<a class="headerlink" href="#allowednetworks" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(IPs</span> <span class="pre">and/or</span> <span class="pre">prefixes)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">[&quot;10.42.0.0/16&quot;,&quot;192.168.111.0/24&quot;,&quot;203.0.113.42&quot;]</span></code></p>
+</dd>
+</dl>
+<p>Restricts egress connection attempts to those listed networks only. This is enforced at all times and can NOT be overridden by users. If you are lucky enough to have you own IP blocks, it's probably a good idea to list them here. An empty array means no restriction is applied.</p>
+</section>
+<section id="forbiddennetworks">
+<span id="id20"></span><h4>forbiddenNetworks<a class="headerlink" href="#forbiddennetworks" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(IPs</span> <span class="pre">and/or</span> <span class="pre">prefixes)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">[&quot;10.42.42.0/24&quot;]</span></code></p>
+</dd>
+</dl>
+<p>Prevents egress connection to the listed networks, this takes precedence over <code class="docutils literal notranslate"><span class="pre">allowedNetworks</span></code>. This can be used to prevent connection to some hosts or subnets in a broadly allowed prefix. This is enforced at all times and can NOT be overridden by users.</p>
+</section>
+<section id="ingresstoegressrules">
+<span id="id21"></span><h4>ingressToEgressRules<a class="headerlink" href="#ingresstoegressrules" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">rules,</span> <span class="pre">a</span> <span class="pre">rule</span> <span class="pre">being</span> <span class="pre">a</span> <span class="pre">3-uple</span> <span class="pre">of</span> <span class="pre">[array,</span> <span class="pre">array,</span> <span class="pre">string]</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>Fine-grained rules (a la <em>netfilter</em>) to apply global restrictions to possible egress destinations given ingress IPs. This is similar to <code class="docutils literal notranslate"><span class="pre">allowedNetworks</span></code> and <code class="docutils literal notranslate"><span class="pre">forbiddenNetworks</span></code>, but way more powerful (in fact, those two previous options can be expressed exclusively using <code class="docutils literal notranslate"><span class="pre">ingressToEgressRules</span></code>). Those rules here are enforced at all times and can <strong>NOT</strong> be overridden by users or admins.
+Each rule will be processed <strong>IN ORDER</strong>. The first rule to match will be applied and no other rule will be checked.
+If no rule matches, the default is to apply no restriction.
+A rule is a 3-uple of [<code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">ingress</span> <span class="pre">networks</span></code>, <code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">egress</span> <span class="pre">networks</span></code>, <code class="docutils literal notranslate"><span class="pre">policy</span> <span class="pre">to</span> <span class="pre">apply</span></code>].</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">ingress</span> <span class="pre">networks</span></code>: if the IP of the ingress connection matches a network or IP in this list, the rule <em>may</em> apply: we proceed to check the egress network IP</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">egress</span> <span class="pre">networks</span></code>: if the IP of the egress connection matches a network or IP in this list, the rule <em>does</em> apply and we'll enforce the policy defined in the third item of the rule</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">policy</span> <span class="pre">to</span> <span class="pre">apply</span></code>: this is what to enforce when the ingress and egress network match</p></li>
+</ul>
+<p>The &quot;policy to apply&quot; item can have 3 values:</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">ALLOW</span></code>, no restriction will be applied (all rights-check of groups and personal accesses still apply)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">DENY</span></code>, access will be denied regardless of any group or personal accesses</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">ALLOW-EXCLUSIVE</span></code>, access will be allowed <strong>if and only if</strong> the egress network match, given the ingress network. In other words, if the ingress IP matches one of the ingress networks specified in the rule, but the egress IP <strong>DOES NOT</strong> match any of the egress network specified, access will be denied. This is an easy way to ensure that a given list of ingress networks can only access a precise list of egress networks and nothing else.</p></li>
+</ul>
+<p>For example, take the following configuration:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="o">[</span>
+   <span class="o">[[</span><span class="s2">&quot;10.19.0.0/16&quot;</span>,<span class="s2">&quot;10.15.15.0/24&quot;</span><span class="o">]</span>, <span class="o">[</span><span class="s2">&quot;10.20.0.0/16&quot;</span><span class="o">]</span>,    <span class="s2">&quot;ALLOW-EXCLUSIVE&quot;</span><span class="o">]</span>,
+   <span class="o">[[</span><span class="s2">&quot;192.168.42.0/24&quot;</span><span class="o">]</span>,              <span class="o">[</span><span class="s2">&quot;192.168.42.0/24&quot;</span><span class="o">]</span>, <span class="s2">&quot;ALLOW&quot;</span><span class="o">]</span>,
+   <span class="o">[[</span><span class="s2">&quot;192.168.0.0/16&quot;</span><span class="o">]</span>,               <span class="o">[</span><span class="s2">&quot;192.168.0.0/16&quot;</span><span class="o">]</span>,  <span class="s2">&quot;DENY&quot;</span><span class="o">]</span>
+<span class="o">]</span>
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>The <code class="docutils literal notranslate"><span class="pre">10.19.0.0/16</span></code> and <code class="docutils literal notranslate"><span class="pre">10.15.15.0/24</span></code> networks can only access the <code class="docutils literal notranslate"><span class="pre">10.20.0.0/16</span></code> network (rule <code class="docutils literal notranslate"><span class="pre">#1</span></code>)</p></li>
+<li><p>The <code class="docutils literal notranslate"><span class="pre">192.168.42.0/24</span></code> network can access any machine from its own /24 network (rule <code class="docutils literal notranslate"><span class="pre">#2</span></code>), but not any other machine from the wider <code class="docutils literal notranslate"><span class="pre">192.168.0.0/16</span></code> network (rule <code class="docutils literal notranslate"><span class="pre">#3</span></code>). It can however access any other machine outside of this block (implicit allow catch-all rule, as there is no corresponding <code class="docutils literal notranslate"><span class="pre">DENY</span></code> rule, and rule <code class="docutils literal notranslate"><span class="pre">#2</span></code> is <code class="docutils literal notranslate"><span class="pre">ALLOW</span></code> and not <code class="docutils literal notranslate"><span class="pre">ALLOW-EXCLUSIVE</span></code>)</p></li>
+<li><p>The <code class="docutils literal notranslate"><span class="pre">192.168.0.0/16</span></code> network (except <code class="docutils literal notranslate"><span class="pre">192.168.42.0/16</span></code>) can access any machine except one from its own network (rule <code class="docutils literal notranslate"><span class="pre">#3</span></code>)</p></li>
+<li><p>All the other networks can access any other network (including egress <code class="docutils literal notranslate"><span class="pre">10.20.0.0/16</span></code> or egress <code class="docutils literal notranslate"><span class="pre">192.168.0.0/16</span></code>)</p></li>
+</ul>
+<p>In any case, all the personal and group accesses still apply in addition to these global rules.</p>
+</section>
+</section>
+<section id="logging">
+<h3>Logging<a class="headerlink" href="#logging" title="Permalink to this headline"></a></h3>
+<section id="enablesyslog">
+<span id="id22"></span><h4>enableSyslog<a class="headerlink" href="#enablesyslog" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If enabled, we'll send logs through syslog, don't forget to setup your syslog daemon!. You can also adjust <code class="docutils literal notranslate"><span class="pre">syslogFacility</span></code> and <code class="docutils literal notranslate"><span class="pre">syslogDescription</span></code> below, to match your syslog configuration. Note that the provided <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code> templates work with the default values left as-is.</p>
+</section>
+<section id="syslogfacility">
+<span id="id23"></span><h4>syslogFacility<a class="headerlink" href="#syslogfacility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local7&quot;</span></code></p>
+</dd>
+</dl>
+<p>Sets the facility that will be used for syslog.</p>
+</section>
+<section id="syslogdescription">
+<span id="id24"></span><h4>syslogDescription<a class="headerlink" href="#syslogdescription" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;bastion&quot;</span></code></p>
+</dd>
+</dl>
+<p>Sets the description that will be used for syslog.</p>
+</section>
+<section id="enableglobalaccesslog">
+<span id="id25"></span><h4>enableGlobalAccessLog<a class="headerlink" href="#enableglobalaccesslog" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If enabled, all <em>open</em> and <em>close</em> logs will be written to <code class="docutils literal notranslate"><span class="pre">/home/logkeeper/global-log-YYYYMM.log</span></code>. Those are also logged through syslog if <em>enableSyslog</em> is set.</p>
+</section>
+<section id="enableaccountaccesslog">
+<span id="id26"></span><h4>enableAccountAccessLog<a class="headerlink" href="#enableaccountaccesslog" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If enabled, all <em>open</em> and <em>close</em> logs will be written to the corresponding user's home in <code class="docutils literal notranslate"><span class="pre">/home/USER/USER-log-YYYYMM.log</span></code>. Those are also logged through syslog if <em>enableSyslog</em> is set.</p>
+</section>
+<section id="enableglobalsqllog">
+<span id="id27"></span><h4>enableGlobalSqlLog<a class="headerlink" href="#enableglobalsqllog" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If enabled, all access logs (corresponding to the <em>open</em> and <em>close</em> events) will be written in a short SQL format, as one row per access, to <code class="docutils literal notranslate"><span class="pre">/home/logkeeper/global-log-YYYYMM.sqlite</span></code>.</p>
+</section>
+<section id="enableaccountsqllog">
+<span id="id28"></span><h4>enableAccountSqlLog<a class="headerlink" href="#enableaccountsqllog" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If enabled, all access logs (corresponding to the <em>open</em> and <em>close</em> events) will be written in a detailed SQL format, as one row per access, in the corresponding user's home to <code class="docutils literal notranslate"><span class="pre">/home/USER/USER-log-YYYYMM.sqlite</span></code>. If you want to use <code class="docutils literal notranslate"><span class="pre">selfListSessions</span></code> and/or <code class="docutils literal notranslate"><span class="pre">selfPlaySession</span></code>, this is required.</p>
+</section>
+<section id="ttyrecfilenameformat">
+<span id="id29"></span><h4>ttyrecFilenameFormat<a class="headerlink" href="#ttyrecfilenameformat" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;%Y-%m-%d.%H-%M-%S.#usec#.&amp;uniqid.&amp;account.&amp;user.&amp;ip.&amp;port.ttyrec&quot;</span></code></p>
+</dd>
+</dl>
+<p>Sets the filename format of the output files of ttyrec for a given session. Magic tokens are: <code class="docutils literal notranslate"><span class="pre">&amp;bastionname</span></code>, <code class="docutils literal notranslate"><span class="pre">&amp;uniqid</span></code>, <code class="docutils literal notranslate"><span class="pre">&amp;account</span></code>, <code class="docutils literal notranslate"><span class="pre">&amp;ip</span></code>, <code class="docutils literal notranslate"><span class="pre">&amp;port</span></code>, <code class="docutils literal notranslate"><span class="pre">&amp;user</span></code> (they'll be replaced by the corresponding values of the current session). Then, this string (automatically prepended with the correct folder) will be passed to ttyrec's <code class="docutils literal notranslate"><span class="pre">-F</span></code> parameter, which uses <code class="docutils literal notranslate"><span class="pre">strftime()</span></code> to expand it, so the usual character conversions will be done (<code class="docutils literal notranslate"><span class="pre">%Y</span></code> for the year, <code class="docutils literal notranslate"><span class="pre">%H</span></code> for the hour, etc., see <code class="docutils literal notranslate"><span class="pre">man</span> <span class="pre">strftime</span></code>). Note that in a addition to the usual <code class="docutils literal notranslate"><span class="pre">strftime()</span></code> conversion specifications, ttyrec also supports <code class="docutils literal notranslate"><span class="pre">#usec#</span></code>, to be replaced by the current microsecond value of the time.</p>
+</section>
+<section id="ttyrecadditionalparameters">
+<span id="id30"></span><h4>ttyrecAdditionalParameters<a class="headerlink" href="#ttyrecadditionalparameters" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">[&quot;-s&quot;,</span> <span class="pre">&quot;This</span> <span class="pre">is</span> <span class="pre">a</span> <span class="pre">message</span> <span class="pre">with</span> <span class="pre">spaces&quot;,</span> <span class="pre">&quot;--zstd&quot;]</span></code></p>
+</dd>
+</dl>
+<p>Additional parameters you want to pass to <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> invocation. Useful, for example, to enable on-the-fly compression, disable cheatcodes, or set/unset any other <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> option. This is an ARRAY, not a string.</p>
+</section>
+<section id="ttyrecstealthstdoutpattern">
+<span id="id31"></span><h4>ttyrecStealthStdoutPattern<a class="headerlink" href="#ttyrecstealthstdoutpattern" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">regex</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;^rsync</span> <span class="pre">--server</span> <span class="pre">.+&quot;</span></code></p>
+</dd>
+</dl>
+<p>When this is set to a non-falsy value, this is expected to be a string that will be converted to a regex which will be matched against a potential remote command specified when connecting through SSH to a remote server. If the regex matches, then we'll instruct ttyrec to NOT record stdout for this session.</p>
+</section>
+</section>
+<section id="other-ingress-policies">
+<h3>Other ingress policies<a class="headerlink" href="#other-ingress-policies" title="Permalink to this headline"></a></h3>
+<section id="ingresskeysfrom">
+<span id="id32"></span><h4>ingressKeysFrom<a class="headerlink" href="#ingresskeysfrom" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(list</span> <span class="pre">of</span> <span class="pre">IPs</span> <span class="pre">and/or</span> <span class="pre">prefixes)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>This array of IPs (or prefixes, such as <code class="docutils literal notranslate"><span class="pre">10.20.30.0/24</span></code>) will be used to build the <code class="docutils literal notranslate"><span class="pre">from=&quot;...&quot;</span></code> in front of the ingress account public keys used to connect to the bastion (in <code class="docutils literal notranslate"><span class="pre">accountCreate</span></code> or <code class="docutils literal notranslate"><span class="pre">selfAddIngressKey</span></code>). If the array is empty, then <strong>NO</strong> <code class="docutils literal notranslate"><span class="pre">from=&quot;...&quot;</span></code> is added (this lowers the security).</p>
+</section>
+<section id="ingresskeysfromallowoverride">
+<span id="id33"></span><h4>ingressKeysFromAllowOverride<a class="headerlink" href="#ingresskeysfromallowoverride" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">false</span></code>, any user-specified <code class="docutils literal notranslate"><span class="pre">from=&quot;...&quot;</span></code> prefix on keys in commands such as <code class="docutils literal notranslate"><span class="pre">selfAddIngressKey</span></code> or <code class="docutils literal notranslate"><span class="pre">accountCreate</span></code> are silently ignored and replaced by the IPs in the <code class="docutils literal notranslate"><span class="pre">ingressKeysFrom</span></code> configuration option (if any).
+If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, any user-specified <code class="docutils literal notranslate"><span class="pre">from=&quot;...&quot;</span></code> will override the value set in <code class="docutils literal notranslate"><span class="pre">ingressKeysFrom</span></code> (if any).
+Note that when no user-specified <code class="docutils literal notranslate"><span class="pre">from=&quot;...&quot;</span></code> appears, the value of <code class="docutils literal notranslate"><span class="pre">ingressKeysFrom</span></code> is still used, regardless of this option.</p>
+</section>
+</section>
+<section id="other-egress-policies">
+<h3>Other egress policies<a class="headerlink" href="#other-egress-policies" title="Permalink to this headline"></a></h3>
+<section id="defaultlogin">
+<span id="id34"></span><h4>defaultLogin<a class="headerlink" href="#defaultlogin" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>The default remote user to use for egress ssh connections where no user has been specified by our caller. If set to the empty string (<code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code>), will default to the account name of the caller. If your bastion is mainly used to connect as <code class="docutils literal notranslate"><span class="pre">root</span></code> on remote systems, you might want to set this to <code class="docutils literal notranslate"><span class="pre">root</span></code> for example, to spare a few keystrokes to your users. This is only used when no user is specified on the connection line. For example if your bastion alias is <code class="docutils literal notranslate"><span class="pre">bssh</span></code>, and you say <code class="docutils literal notranslate"><span class="pre">bssh</span> <span class="pre">srv1.example.net</span></code>, the value of the <code class="docutils literal notranslate"><span class="pre">defaultLogin</span></code> value will be used as the user to login as remotely.</p>
+</section>
+<section id="egresskeysfrom">
+<span id="id35"></span><h4>egressKeysFrom<a class="headerlink" href="#egresskeysfrom" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(IPs</span> <span class="pre">and/or</span> <span class="pre">prefixes)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>These IPs will be added to the <code class="docutils literal notranslate"><span class="pre">from=&quot;...&quot;</span></code> of the personal account keys and the group keys. Typically you want to specify only the bastions IP here (including all the slaves). Note that if this option is NOT set at all or set to the empty array, it will default to autodetection at runtime (using <code class="docutils literal notranslate"><span class="pre">hostname</span> <span class="pre">--all-ip-addresses</span></code> under the hood). This is dependent from your system configuration and is therefore discouraged.</p>
+</section>
+<section id="keyboardinteractiveallowed">
+<span id="id36"></span><h4>keyboardInteractiveAllowed<a class="headerlink" href="#keyboardinteractiveallowed" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, will allow keyboard-interactive authentication when publickey auth is requested for egress connections, this is needed e.g. for 2FA.</p>
+</section>
+<section id="passwordallowed">
+<span id="id37"></span><h4>passwordAllowed<a class="headerlink" href="#passwordallowed" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, will allow password authentication for egress ssh, so that user can type his remote password interactively.</p>
+</section>
+<section id="telnetallowed">
+<span id="id38"></span><h4>telnetAllowed<a class="headerlink" href="#telnetallowed" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, will allow telnet egress connections (<code class="docutils literal notranslate"><span class="pre">-e</span></code> / <code class="docutils literal notranslate"><span class="pre">--telnet</span></code>).</p>
+</section>
+</section>
+<section id="session-policies">
+<h3>Session policies<a class="headerlink" href="#session-policies" title="Permalink to this headline"></a></h3>
+<section id="displaylastlogin">
+<span id="id39"></span><h4>displayLastLogin<a class="headerlink" href="#displaylastlogin" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If <code class="docutils literal notranslate"><span class="pre">true</span></code>, display their last login information on connection to your users.</p>
+</section>
+<section id="fanciness">
+<span id="id40"></span><h4>fanciness<a class="headerlink" href="#fanciness" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">full</span></code></p>
+</dd>
+</dl>
+<p>Customize to which extent the text output by the program will use decorations to enhance human-friendliness and highlight warnings or critical messages. Note that if a given session's terminal doesn't advertise UTF-8 support, UTF-8 will not be used, regardless of what is set here.</p>
+<ul class="simple">
+<li><p>&quot;none&quot;: Text will only consist of us-ascii characters</p></li>
+<li><p>&quot;basic&quot;: UTF-8 characters will be used to draw tables, instead of ---'s, among other things</p></li>
+<li><p>&quot;full&quot;: Some emoticons may appear to highlight important messages</p></li>
+</ul>
+</section>
+<section id="interactivemodeallowed">
+<span id="id41"></span><h4>interactiveModeAllowed<a class="headerlink" href="#interactivemodeallowed" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">true</span></code>, <code class="docutils literal notranslate"><span class="pre">--interactive</span></code> mode is allowed. Otherwise, this feature is disabled.</p>
+</section>
+<section id="interactivemodetimeout">
+<span id="id42"></span><h4>interactiveModeTimeout<a class="headerlink" href="#interactivemodetimeout" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(seconds)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">60</span></code></p>
+</dd>
+</dl>
+<p>The number of idle seconds after which the user is disconnected from the bastion when in interactive mode. A value of 0 will disable this feature (user will never be disconnected for idle timeout).</p>
+</section>
+<section id="interactivemodebydefault">
+<span id="id43"></span><h4>interactiveModeByDefault<a class="headerlink" href="#interactivemodebydefault" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If <code class="docutils literal notranslate"><span class="pre">true</span></code>, drops the user to interactive mode if nothing is specified on the command line. If <code class="docutils literal notranslate"><span class="pre">false</span></code>, displays the help and exits with an error. Note that for <code class="docutils literal notranslate"><span class="pre">true</span></code> to have the expected effect, interactive mode must be enabled (see the <code class="docutils literal notranslate"><span class="pre">interactiveModeAllowed</span></code> option above).</p>
+</section>
+<section id="interactivemodeproactivemfaenabled">
+<span id="id44"></span><h4>interactiveModeProactiveMFAenabled<a class="headerlink" href="#interactivemodeproactivemfaenabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If enabled, the <code class="docutils literal notranslate"><span class="pre">mfa</span></code> command is allowed in interactive mode, to trigger a proactive MFA challenge, so that subsequent commands normally requiring MFA won't ask for it again.</p>
+</section>
+<section id="interactivemodeproactivemfaexpiration">
+<span id="id45"></span><h4>interactiveModeProactiveMFAexpiration<a class="headerlink" href="#interactivemodeproactivemfaexpiration" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(seconds)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">900</span></code></p>
+</dd>
+</dl>
+<p>If the above <code class="docutils literal notranslate"><span class="pre">interactiveModeProactiveMFAenabled</span></code> option is <code class="docutils literal notranslate"><span class="pre">true</span></code>, then this is the amount of seconds after which the proactive MFA mode is automatically disengaged.</p>
+</section>
+<section id="idlelocktimeout">
+<span id="id46"></span><h4>idleLockTimeout<a class="headerlink" href="#idlelocktimeout" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(seconds)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>If set to a positive value &gt;0, the number of seconds of input idle time after which the session is locked. If <code class="docutils literal notranslate"><span class="pre">false</span></code>, disabled.</p>
+</section>
+<section id="idlekilltimeout">
+<span id="id47"></span><h4>idleKillTimeout<a class="headerlink" href="#idlekilltimeout" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(seconds)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>If set to a positive value &gt;0, the number of seconds of input idle time after which the session is killed. If <code class="docutils literal notranslate"><span class="pre">false</span></code>, disabled. If <code class="docutils literal notranslate"><span class="pre">idleLockTimeout</span></code> is set, this value must be higher (obviously).</p>
+</section>
+<section id="warnbeforelockseconds">
+<span id="id48"></span><h4>warnBeforeLockSeconds<a class="headerlink" href="#warnbeforelockseconds" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(seconds)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>If set to a positive value &gt;0, the number of seconds before <code class="docutils literal notranslate"><span class="pre">idleLockTimeout</span></code> where the user will receive a warning message telling them about the upcoming lock of his session. Don't enable this (by setting a non-zero value) if <cite>idleLockTimeout</cite> is disabled (set to zero).</p>
+</section>
+<section id="warnbeforekillseconds">
+<span id="id49"></span><h4>warnBeforeKillSeconds<a class="headerlink" href="#warnbeforekillseconds" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(seconds)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>If set to a positive value &gt;0, the number of seconds before <code class="docutils literal notranslate"><span class="pre">idleKillTimeout</span></code> where the user will receive a warning message telling them about the upcoming kill of his session. Don't enable this (by setting a non-zero value) if <cite>idleKillTimeout</cite> is disabled (set to zero).</p>
+</section>
+<section id="accountexternalvalidationprogram">
+<span id="id50"></span><h4>accountExternalValidationProgram<a class="headerlink" href="#accountexternalvalidationprogram" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span> <span class="pre">(path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">binary)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;$BASEDIR/bin/other/check-active-account-simple.pl&quot;</span></code></p>
+</dd>
+</dl>
+<p>Binary or script that will be called by the bastion, with the account name in parameter, to check whether this account should be allowed to connect to the bastion. If empty, this check is skipped. <code class="docutils literal notranslate"><span class="pre">$BASEDIR</span></code> is a magic token that is replaced by where the bastion code lives (usually, <code class="docutils literal notranslate"><span class="pre">/opt/bastion</span></code>).</p>
+<p>You can use this configuration parameter to counter-verify all accounts against an external system, for example an <em>LDAP</em>, an <em>Active Directory</em>, or any system having a list of identities, right when they're connecting to the bastion (on the ingress side). However, it is advised to avoid calling an external system in the flow of an incoming connection, as this violates the &quot;the bastion must be working at all times, regardless of the status of the other components of the company's infrastructure&quot; rule. Instead, you should have a cronjob to periodically fetch all the allowed accounts from said external system, and store this list somewhere on the bastion, then write a simple script that will be called by the bastion to verify whether the connecting account is present on this locally cached list.</p>
+<p>An account present in this list is called an <em>active account</em>, in the bastion's jargon. An <em>inactive</em> account is an account existing on the bastion, but not in this list, and won't be able to connect. Note that for security reasons, inactive bastions administrators would be denied as any other account.</p>
+<p>The result is interpreted from the program's exit code. If the program return 0, the account is deemed active. If the program returns 1, the account is deemed inactive. A return code of 2, 3 or 4 indicates a failure of the program in determining the activeness of the account. In this case, the decision to allow or deny the access is determined by the <code class="docutils literal notranslate"><span class="pre">accountExternalValidationDenyOnFailure</span></code> option below. Status code 3 additionally logs the <code class="docutils literal notranslate"><span class="pre">stderr</span></code> of the program <em>silently</em> to the syslog: this can be used to warn admins of a problem without leaking information to the user. Status code 4 does the same, but the <code class="docutils literal notranslate"><span class="pre">stderr</span></code> is also shown directly to the user. Any other return code deems the account inactive (same behavior that return code 1).</p>
+</section>
+<section id="accountexternalvalidationdenyonfailure">
+<span id="id51"></span><h4>accountExternalValidationDenyOnFailure<a class="headerlink" href="#accountexternalvalidationdenyonfailure" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If we can't validate an account using the program configured in <code class="docutils literal notranslate"><span class="pre">accountExternalValidationProgram</span></code>, for example because the path doesn't exist, the file is not executable, or because the program returns the exit code 4 (see above for more information), this configuration option indicates whether we should deny or allow access.</p>
+<p>Note that the bastion admins will always be allowed if the <code class="docutils literal notranslate"><span class="pre">accountExternalValidationProgram</span></code> doesn't work correctly, because they're expected to be able to fix it. They would be denied, as any other account, if <code class="docutils literal notranslate"><span class="pre">accountExternalValidationProgram</span></code> works correctly and denies them access, however. If you're still testing your account validation procedure, and don't want to break your users workflow while you're not 100% sure it works correctly, you can say <code class="docutils literal notranslate"><span class="pre">false</span></code> here, and return 4 instead of 1 in your <code class="docutils literal notranslate"><span class="pre">accountExternalValidationProgram</span></code> when you would want to deny access.</p>
+</section>
+<section id="alwaysactiveaccounts">
+<span id="id52"></span><h4>alwaysActiveAccounts<a class="headerlink" href="#alwaysactiveaccounts" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(account</span> <span class="pre">names)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>List of accounts which should NOT be checked against the <code class="docutils literal notranslate"><span class="pre">accountExternalValidationProgram</span></code> mechanism above (for example bot accounts). This can also be set per-account at account creation time or later with the <code class="docutils literal notranslate"><span class="pre">accountModify</span></code> plugin's <code class="docutils literal notranslate"><span class="pre">--always-active</span></code> flag.</p>
+</section>
+</section>
+<section id="account-policies">
+<h3>Account policies<a class="headerlink" href="#account-policies" title="Permalink to this headline"></a></h3>
+<section id="accountmaxinactivedays">
+<span id="id53"></span><h4>accountMaxInactiveDays<a class="headerlink" href="#accountmaxinactivedays" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(days)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>If &gt; 0, deny access to accounts that didn't log in since at least that many days. A value of 0 means that this functionality is disabled (we will never deny access for inactivity reasons).</p>
+</section>
+<section id="accountexpiredmessage">
+<span id="id54"></span><h4>accountExpiredMessage<a class="headerlink" href="#accountexpiredmessage" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>If non-empty, customizes the message that will be printed to a user attempting to connect with an expired account (see <code class="docutils literal notranslate"><span class="pre">accountMaxInactiveDays</span></code> above). When empty, defaults to the standard message &quot;Sorry, but your account has expired (#DAYS# days), access denied by policy.&quot;. The special token <code class="docutils literal notranslate"><span class="pre">#DAYS#</span></code> is replaced by the number of days since we've last seen this user.</p>
+</section>
+<section id="accountcreatesupplementarygroups">
+<span id="id55"></span><h4>accountCreateSupplementaryGroups<a class="headerlink" href="#accountcreatesupplementarygroups" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(system</span> <span class="pre">group</span> <span class="pre">names)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>List of system groups to add a new account to when its created (see <code class="docutils literal notranslate"><span class="pre">accountCreate</span></code>). Can be useful to grant some restricted commands by default to new accounts. For example <code class="docutils literal notranslate"><span class="pre">osh-selfAddPersonalAccess</span></code>, <code class="docutils literal notranslate"><span class="pre">osh-selfDelPersonalAccess</span></code>, etc. Note that the group here are <strong>NOT</strong> <em>bastion groups</em>, but system groups.</p>
+</section>
+<section id="accountcreatedefaultpersonalaccesses">
+<span id="id56"></span><h4>accountCreateDefaultPersonalAccesses<a class="headerlink" href="#accountcreatedefaultpersonalaccesses" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(list</span> <span class="pre">of</span> <span class="pre">IPs</span> <span class="pre">and/or</span> <span class="pre">prefixes)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+</dl>
+<p>List of strings of the form <a class="reference external" href="mailto:USER&#37;&#52;&#48;IP">USER<span>&#64;</span>IP</a> or <a class="reference external" href="mailto:USER&#37;&#52;&#48;IP">USER<span>&#64;</span>IP</a>:PORT or IP or IP:PORT, with IP being IP or prefix (such as 1.2.3.0/24). This is the list of accesses to add to the personal access list of newly created accounts. The special value ACCOUNT is replaced by the name of the account being created. This can be useful to grant some accesses by default to new accounts (for example ACCOUNT&#64;0.0.0.0/0)</p>
+</section>
+<section id="ingressrequirepiv">
+<span id="id57"></span><h4>ingressRequirePIV<a class="headerlink" href="#ingressrequirepiv" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>When set to true, only PIV-enabled SSH keys will be able to be added with selfAddIngressKey, hence ensuring that an SSH key generated on a computer, and not within a PIV-compatible hardware token, can't be used to access The Bastion. If you only want to enable this on a per-account basis, leave this to false and set the flag on said accounts using accountPIV instead. When set to false, will not require PIV-enabled SSH keys to be added by selfAddIngressKey. If you have no idea what PIV keys are, leave this to false, this is what you want.</p>
+</section>
+<section id="accountmfapolicy">
+<span id="id58"></span><h4>accountMFAPolicy<a class="headerlink" href="#accountmfapolicy" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;enabled&quot;</span></code></p>
+</dd>
+</dl>
+<p>Set a MFA policy for the bastion accounts, the supported values are:</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">disabled</span></code>: the commands to setup TOTP and UNIX account password are disabled, nobody can setup MFA for themselves or others. Already configured MFA still applies, unless the sshd configuration is modified to no longer call PAM on the authentication phase</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">password-required</span></code>: for all accounts, a UNIX account password is required in addition to the ingress SSH public key. On first connection with his SSH key, the user is forced to setup a password for his account, and can't disable it afterwards</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">totp-required</span></code>: for all accounts, a TOTP is required in addition to the ingress SSH public key. On first connection with his SSH key, the user is forced to setup a TOTP for his account, and can't disable it afterwards</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">any-required</span></code>: for all accounts, either a TOTP or an UNIX account password is required in addition to the ingress SSH public key. On first connection with his SSH key, the user is forced to setup either of those, as he sees fit, and can't disable it afterwards</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">enabled</span></code>: for all accounts, TOTP and UNIX account password are available as opt-in features as the users see fit. Some accounts can be forced to setup either TOTP or password-based MFA if they're flagged accordingly (with the accountModify command)</p></li>
+</ul>
+</section>
+<section id="mfapasswordmindays">
+<span id="id59"></span><h4>MFAPasswordMinDays<a class="headerlink" href="#mfapasswordmindays" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(days)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>For the PAM UNIX password MFA, sets the min amount of days between two password changes (see <code class="docutils literal notranslate"><span class="pre">chage</span> <span class="pre">-m</span></code>)</p>
+</section>
+<section id="mfapasswordmaxdays">
+<span id="id60"></span><h4>MFAPasswordMaxDays<a class="headerlink" href="#mfapasswordmaxdays" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(days)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">90</span></code></p>
+</dd>
+</dl>
+<p>For the PAM UNIX password MFA, sets the max amount of days after which the password must be changed (see <code class="docutils literal notranslate"><span class="pre">chage</span> <span class="pre">-M</span></code>)</p>
+</section>
+<section id="mfapasswordwarndays">
+<span id="id61"></span><h4>MFAPasswordWarnDays<a class="headerlink" href="#mfapasswordwarndays" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span> <span class="pre">(days)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">15</span></code></p>
+</dd>
+</dl>
+<p>For the PAM UNIX password MFA, sets the number of days before expiration on which the user will be warned to change his password (see <code class="docutils literal notranslate"><span class="pre">chage</span> <span class="pre">-W</span></code>)</p>
+</section>
+<section id="mfapasswordinactivedays">
+<span id="id62"></span><h4>MFAPasswordInactiveDays<a class="headerlink" href="#mfapasswordinactivedays" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">-1</span> <span class="pre">(days)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">-1</span></code></p>
+</dd>
+</dl>
+<p>For the PAM UNIX password MFA, the account will be blocked after the password is expired (and not renewed) for this amount of days (see <code class="docutils literal notranslate"><span class="pre">chage</span> <span class="pre">-E</span></code>). -1 disables this feature. Note that this is different from the <code class="docutils literal notranslate"><span class="pre">accountMaxInactiveDays</span></code> option above, that is handled by the bastion software itself instead of PAM</p>
+</section>
+<section id="mfapostcommand">
+<span id="id63"></span><h4>MFAPostCommand<a class="headerlink" href="#mfapostcommand" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings</span> <span class="pre">(a</span> <span class="pre">valid</span> <span class="pre">system</span> <span class="pre">command)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">[]</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">[&quot;sudo&quot;,&quot;-n&quot;,&quot;-u&quot;,&quot;root&quot;,&quot;--&quot;,&quot;/sbin/pam_tally2&quot;,&quot;-u&quot;,&quot;%ACCOUNT%&quot;,&quot;-r&quot;]</span> <span class="pre">or</span> <span class="pre">[&quot;/usr/sbin/faillock&quot;,&quot;--reset&quot;]</span></code></p>
+</dd>
+</dl>
+<p>When using JIT MFA (i.e. not directly by calling PAM from SSHD's configuration, but using <code class="docutils literal notranslate"><span class="pre">pamtester</span></code> from within the code), execute this command on success.
+This can be used for example if you're using <code class="docutils literal notranslate"><span class="pre">pam_tally2</span></code> or <code class="docutils literal notranslate"><span class="pre">pam_faillock</span></code> in your PAM MFA configuration, <code class="docutils literal notranslate"><span class="pre">pamtester</span></code> can't reset the counter to zero because this is usually done in the <code class="docutils literal notranslate"><span class="pre">account_mgmt</span></code> PAM phase. You can use a script to reset it here.
+The magic token <code class="docutils literal notranslate"><span class="pre">%ACCOUNT%</span></code> will be replaced by the account name.
+Note that usually, <code class="docutils literal notranslate"><span class="pre">pam_tally2</span></code> can only be used by root (hence might require the proper sudoers configuration), while <code class="docutils literal notranslate"><span class="pre">faillock</span></code> can directly be used by unprivileged users to reset their counter.</p>
+</section>
+<section id="totpprovider">
+<span id="id64"></span><h4>TOTPProvider<a class="headerlink" href="#totpprovider" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">'google-authenticator'</span></code></p>
+</dd>
+</dl>
+<p>Defines which is the provider of the TOTP MFA, that will be used for the <code class="docutils literal notranslate"><span class="pre">(self|account)MFA(Setup|Reset)TOTP</span></code> commands. Allowed values are:
+- none: no TOTP providers are defined, the corresponding setup commands won't be available.
+- google-authenticator: the pam_google_authenticator.so module will be used, along with its corresponding setup binary. This is the default, for backward compatibility reasons. This is also what is configured in the provided pam templates.
+- duo: enable the use of the Duo PAM module (pam_duo.so), of course you need to set it up correctly in your <cite>/etc/pam.d/sshd</cite> file.</p>
+</section>
+</section>
+<section id="other-options">
+<h3>Other options<a class="headerlink" href="#other-options" title="Permalink to this headline"></a></h3>
+<section id="accountuidmin">
+<span id="id65"></span><h4>accountUidMin<a class="headerlink" href="#accountuidmin" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">100</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">2000</span></code></p>
+</dd>
+</dl>
+<p>Minimum allowed UID for accounts on this bastion. Hardcoded &gt; 100 even if configured for less.</p>
+</section>
+<section id="accountuidmax">
+<span id="id66"></span><h4>accountUidMax<a class="headerlink" href="#accountuidmax" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">99999</span></code></p>
+</dd>
+</dl>
+<p>Maximum allowed UID for accounts on this bastion.</p>
+</section>
+<section id="ttyrecgroupidoffset">
+<span id="id67"></span><h4>ttyrecGroupIdOffset<a class="headerlink" href="#ttyrecgroupidoffset" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">100000</span></code></p>
+</dd>
+</dl>
+<p>Offset to apply on user group uid to create its <code class="docutils literal notranslate"><span class="pre">-tty</span></code> group, should be &gt; <code class="docutils literal notranslate"><span class="pre">accountUidMax</span> <span class="pre">-</span> <span class="pre">accountUidMin</span></code> to ensure there is no overlap.</p>
+</section>
+<section id="documentationurl">
+<span id="id68"></span><h4>documentationURL<a class="headerlink" href="#documentationurl" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;https://ovh.github.io/the-bastion/&quot;</span></code></p>
+</dd>
+</dl>
+<p>The URL of the documentation where users will be pointed to, for example when displaying help. If you have some internal documentation about the bastion, you might want to advertise it here.</p>
+</section>
+<section id="debug">
+<span id="id69"></span><h4>debug<a class="headerlink" href="#debug" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>Enables or disables debug <em>GLOBALLY</em>, printing a lot of information to anyone using the bastion. Don't enable this unless you're chasing a bug in the code and are familiar with it.</p>
+</section>
+<section id="remotecommandescapebydefault">
+<span id="id70"></span><h4>remoteCommandEscapeByDefault<a class="headerlink" href="#remotecommandescapebydefault" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>If set to <code class="docutils literal notranslate"><span class="pre">false</span></code>, will not escape simple quotes in remote commands by default. Don't enable this, this is to keep compatibility with an ancient broken behavior. Will be removed in the future. Can be overridden at runtime with <code class="docutils literal notranslate"><span class="pre">--never-escape</span></code> and <code class="docutils literal notranslate"><span class="pre">--always-escape</span></code>.</p>
+</section>
+<section id="sshclientdebuglevel">
+<span id="id71"></span><h4>sshClientDebugLevel<a class="headerlink" href="#sshclientdebuglevel" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">(0-3)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>Indicates the number of <code class="docutils literal notranslate"><span class="pre">-v</span></code>'s that will be added to the ssh client command line when starting a session. Probably a bad idea unless you want to annoy your users.</p>
+</section>
+<section id="sshclienthasoptione">
+<span id="id72"></span><h4>sshClientHasOptionE<a class="headerlink" href="#sshclienthasoptione" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">boolean</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>Set to <code class="docutils literal notranslate"><span class="pre">true</span></code> if your ssh client supports the <code class="docutils literal notranslate"><span class="pre">-E</span></code> option and you want to use it to log debug info on opened sessions. <strong>Discouraged</strong> because it has some annoying side effects (some ssh errors then go silent from the user perspective).</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="Configuration files" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-backup-acl-keys_conf.html" class="btn btn-neutral float-right" title="osh-backup-acl-keys.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/index.html b/administration/configuration/index.html
new file mode 100644
index 000000000..fe57e33d7
--- /dev/null
+++ b/administration/configuration/index.html
@@ -0,0 +1,194 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Configuration files &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="bastion.conf" href="bastion_conf.html" />
+    <link rel="prev" title="Using PuTTY with The Bastion" href="../../using/specific_ssh_clients_tutorials/putty.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Configuration files</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#main-configuration-files">Main configuration files</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="bastion_conf.html">bastion.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-backup-acl-keys_conf.html">osh-backup-acl-keys.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-encrypt-rsync_conf.html">osh-encrypt-rsync.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-sync-watcher_sh.html">osh-sync-watcher.sh</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-http-proxy_conf.html">osh-http-proxy.conf</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="osh-piv-grace-reaper_conf.html">osh-piv-grace-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-remove-empty-folders_conf.html">osh-remove-empty-folders.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-cleanup-guest-key-access_conf.html">osh-cleanup-guest-key-access.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-lingering-sessions-reaper_conf.html">osh-lingering-sessions-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-orphaned-homedir_conf.html">osh-orphaned-homedir.conf</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Configuration files</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="configuration-files">
+<h1>Configuration files<a class="headerlink" href="#configuration-files" title="Permalink to this headline"></a></h1>
+<section id="main-configuration-files">
+<h2>Main configuration files<a class="headerlink" href="#main-configuration-files" title="Permalink to this headline"></a></h2>
+<p>These config files should be reviewed and adapted for the environment in which
+you're deploying The Bastion. The doc:<cite>bastion_conf</cite> is the only one that is
+mandatory to get you started. You should however review the other ones before
+going into production.</p>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="bastion_conf.html">bastion.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-backup-acl-keys_conf.html">osh-backup-acl-keys.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-encrypt-rsync_conf.html">osh-encrypt-rsync.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-sync-watcher_sh.html">osh-sync-watcher.sh</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-http-proxy_conf.html">osh-http-proxy.conf</a></li>
+</ul>
+</div>
+</section>
+<section id="configuration-files-for-satellite-scripts">
+<h2>Configuration files for satellite scripts<a class="headerlink" href="#configuration-files-for-satellite-scripts" title="Permalink to this headline"></a></h2>
+<p>These config files govern the behavior of satellite scripts that handle
+background tasks of The Bastion. Most of the time, there is no need to alter
+the configuration as sane defaults are already built in.</p>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="osh-piv-grace-reaper_conf.html">osh-piv-grace-reaper.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-remove-empty-folders_conf.html">osh-remove-empty-folders.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-cleanup-guest-key-access_conf.html">osh-cleanup-guest-key-access.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-lingering-sessions-reaper_conf.html">osh-lingering-sessions-reaper.conf</a></li>
+<li class="toctree-l1"><a class="reference internal" href="osh-orphaned-homedir_conf.html">osh-orphaned-homedir.conf</a></li>
+</ul>
+</div>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../../using/specific_ssh_clients_tutorials/putty.html" class="btn btn-neutral float-left" title="Using PuTTY with The Bastion" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="bastion_conf.html" class="btn btn-neutral float-right" title="bastion.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-backup-acl-keys_conf.html b/administration/configuration/osh-backup-acl-keys_conf.html
new file mode 100644
index 000000000..193133a5a
--- /dev/null
+++ b/administration/configuration/osh-backup-acl-keys_conf.html
@@ -0,0 +1,376 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-backup-acl-keys.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-encrypt-rsync.conf" href="osh-encrypt-rsync_conf.html" />
+    <link rel="prev" title="bastion.conf" href="bastion_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="bastion_conf.html">bastion.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-backup-acl-keys.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-encrypt-rsync_conf.html">osh-encrypt-rsync.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-sync-watcher_sh.html">osh-sync-watcher.sh</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-http-proxy_conf.html">osh-http-proxy.conf</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-backup-acl-keys.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-backup-acl-keys_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-backup-acl-keys-conf">
+<h1>osh-backup-acl-keys.conf<a class="headerlink" href="#osh-backup-acl-keys-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This script is called by cron and is responsible
+for backing up the bastion configuration, users &amp; groups lists,
+credentials, and everything needed to be able to restore a functioning
+bastion from scratch.</p>
+</div>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>If left unconfigured, this script won't do anything,
+and you won't have backups, unless this task is handled by
+some other external system.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-activation-options">
+<h3>Logging &amp; activation options<a class="headerlink" href="#logging-activation-options" title="Permalink to this headline"></a></h3>
+<p>Script logging configuration and script activation</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logfile">LOGFILE</a></p></li>
+<li><p><a class="reference internal" href="#log-facility">LOG_FACILITY</a></p></li>
+<li><p><a class="reference internal" href="#enabled">ENABLED</a></p></li>
+</ul>
+</section>
+<section id="backup-policy-options">
+<h3>Backup policy options<a class="headerlink" href="#backup-policy-options" title="Permalink to this headline"></a></h3>
+<p>These options configure the backup policy to apply</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#destdir">DESTDIR</a></p></li>
+<li><p><a class="reference internal" href="#daystokeep">DAYSTOKEEP</a></p></li>
+</ul>
+</section>
+<section id="encryption-and-signing-options">
+<h3>Encryption and signing options<a class="headerlink" href="#encryption-and-signing-options" title="Permalink to this headline"></a></h3>
+<p>These options configure how the script uses GPG to encrypt and sign the ttyrec files</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#gpgkeys">GPGKEYS</a></p></li>
+<li><p><a class="reference internal" href="#signing-key">SIGNING_KEY</a></p></li>
+<li><p><a class="reference internal" href="#signing-key-passphrase">SIGNING_KEY_PASSPHRASE</a></p></li>
+</ul>
+</section>
+<section id="remote-backup-options">
+<h3>Remote backup options<a class="headerlink" href="#remote-backup-options" title="Permalink to this headline"></a></h3>
+<p>These options configure how the script should push the encrypted backups to a remote system</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#push-remote">PUSH_REMOTE</a></p></li>
+<li><p><a class="reference internal" href="#push-options">PUSH_OPTIONS</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging-activation">
+<h3>Logging &amp; activation<a class="headerlink" href="#logging-activation" title="Permalink to this headline"></a></h3>
+<section id="logfile">
+<h4>LOGFILE<a class="headerlink" href="#logfile" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">file</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>File where the logs will be written to (don't forget to configure <code class="docutils literal notranslate"><span class="pre">logrotate</span></code>!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.</p>
+</section>
+<section id="log-facility">
+<h4>LOG_FACILITY<a class="headerlink" href="#log-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local6&quot;</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+<section id="enabled">
+<h4>ENABLED<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">0</span> <span class="pre">or</span> <span class="pre">1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd>
+</dl>
+<p>If set to 1, the script is enabled and will run when started by crond.</p>
+</section>
+</section>
+<section id="backup-policy">
+<h3>Backup policy<a class="headerlink" href="#backup-policy" title="Permalink to this headline"></a></h3>
+<section id="destdir">
+<h4>DESTDIR<a class="headerlink" href="#destdir" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">folder</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;/root/backups&quot;</span></code></p>
+</dd>
+</dl>
+<p>Folder where to put the backup artefacts (<code class="docutils literal notranslate"><span class="pre">.tar.gz</span></code> files).
+This folder will be created if needed. If empty or omitted,
+the script won't run: this option is mandatory.</p>
+</section>
+<section id="daystokeep">
+<h4>DAYSTOKEEP<a class="headerlink" href="#daystokeep" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">90</span></code></p>
+</dd>
+</dl>
+<p>Number of days to keep the old backups on the filesystem before deleting them.</p>
+</section>
+</section>
+<section id="encryption-and-signing">
+<h3>Encryption and signing<a class="headerlink" href="#encryption-and-signing" title="Permalink to this headline"></a></h3>
+<section id="gpgkeys">
+<h4>GPGKEYS<a class="headerlink" href="#gpgkeys" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">space-separated</span> <span class="pre">list</span> <span class="pre">of</span> <span class="pre">GPG</span> <span class="pre">keys</span> <span class="pre">IDs</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;41FDB9C7</span> <span class="pre">DA97EFD1</span> <span class="pre">339483FF&quot;</span></code></p>
+</dd>
+</dl>
+<p>List of public GPG keys to encrypt to (see <code class="docutils literal notranslate"><span class="pre">gpg</span> <span class="pre">--list-keys</span></code>), these must be separated by spaces.
+Note that if this option is empty or omitted, backup artefacts will NOT be encrypted!</p>
+</section>
+<section id="signing-key">
+<h4>SIGNING_KEY<a class="headerlink" href="#signing-key" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">GPG</span> <span class="pre">key</span> <span class="pre">ID</span> <span class="pre">in</span> <span class="pre">short</span> <span class="pre">or</span> <span class="pre">long</span> <span class="pre">format</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">(none)</span></code></p>
+</dd>
+</dl>
+<p>ID of the GPG key used to sign the ttyrec files.
+The key must be in the local root keyring, check it with <code class="docutils literal notranslate"><span class="pre">gpg</span> <span class="pre">--list-secret-keys</span></code>.
+If empty, the archives will not be signed, but encrypted only (using the GPGKEYS configuration above).</p>
+</section>
+<section id="signing-key-passphrase">
+<h4>SIGNING_KEY_PASSPHRASE<a class="headerlink" href="#signing-key-passphrase" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">(none)</span></code></p>
+</dd>
+</dl>
+<p>This passphrase should be able to unlock the SIGNING_KEY defined above.
+Please ensure this configuration file only readable by root (0640), to protect this passphrase.
+As a security measure, the script will refuse to read the configuration otherwise.</p>
+</section>
+</section>
+<section id="remote-backup">
+<h3>Remote backup<a class="headerlink" href="#remote-backup" title="Permalink to this headline"></a></h3>
+<section id="push-remote">
+<h4>PUSH_REMOTE<a class="headerlink" href="#push-remote" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;push&#64;192.0.2.4:~/backup/&quot;</span></code></p>
+</dd>
+</dl>
+<p>The <code class="docutils literal notranslate"><span class="pre">scp</span></code> remote host push backups to. If empty or missing, won't push backups.
+This will also be the case if the <code class="docutils literal notranslate"><span class="pre">GPGKEYS</span></code> option above is empty or missing,
+because we will never push unencrypted backups.
+Don't forget to put a trailing <code class="docutils literal notranslate"><span class="pre">/</span></code> (except if you want to push to the remote <code class="docutils literal notranslate"><span class="pre">$HOME</span></code>,
+in which case ending with a simple <code class="docutils literal notranslate"><span class="pre">:</span></code> works, as per standard <code class="docutils literal notranslate"><span class="pre">scp</span></code>).</p>
+</section>
+<section id="push-options">
+<h4>PUSH_OPTIONS<a class="headerlink" href="#push-options" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;-i</span> <span class="pre">$HOME/.ssh/id_backup&quot;</span></code></p>
+</dd>
+</dl>
+<p>Additional options to pass to <code class="docutils literal notranslate"><span class="pre">scp</span></code>, if needed.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="bastion_conf.html" class="btn btn-neutral float-left" title="bastion.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-encrypt-rsync_conf.html" class="btn btn-neutral float-right" title="osh-encrypt-rsync.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-cleanup-guest-key-access_conf.html b/administration/configuration/osh-cleanup-guest-key-access_conf.html
new file mode 100644
index 000000000..2f1e40974
--- /dev/null
+++ b/administration/configuration/osh-cleanup-guest-key-access_conf.html
@@ -0,0 +1,216 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-cleanup-guest-key-access.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-lingering-sessions-reaper.conf" href="osh-lingering-sessions-reaper_conf.html" />
+    <link rel="prev" title="osh-remove-empty-folders.conf" href="osh-remove-empty-folders_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="osh-piv-grace-reaper_conf.html">osh-piv-grace-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-remove-empty-folders_conf.html">osh-remove-empty-folders.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-cleanup-guest-key-access.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-lingering-sessions-reaper_conf.html">osh-lingering-sessions-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-orphaned-homedir_conf.html">osh-orphaned-homedir.conf</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-cleanup-guest-key-access.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-cleanup-guest-key-access_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-cleanup-guest-key-access-conf">
+<h1>osh-cleanup-guest-key-access.conf<a class="headerlink" href="#osh-cleanup-guest-key-access-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This script is called by cron and is responsible for cleaning up dangling
+accesses to group keys for group guests that no longer have access to any
+server of the group. This happens when the last access a guest have on a
+group has a TTL, and this TTL expires.
+This is a basic background task of The Bastion, hence there is not much
+to configure. You can still disable this script below, if needs be.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-activation-options">
+<h3>Logging &amp; activation options<a class="headerlink" href="#logging-activation-options" title="Permalink to this headline"></a></h3>
+<p>Script logging configuration and script activation</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#syslog-facility">syslog_facility</a></p></li>
+<li><p><a class="reference internal" href="#enabled">enabled</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging-activation">
+<h3>Logging &amp; activation<a class="headerlink" href="#logging-activation" title="Permalink to this headline"></a></h3>
+<section id="syslog-facility">
+<h4>syslog_facility<a class="headerlink" href="#syslog-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">local6</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+<section id="enabled">
+<h4>enabled<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">bool</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If not set to <cite>true</cite> (or a true value), the script will not run.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-remove-empty-folders_conf.html" class="btn btn-neutral float-left" title="osh-remove-empty-folders.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-lingering-sessions-reaper_conf.html" class="btn btn-neutral float-right" title="osh-lingering-sessions-reaper.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-encrypt-rsync_conf.html b/administration/configuration/osh-encrypt-rsync_conf.html
new file mode 100644
index 000000000..eba2a87ca
--- /dev/null
+++ b/administration/configuration/osh-encrypt-rsync_conf.html
@@ -0,0 +1,441 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-encrypt-rsync.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-sync-watcher.sh" href="osh-sync-watcher_sh.html" />
+    <link rel="prev" title="osh-backup-acl-keys.conf" href="osh-backup-acl-keys_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="bastion_conf.html">bastion.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-backup-acl-keys_conf.html">osh-backup-acl-keys.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-encrypt-rsync.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-sync-watcher_sh.html">osh-sync-watcher.sh</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-http-proxy_conf.html">osh-http-proxy.conf</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-encrypt-rsync.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-encrypt-rsync_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-encrypt-rsync-conf">
+<h1>osh-encrypt-rsync.conf<a class="headerlink" href="#osh-encrypt-rsync-conf" title="Permalink to this headline"></a></h1>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>The osh-encrypt-rsync script is called by cron and is responsible for encrypting
+and optionally pushing the recorded <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> files to a distant server, along
+with the user logs (<code class="docutils literal notranslate"><span class="pre">/home/*/*.log</span></code>) and user sqlite files (<code class="docutils literal notranslate"><span class="pre">/home/*/*.sqlite</span></code>).
+The global log and sqlite files are also handled (located in <code class="docutils literal notranslate"><span class="pre">/home/logkeeper/</span></code>).
+Note that logs sent through syslog are NOT managed by this script.</p>
+</div>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>If left unconfigured, this script won't do anything, and the recorded <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> files,
+along with the log and sqlite files won't be encrypted or moved out from the server.
+This might not be a problem for low-traffic bastions or if you have plenty of storage available, though.</p>
+</div>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-options">
+<h3>Logging options<a class="headerlink" href="#logging-options" title="Permalink to this headline"></a></h3>
+<p>These options configure the way the script logs its actions</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logfile">logfile</a></p></li>
+<li><p><a class="reference internal" href="#syslog-facility">syslog_facility</a></p></li>
+<li><p><a class="reference internal" href="#verbose">verbose</a></p></li>
+</ul>
+</section>
+<section id="encryption-and-signing-options">
+<h3>Encryption and signing options<a class="headerlink" href="#encryption-and-signing-options" title="Permalink to this headline"></a></h3>
+<p>These options configure how the script uses GPG to encrypt and sign the ttyrec files</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#signing-key">signing_key</a></p></li>
+<li><p><a class="reference internal" href="#signing-key-passphrase">signing_key_passphrase</a></p></li>
+<li><p><a class="reference internal" href="#recipients">recipients</a></p></li>
+<li><p><a class="reference internal" href="#encrypt-and-move-to-directory">encrypt_and_move_to_directory</a></p></li>
+<li><p><a class="reference internal" href="#encrypt-and-move-ttyrec-delay-days">encrypt_and_move_ttyrec_delay_days</a></p></li>
+<li><p><a class="reference internal" href="#encrypt-and-move-user-logs-delay-days">encrypt_and_move_user_logs_delay_days</a></p></li>
+<li><p><a class="reference internal" href="#encrypt-and-move-user-sqlites-delay-days">encrypt_and_move_user_sqlites_delay_days</a></p></li>
+</ul>
+</section>
+<section id="push-files-to-a-remote-destination-options">
+<h3>Push files to a remote destination options<a class="headerlink" href="#push-files-to-a-remote-destination-options" title="Permalink to this headline"></a></h3>
+<p>These options configure the way the script uses rsync to optionally push the encrypted files out of the server</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#rsync-destination">rsync_destination</a></p></li>
+<li><p><a class="reference internal" href="#rsync-rsh">rsync_rsh</a></p></li>
+<li><p><a class="reference internal" href="#rsync-delay-before-remove-days">rsync_delay_before_remove_days</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging">
+<h3>Logging<a class="headerlink" href="#logging" title="Permalink to this headline"></a></h3>
+<section id="logfile">
+<h4>logfile<a class="headerlink" href="#logfile" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">file</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>File where the logs will be written to (don't forget to configure <code class="docutils literal notranslate"><span class="pre">logrotate</span></code>!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.</p>
+</section>
+<section id="syslog-facility">
+<h4>syslog_facility<a class="headerlink" href="#syslog-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local6&quot;</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+<section id="verbose">
+<h4>verbose<a class="headerlink" href="#verbose" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>The verbosity level of the logs produced by the script
+0: normal (default)
+1: log more information about what is happening
+2: log debug-level information</p>
+</section>
+</section>
+<section id="encryption-and-signing">
+<h3>Encryption and signing<a class="headerlink" href="#encryption-and-signing" title="Permalink to this headline"></a></h3>
+<section id="signing-key">
+<h4>signing_key<a class="headerlink" href="#signing-key" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">GPG</span> <span class="pre">key</span> <span class="pre">ID</span> <span class="pre">in</span> <span class="pre">short</span> <span class="pre">or</span> <span class="pre">long</span> <span class="pre">format</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">(none),</span> <span class="pre">setting</span> <span class="pre">a</span> <span class="pre">value</span> <span class="pre">is</span> <span class="pre">mandatory</span></code></p>
+</dd>
+</dl>
+<p>ID of the GPG key used to sign the ttyrec files.
+The key must be in the local root keyring, check it with <code class="docutils literal notranslate"><span class="pre">gpg</span> <span class="pre">--list-secret-keys</span></code></p>
+</section>
+<section id="signing-key-passphrase">
+<h4>signing_key_passphrase<a class="headerlink" href="#signing-key-passphrase" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">(none),</span> <span class="pre">setting</span> <span class="pre">a</span> <span class="pre">value</span> <span class="pre">is</span> <span class="pre">mandatory</span></code></p>
+</dd>
+</dl>
+<p>This passphrase should be able to unlock the <code class="docutils literal notranslate"><span class="pre">signing_key</span></code> defined above.
+As a side note, please ensure this configuration file only readable by root (0640),
+to protect this passphrase. As a security measure,
+the script will refuse to read the configuration otherwise.</p>
+</section>
+<section id="recipients">
+<h4>recipients<a class="headerlink" href="#recipients" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">array</span> <span class="pre">of</span> <span class="pre">array</span> <span class="pre">of</span> <span class="pre">strings,</span> <span class="pre">a</span> <span class="pre">string</span> <span class="pre">being</span> <span class="pre">a</span> <span class="pre">GPG</span> <span class="pre">key</span> <span class="pre">ID</span> <span class="pre">in</span> <span class="pre">short</span> <span class="pre">or</span> <span class="pre">long</span> <span class="pre">format</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">(none),</span> <span class="pre">setting</span> <span class="pre">a</span> <span class="pre">value</span> <span class="pre">is</span> <span class="pre">mandatory</span></code></p>
+</dd>
+</dl>
+<p>The ttyrecs will be encrypted with those GPG keys, possibly using multi-layer GPG encryption.
+Each sub-array is a layer, the first sub-array being the first encryption layer (which is also the last one for decryption)
+To completely decrypt a ttyrec, one would need at least one key of each layer.
+To encrypt only to a single layer and to only one key, simply use [ [ &quot;KEYID&quot; ] ].
+To encrypt to a single layer but with 3 keys being able to decrypt the ttyrec, use [ [ &quot;KEY1&quot;, &quot;KEY2&quot;, &quot;KEY3&quot; ] ], etc.
+A common use of multi-layer encryption is to have the first layer composed of the auditors' GPG keys, and
+the second layer composed of the sysadmins' GPG keys. During an audit, the sysadmins would get the ttyrec encrypted file,
+decrypt the second encryption layer (the first for decryption), and handle the now only auditor-protected file to the auditors.
+All public keys must be in the local root keyring (gpg --list-keys).
+Don't forget to trust those keys &quot;ultimately&quot; in root's keyring, too (gpg --edit-key ID)</p>
+</section>
+<section id="encrypt-and-move-to-directory">
+<h4>encrypt_and_move_to_directory<a class="headerlink" href="#encrypt-and-move-to-directory" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">a</span> <span class="pre">valid</span> <span class="pre">directory</span> <span class="pre">name</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;/home/.encrypt&quot;</span></code></p>
+</dd>
+</dl>
+<p>After encryption (and compression), move ttyrec, user sqlite and user log files to subdirs of this directory.
+It'll be created if it doesn't exist yet.
+You may want this directory to be the mount point of a remote filer, if you wish.
+If you change this, it's probably a good idea to ensure that the path is excluded from the
+master/slave synchronization, in <code class="docutils literal notranslate"><span class="pre">/etc/bastion/osh-sync-watcher.rsyncfilter</span></code>.
+This is already the case for the default value.</p>
+</section>
+<section id="encrypt-and-move-ttyrec-delay-days">
+<h4>encrypt_and_move_ttyrec_delay_days<a class="headerlink" href="#encrypt-and-move-ttyrec-delay-days" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0,</span> <span class="pre">or</span> <span class="pre">-1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">14</span></code></p>
+</dd>
+</dl>
+<p>Don't touch ttyrec files that have a modification time more recent than this amount of days.
+The files won't be encrypted nor moved yet, and will still be readable by the <code class="docutils literal notranslate"><span class="pre">selfPlaySession</span></code> command.
+You can set this to a (possibly) much higher value, the only limit is the amount of disk space you have.
+If set to -1, the ttyrec files will never get encrypted or moved by this script.
+The eligible files will be encrypted and moved to <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code>.
+NOTE: The old name of this option is <cite>encrypt_and_move_delay_days</cite>.
+If it is found in your configuration file and <cite>encrypt_and_move_ttyrec_delay_days</cite> is not,
+then the value of <cite>encrypt_and_move_delay_days</cite> will be used instead of the default.</p>
+</section>
+<section id="encrypt-and-move-user-logs-delay-days">
+<h4>encrypt_and_move_user_logs_delay_days<a class="headerlink" href="#encrypt-and-move-user-logs-delay-days" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">31,</span> <span class="pre">or</span> <span class="pre">-1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">31</span></code></p>
+</dd>
+</dl>
+<p>Don't touch user log files (<code class="docutils literal notranslate"><span class="pre">/home/*/*.log</span></code>) that have been modified more recently than this amount of days.
+The bare minimum is 31 days, to ensure we're not moving a current-month file.
+You can set this to a (possibly) much higher value, the only limit is the amount of disk space you have.
+If set to -1, the user log files will never get encrypted or moved by this script.
+The eligible files will be encrypted and moved to <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code>.</p>
+</section>
+<section id="encrypt-and-move-user-sqlites-delay-days">
+<h4>encrypt_and_move_user_sqlites_delay_days<a class="headerlink" href="#encrypt-and-move-user-sqlites-delay-days" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">31,</span> <span class="pre">or</span> <span class="pre">-1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">31</span></code></p>
+</dd>
+</dl>
+<p>Don't touch user sqlite files (<code class="docutils literal notranslate"><span class="pre">/home/*/*.sqlite</span></code>) that have been modified more recently than this amount of days.
+The files won't be encrypted nor moved yet, and will still be usable by the <code class="docutils literal notranslate"><span class="pre">selfListSessions</span></code> command.
+The bare minimum is 31 days, to ensure we're not moving a current-month file.
+You can set this to a (possibly) much higher value, the only limit is the amount of disk space you have.
+If set to -1, the user sqlite files will never get encrypted or moved by this script.
+The eligible files will be encrypted and moved to <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code>.</p>
+</section>
+</section>
+<section id="push-files-to-a-remote-destination">
+<h3>Push files to a remote destination<a class="headerlink" href="#push-files-to-a-remote-destination" title="Permalink to this headline"></a></h3>
+<section id="rsync-destination">
+<h4>rsync_destination<a class="headerlink" href="#rsync-destination" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;user&#64;remotebackup.example.org:/remote/dir&quot;</span></code></p>
+</dd>
+</dl>
+<p>The value of this option will be passed to <code class="docutils literal notranslate"><span class="pre">rsync</span></code> as the destination.
+Note that the source of the rsync is already configured above, as the <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code>.
+We only rsync the files that have already been encrypted and moved there.
+If this option is empty, this will <strong>disable</strong> <code class="docutils literal notranslate"><span class="pre">rsync</span></code>, meaning that the ttyrec files will be encrypted,
+but not moved out of the server. In other words, the files will pile up in <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code>,
+which can be pretty okay in you have enough disk space.</p>
+</section>
+<section id="rsync-rsh">
+<h4>rsync_rsh<a class="headerlink" href="#rsync-rsh" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;ssh</span> <span class="pre">-p</span> <span class="pre">222</span> <span class="pre">-i</span> <span class="pre">/root/.ssh/id_ed25519_backup&quot;</span></code></p>
+</dd>
+</dl>
+<p>The value of this option will be passed to <code class="docutils literal notranslate"><span class="pre">rsync</span></code>'s <code class="docutils literal notranslate"><span class="pre">--rsh</span></code> option.
+This is useful to specify an SSH key or an alternate SSH port for example.
+This option is ignored when <code class="docutils literal notranslate"><span class="pre">rsync</span></code> is disabled (i.e. when <code class="docutils literal notranslate"><span class="pre">rsync_destination</span></code> is empty).</p>
+</section>
+<section id="rsync-delay-before-remove-days">
+<h4>rsync_delay_before_remove_days<a class="headerlink" href="#rsync-delay-before-remove-days" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0,</span> <span class="pre">or</span> <span class="pre">-1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>After encryption/compression, and successful rsync of <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code> to remote,
+wait for this amount of days before removing the encrypted/compressed files locally.
+Specify 0 to remove the files as soon as they're transferred.
+This option is ignored when <code class="docutils literal notranslate"><span class="pre">rsync</span></code> is disabled (i.e. when <code class="docutils literal notranslate"><span class="pre">rsync_destination</span></code> is empty).
+Note that if rsync is enabled (see <code class="docutils literal notranslate"><span class="pre">rsync_destination</span></code> above), we'll always sync the files present in
+<code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code> as soon as we can, to ensure limitation of logs data loss in case of
+catastrophic failure of the server. The <code class="docutils literal notranslate"><span class="pre">rsync_delay_before_remove_days</span></code> option configures the number
+of days after we remove the files locally, but note that these have already been transferred remotely
+as soon as they were present in <code class="docutils literal notranslate"><span class="pre">encrypt_and_move_to_directory</span></code>.
+To rsync the files remotely but never delete them locally, set this to -1.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-backup-acl-keys_conf.html" class="btn btn-neutral float-left" title="osh-backup-acl-keys.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-sync-watcher_sh.html" class="btn btn-neutral float-right" title="osh-sync-watcher.sh" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-http-proxy_conf.html b/administration/configuration/osh-http-proxy_conf.html
new file mode 100644
index 000000000..bb3e42f59
--- /dev/null
+++ b/administration/configuration/osh-http-proxy_conf.html
@@ -0,0 +1,377 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-http-proxy.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-piv-grace-reaper.conf" href="osh-piv-grace-reaper_conf.html" />
+    <link rel="prev" title="osh-sync-watcher.sh" href="osh-sync-watcher_sh.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="bastion_conf.html">bastion.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-backup-acl-keys_conf.html">osh-backup-acl-keys.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-encrypt-rsync_conf.html">osh-encrypt-rsync.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-sync-watcher_sh.html">osh-sync-watcher.sh</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-http-proxy.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-http-proxy.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-http-proxy_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-http-proxy-conf">
+<h1>osh-http-proxy.conf<a class="headerlink" href="#osh-http-proxy-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This module is optional, and disabled by default.
+To know more about the HTTP Proxy feature of The Bastion,
+please check the <a class="reference internal" href="../../using/http_proxy.html"><span class="doc">HTTPS Proxy</span></a> section</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="http-proxy-configuration-options">
+<h3>HTTP Proxy configuration options<a class="headerlink" href="#http-proxy-configuration-options" title="Permalink to this headline"></a></h3>
+<p>These options modify the behavior of the HTTP Proxy, an optional module of The Bastion</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#enabled">enabled</a></p></li>
+<li><p><a class="reference internal" href="#port">port</a></p></li>
+<li><p><a class="reference internal" href="#ssl-certificate">ssl_certificate</a></p></li>
+<li><p><a class="reference internal" href="#ssl-key">ssl_key</a></p></li>
+<li><p><a class="reference internal" href="#ciphers">ciphers</a></p></li>
+<li><p><a class="reference internal" href="#insecure">insecure</a></p></li>
+<li><p><a class="reference internal" href="#min-servers">min_servers</a></p></li>
+<li><p><a class="reference internal" href="#max-servers">max_servers</a></p></li>
+<li><p><a class="reference internal" href="#min-spare-servers">min_spare_servers</a></p></li>
+<li><p><a class="reference internal" href="#max-spare-servers">max_spare_servers</a></p></li>
+<li><p><a class="reference internal" href="#timeout">timeout</a></p></li>
+<li><p><a class="reference internal" href="#log-request-response">log_request_response</a></p></li>
+<li><p><a class="reference internal" href="#log-request-response-max-size">log_request_response_max_size</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="http-proxy-configuration">
+<h3>HTTP Proxy configuration<a class="headerlink" href="#http-proxy-configuration" title="Permalink to this headline"></a></h3>
+<section id="enabled">
+<h4>enabled<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">bool</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>Whether the HTTP proxy daemon daemon is enabled or not. If it's not enabled, it'll exit when started.
+Of course, if you want to enable this daemon, you should <strong>also</strong> configure your init system to start it
+for you. Both sysV-style scripts and systemd unit files are provided.
+For systemd, using <cite>systemctl enable osh-http-proxy.service</cite> should be enough.
+For sysV-style inits, it depends on the scripts provided for your distro,
+but usually <cite>update-rc.d osh-http-proxy defaults</cite> then <cite>update-rc.d osh-http-proxy enable</cite> should
+do the trick.</p>
+</section>
+<section id="port">
+<h4>port<a class="headerlink" href="#port" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">1</span> <span class="pre">to</span> <span class="pre">65535</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">8443</span></code></p>
+</dd>
+</dl>
+<p>The port to listen to. You can use ports &lt; 1024, in which case privileges will be dropped after binding,
+but please ensure your systemd unit file starts the daemon as root in that case.</p>
+</section>
+<section id="ssl-certificate">
+<h4>ssl_certificate<a class="headerlink" href="#ssl-certificate" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">/etc/ssl/certs/ssl-cert-snakeoil.pem</span></code></p>
+</dd>
+</dl>
+<p>The file that contains the server SSL certificate in PEM format.
+For tests, install the <code class="docutils literal notranslate"><span class="pre">ssl-cert</span></code> package and point this configuration item
+to the snakeoil certs (which is the default).</p>
+</section>
+<section id="ssl-key">
+<h4>ssl_key<a class="headerlink" href="#ssl-key" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">/etc/ssl/private/ssl-cert-snakeoil.key</span></code></p>
+</dd>
+</dl>
+<p>The file that contains the server SSL key in PEM format.
+For tests, install the <code class="docutils literal notranslate"><span class="pre">ssl-cert</span></code> package and point this configuration item
+to the snakeoil certs (which is the default).</p>
+</section>
+<section id="ciphers">
+<h4>ciphers<a class="headerlink" href="#ciphers" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256&quot;</span></code></p>
+</dd>
+</dl>
+<p>The ordered list the TLS server ciphers, in <code class="docutils literal notranslate"><span class="pre">openssl</span></code> classic format. Use <code class="docutils literal notranslate"><span class="pre">openssl</span> <span class="pre">ciphers</span></code>
+to see what your system supports, an empty list leaves the choice to your openssl libraries default
+values (system-dependent)</p>
+</section>
+<section id="insecure">
+<h4>insecure<a class="headerlink" href="#insecure" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">bool</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">false</span></code></p>
+</dd>
+</dl>
+<p>Whether to ignore SSL certificate verification for the connection between the bastion and the devices</p>
+</section>
+<section id="min-servers">
+<h4>min_servers<a class="headerlink" href="#min-servers" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">1</span> <span class="pre">to</span> <span class="pre">512</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">8</span></code></p>
+</dd>
+</dl>
+<p>Number of child processes to start at launch</p>
+</section>
+<section id="max-servers">
+<h4>max_servers<a class="headerlink" href="#max-servers" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">1</span> <span class="pre">to</span> <span class="pre">512</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">32</span></code></p>
+</dd>
+</dl>
+<p>Hard maximum number of child processes that can be active at any given time no matter what</p>
+</section>
+<section id="min-spare-servers">
+<h4>min_spare_servers<a class="headerlink" href="#min-spare-servers" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">1</span> <span class="pre">to</span> <span class="pre">512</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">8</span></code></p>
+</dd>
+</dl>
+<p>The daemon will ensure that there is at least this number of children idle &amp; ready to accept
+new connections (as long as max_servers is not reached)</p>
+</section>
+<section id="max-spare-servers">
+<h4>max_spare_servers<a class="headerlink" href="#max-spare-servers" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">1</span> <span class="pre">to</span> <span class="pre">512</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">16</span></code></p>
+</dd>
+</dl>
+<p>The daemon will kill <em>idle</em> children to keep their number below this maximum when traffic is low</p>
+</section>
+<section id="timeout">
+<h4>timeout<a class="headerlink" href="#timeout" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">1</span> <span class="pre">to</span> <span class="pre">3600</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">120</span></code></p>
+</dd>
+</dl>
+<p>Timeout delay (in seconds) for the connection between the bastion and the devices</p>
+</section>
+<section id="log-request-response">
+<h4>log_request_response<a class="headerlink" href="#log-request-response" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">bool</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>When enabled, the complete response of the device to the request we forwarded will be logged,
+otherwise we'll only log the response headers</p>
+</section>
+<section id="log-request-response-max-size">
+<h4>log_request_response_max_size<a class="headerlink" href="#log-request-response-max-size" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">0</span> <span class="pre">to</span> <span class="pre">2^30</span> <span class="pre">(1</span> <span class="pre">GiB)</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">65536</span></code></p>
+</dd>
+</dl>
+<p>This option only applies when <cite>log_request_response</cite> is true (see above).
+When set to zero, the complete response will be logged in the account's home log directory,
+including the body, regardless of its size. If set to a positive integer,
+the query response will only be partially logged, with full status and headers but the body only up
+to the specified size. This is a way to avoid turning off request response logging completely on
+very busy bastions, by ensuring logs growth don't get out of hand, as some responses to queries can
+take megabytes, with possibly limited added value to traceability.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-sync-watcher_sh.html" class="btn btn-neutral float-left" title="osh-sync-watcher.sh" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-piv-grace-reaper_conf.html" class="btn btn-neutral float-right" title="osh-piv-grace-reaper.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-lingering-sessions-reaper_conf.html b/administration/configuration/osh-lingering-sessions-reaper_conf.html
new file mode 100644
index 000000000..b33d0640b
--- /dev/null
+++ b/administration/configuration/osh-lingering-sessions-reaper_conf.html
@@ -0,0 +1,252 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-lingering-sessions-reaper.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-orphaned-homedir.conf" href="osh-orphaned-homedir_conf.html" />
+    <link rel="prev" title="osh-cleanup-guest-key-access.conf" href="osh-cleanup-guest-key-access_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="osh-piv-grace-reaper_conf.html">osh-piv-grace-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-remove-empty-folders_conf.html">osh-remove-empty-folders.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-cleanup-guest-key-access_conf.html">osh-cleanup-guest-key-access.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-lingering-sessions-reaper.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-orphaned-homedir_conf.html">osh-orphaned-homedir.conf</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-lingering-sessions-reaper.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-lingering-sessions-reaper_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-lingering-sessions-reaper-conf">
+<h1>osh-lingering-sessions-reaper.conf<a class="headerlink" href="#osh-lingering-sessions-reaper-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This script is called by cron and is responsible for terminating
+lingering sessions that no longer have any tty attached nor parent PID,
+and have been running for some time.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-activation-options">
+<h3>Logging &amp; activation options<a class="headerlink" href="#logging-activation-options" title="Permalink to this headline"></a></h3>
+<p>Script logging configuration and script activation</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logfile">LOGFILE</a></p></li>
+<li><p><a class="reference internal" href="#log-facility">LOG_FACILITY</a></p></li>
+<li><p><a class="reference internal" href="#enabled">ENABLED</a></p></li>
+</ul>
+</section>
+<section id="main-options">
+<h3>Main options<a class="headerlink" href="#main-options" title="Permalink to this headline"></a></h3>
+<p>These options govern the behavior of the script</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#max-age">MAX_AGE</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging-activation">
+<h3>Logging &amp; activation<a class="headerlink" href="#logging-activation" title="Permalink to this headline"></a></h3>
+<section id="logfile">
+<h4>LOGFILE<a class="headerlink" href="#logfile" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">file</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>File where the logs will be written to (don't forget to configure <code class="docutils literal notranslate"><span class="pre">logrotate</span></code>!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.</p>
+</section>
+<section id="log-facility">
+<h4>LOG_FACILITY<a class="headerlink" href="#log-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local6&quot;</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+<section id="enabled">
+<h4>ENABLED<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">0</span> <span class="pre">or</span> <span class="pre">1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd>
+</dl>
+<p>If set to 1, the script is enabled and will run when started by crond.</p>
+</section>
+</section>
+<section id="main">
+<h3>Main<a class="headerlink" href="#main" title="Permalink to this headline"></a></h3>
+<section id="max-age">
+<h4>MAX_AGE<a class="headerlink" href="#max-age" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;=</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">86400</span></code></p>
+</dd>
+</dl>
+<p>The minimum number of seconds a session must have been opened before
+being considered as possibly a lingering orphan session.
+Still alive sessions, even older than MAX_AGE seconds, will be kept.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-cleanup-guest-key-access_conf.html" class="btn btn-neutral float-left" title="osh-cleanup-guest-key-access.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-orphaned-homedir_conf.html" class="btn btn-neutral float-right" title="osh-orphaned-homedir.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-orphaned-homedir_conf.html b/administration/configuration/osh-orphaned-homedir_conf.html
new file mode 100644
index 000000000..c2820ae46
--- /dev/null
+++ b/administration/configuration/osh-orphaned-homedir_conf.html
@@ -0,0 +1,230 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-orphaned-homedir.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="Logs" href="../logs.html" />
+    <link rel="prev" title="osh-lingering-sessions-reaper.conf" href="osh-lingering-sessions-reaper_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="osh-piv-grace-reaper_conf.html">osh-piv-grace-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-remove-empty-folders_conf.html">osh-remove-empty-folders.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-cleanup-guest-key-access_conf.html">osh-cleanup-guest-key-access.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-lingering-sessions-reaper_conf.html">osh-lingering-sessions-reaper.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-orphaned-homedir.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-orphaned-homedir.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-orphaned-homedir_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-orphaned-homedir-conf">
+<h1>osh-orphaned-homedir.conf<a class="headerlink" href="#osh-orphaned-homedir-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This script is called by cron and is responsible for clearing up
+orphaned home directories on secondary bastions.
+Indeed, once the user has been deleted, a few files may remain,
+such as logs, so this script handles the proper archiving
+of these sparse files, before removing the orphaned home directory.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-activation-options">
+<h3>Logging &amp; activation options<a class="headerlink" href="#logging-activation-options" title="Permalink to this headline"></a></h3>
+<p>Script logging configuration and script activation</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logfile">LOGFILE</a></p></li>
+<li><p><a class="reference internal" href="#log-facility">LOG_FACILITY</a></p></li>
+<li><p><a class="reference internal" href="#enabled">ENABLED</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging-activation">
+<h3>Logging &amp; activation<a class="headerlink" href="#logging-activation" title="Permalink to this headline"></a></h3>
+<section id="logfile">
+<h4>LOGFILE<a class="headerlink" href="#logfile" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">file</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>File where the logs will be written to (don't forget to configure <code class="docutils literal notranslate"><span class="pre">logrotate</span></code>!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.</p>
+</section>
+<section id="log-facility">
+<h4>LOG_FACILITY<a class="headerlink" href="#log-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local6&quot;</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+<section id="enabled">
+<h4>ENABLED<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">0</span> <span class="pre">or</span> <span class="pre">1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd>
+</dl>
+<p>If set to 1, the script is enabled and will run when started by crond.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-lingering-sessions-reaper_conf.html" class="btn btn-neutral float-left" title="osh-lingering-sessions-reaper.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../logs.html" class="btn btn-neutral float-right" title="Logs" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-piv-grace-reaper_conf.html b/administration/configuration/osh-piv-grace-reaper_conf.html
new file mode 100644
index 000000000..1fa8eefca
--- /dev/null
+++ b/administration/configuration/osh-piv-grace-reaper_conf.html
@@ -0,0 +1,213 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-piv-grace-reaper.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-remove-empty-folders.conf" href="osh-remove-empty-folders_conf.html" />
+    <link rel="prev" title="osh-http-proxy.conf" href="osh-http-proxy_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a><ul class="current">
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-piv-grace-reaper.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-remove-empty-folders_conf.html">osh-remove-empty-folders.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-cleanup-guest-key-access_conf.html">osh-cleanup-guest-key-access.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-lingering-sessions-reaper_conf.html">osh-lingering-sessions-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-orphaned-homedir_conf.html">osh-orphaned-homedir.conf</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-piv-grace-reaper.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-piv-grace-reaper_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-piv-grace-reaper-conf">
+<h1>osh-piv-grace-reaper.conf<a class="headerlink" href="#osh-piv-grace-reaper-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This script is called by cron and is responsible for removing temporary
+grace periods on PIV policies, once they expire. If you don't use PIV keys,
+this script won't do anything (see <a class="reference internal" href="../../using/piv.html"><span class="doc">PIV keys support</span></a>).</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-activation-options">
+<h3>Logging &amp; activation options<a class="headerlink" href="#logging-activation-options" title="Permalink to this headline"></a></h3>
+<p>Script logging configuration and script activation</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#syslog-facility">syslog_facility</a></p></li>
+<li><p><a class="reference internal" href="#enabled">enabled</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging-activation">
+<h3>Logging &amp; activation<a class="headerlink" href="#logging-activation" title="Permalink to this headline"></a></h3>
+<section id="syslog-facility">
+<h4>syslog_facility<a class="headerlink" href="#syslog-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">local6</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+<section id="enabled">
+<h4>enabled<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">bool</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">true</span></code></p>
+</dd>
+</dl>
+<p>If not set to <cite>true</cite> (or a true value), the script will not run.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-http-proxy_conf.html" class="btn btn-neutral float-left" title="osh-http-proxy.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-remove-empty-folders_conf.html" class="btn btn-neutral float-right" title="osh-remove-empty-folders.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-remove-empty-folders_conf.html b/administration/configuration/osh-remove-empty-folders_conf.html
new file mode 100644
index 000000000..70204a973
--- /dev/null
+++ b/administration/configuration/osh-remove-empty-folders_conf.html
@@ -0,0 +1,255 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-remove-empty-folders.conf &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-cleanup-guest-key-access.conf" href="osh-cleanup-guest-key-access_conf.html" />
+    <link rel="prev" title="osh-piv-grace-reaper.conf" href="osh-piv-grace-reaper_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="osh-piv-grace-reaper_conf.html">osh-piv-grace-reaper.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-remove-empty-folders.conf</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-cleanup-guest-key-access_conf.html">osh-cleanup-guest-key-access.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-lingering-sessions-reaper_conf.html">osh-lingering-sessions-reaper.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-orphaned-homedir_conf.html">osh-orphaned-homedir.conf</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-remove-empty-folders.conf</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-remove-empty-folders_conf.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-remove-empty-folders-conf">
+<h1>osh-remove-empty-folders.conf<a class="headerlink" href="#osh-remove-empty-folders-conf" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This script is called by cron and is responsible for getting rid of empty
+folders in the <code class="docutils literal notranslate"><span class="pre">ttyrec/</span></code> directory of users homes, which may contain a
+high amount of empty folders for busy users connecting to a lot of
+different servers, as we create one folder per destination IP.
+Of course, this script will only remove empty folders, never actual files.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-activation-options">
+<h3>Logging &amp; activation options<a class="headerlink" href="#logging-activation-options" title="Permalink to this headline"></a></h3>
+<p>Script logging configuration and script activation</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logfile">LOGFILE</a></p></li>
+<li><p><a class="reference internal" href="#log-facility">LOG_FACILITY</a></p></li>
+</ul>
+</section>
+<section id="behavior-options">
+<h3>Behavior options<a class="headerlink" href="#behavior-options" title="Permalink to this headline"></a></h3>
+<p>These options govern the behavior of the script</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#enabled">ENABLED</a></p></li>
+<li><p><a class="reference internal" href="#mtime-days">MTIME_DAYS</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging-activation">
+<h3>Logging &amp; activation<a class="headerlink" href="#logging-activation" title="Permalink to this headline"></a></h3>
+<section id="logfile">
+<h4>LOGFILE<a class="headerlink" href="#logfile" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string,</span> <span class="pre">path</span> <span class="pre">to</span> <span class="pre">a</span> <span class="pre">file</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>File where the logs will be written to (don't forget to configure <code class="docutils literal notranslate"><span class="pre">logrotate</span></code>!).
+Note that using this configuration option, the script will directly write to the file, without using syslog.
+If empty, won't log directly to any file.</p>
+</section>
+<section id="log-facility">
+<h4>LOG_FACILITY<a class="headerlink" href="#log-facility" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local6&quot;</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output.
+If set to the empty string, we'll not log through syslog at all.
+If this configuration option is missing from your config file altogether,
+the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+</section>
+<section id="behavior">
+<h3>Behavior<a class="headerlink" href="#behavior" title="Permalink to this headline"></a></h3>
+<section id="enabled">
+<h4>ENABLED<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">0</span> <span class="pre">or</span> <span class="pre">1</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd>
+</dl>
+<p>If set to 1, the script is enabled and will attempt to garbage-collect empty directories located
+in <code class="docutils literal notranslate"><span class="pre">/home/*/ttyrec</span></code>. If set to anything else, the script is considered disabled and will not run.</p>
+</section>
+<section id="mtime-days">
+<h4>MTIME_DAYS<a class="headerlink" href="#mtime-days" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int,</span> <span class="pre">&gt;=</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd>
+</dl>
+<p>The amount of days the empty folder must have been empty before considering a removal. You probably
+don't need to change the default value, unless you want to ensure that a given folder has not been
+used since some time before removing it (this has no impact as folders are re-created as needed).</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-piv-grace-reaper_conf.html" class="btn btn-neutral float-left" title="osh-piv-grace-reaper.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-cleanup-guest-key-access_conf.html" class="btn btn-neutral float-right" title="osh-cleanup-guest-key-access.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/configuration/osh-sync-watcher_sh.html b/administration/configuration/osh-sync-watcher_sh.html
new file mode 100644
index 000000000..7849c61cb
--- /dev/null
+++ b/administration/configuration/osh-sync-watcher_sh.html
@@ -0,0 +1,301 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>osh-sync-watcher.sh &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="osh-http-proxy.conf" href="osh-http-proxy_conf.html" />
+    <link rel="prev" title="osh-encrypt-rsync.conf" href="osh-encrypt-rsync_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Configuration files</a><ul class="current">
+<li class="toctree-l2 current"><a class="reference internal" href="index.html#main-configuration-files">Main configuration files</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="bastion_conf.html">bastion.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-backup-acl-keys_conf.html">osh-backup-acl-keys.conf</a></li>
+<li class="toctree-l3"><a class="reference internal" href="osh-encrypt-rsync_conf.html">osh-encrypt-rsync.conf</a></li>
+<li class="toctree-l3 current"><a class="current reference internal" href="#">osh-sync-watcher.sh</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#option-list">Option List</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#option-reference">Option Reference</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="osh-http-proxy_conf.html">osh-http-proxy.conf</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Configuration files</a> &raquo;</li>
+      <li>osh-sync-watcher.sh</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/configuration/osh-sync-watcher_sh.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="osh-sync-watcher-sh">
+<h1>osh-sync-watcher.sh<a class="headerlink" href="#osh-sync-watcher-sh" title="Permalink to this headline"></a></h1>
+<blockquote>
+<div><div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This daemon is responsible for ensuring secondary bastions
+are synced up to their primary at all times.
+If you don't have such HA setup, you can ignore this config file.
+For more information, refer to
+<a class="reference internal" href="../../installation/advanced.html#clustering-high-availability"><span class="std std-ref">Clustering (High Availability)</span></a>.</p>
+</div>
+</div></blockquote>
+<section id="option-list">
+<h2>Option List<a class="headerlink" href="#option-list" title="Permalink to this headline"></a></h2>
+<section id="logging-options">
+<h3>Logging options<a class="headerlink" href="#logging-options" title="Permalink to this headline"></a></h3>
+<p>These options configure the way the script logs its actions</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logdir">logdir</a></p></li>
+<li><p><a class="reference internal" href="#syslog">syslog</a></p></li>
+</ul>
+</section>
+<section id="daemon-setup-options">
+<h3>Daemon setup options<a class="headerlink" href="#daemon-setup-options" title="Permalink to this headline"></a></h3>
+<p>These options configure whether the synchronization daemon is enabled</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#enabled">enabled</a></p></li>
+<li><p><a class="reference internal" href="#timeout">timeout</a></p></li>
+</ul>
+</section>
+<section id="remote-synchronization-options">
+<h3>Remote synchronization options<a class="headerlink" href="#remote-synchronization-options" title="Permalink to this headline"></a></h3>
+<p>These options configure how the primary bastion should push its configuration to the secondaries</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#rshcmd">rshcmd</a></p></li>
+<li><p><a class="reference internal" href="#remoteuser">remoteuser</a></p></li>
+<li><p><a class="reference internal" href="#remotehostlist">remotehostlist</a></p></li>
+</ul>
+</section>
+</section>
+<section id="option-reference">
+<h2>Option Reference<a class="headerlink" href="#option-reference" title="Permalink to this headline"></a></h2>
+<section id="logging">
+<h3>Logging<a class="headerlink" href="#logging" title="Permalink to this headline"></a></h3>
+<section id="logdir">
+<h4>logdir<a class="headerlink" href="#logdir" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+</dl>
+<p>Directory where the logs will be written to. Note that using this configuration option, the script will directly write to a file, without using syslog. If empty, won't log directly to a file.</p>
+</section>
+<section id="syslog">
+<h4>syslog<a class="headerlink" href="#syslog" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;local6&quot;</span></code></p>
+</dd>
+</dl>
+<p>The syslog facility to use for logging the script output. If set to the empty string, we'll not log through syslog at all. If this configuration option is missing from your config file altogether, the default value will be used (local6), which means that we'll log to syslog.</p>
+</section>
+</section>
+<section id="daemon-setup">
+<h3>Daemon setup<a class="headerlink" href="#daemon-setup" title="Permalink to this headline"></a></h3>
+<section id="enabled">
+<h4>enabled<a class="headerlink" href="#enabled" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">0</span></code></p>
+</dd>
+</dl>
+<p>If set to anything else than <code class="docutils literal notranslate"><span class="pre">1</span></code>, the daemon will refuse to start (e.g. you don't have secondary bastions). You can set this to <code class="docutils literal notranslate"><span class="pre">1</span></code> when you've configured and tested the primary/secondaries setup.</p>
+</section>
+<section id="timeout">
+<h4>timeout<a class="headerlink" href="#timeout" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">int</span> <span class="pre">&gt;</span> <span class="pre">0</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">120</span></code></p>
+</dd>
+</dl>
+<p>The maximum delay, in seconds, after which we'll forcefully synchronize our data to the secondaries, even if no change was detected.</p>
+</section>
+</section>
+<section id="remote-synchronization">
+<h3>Remote synchronization<a class="headerlink" href="#remote-synchronization" title="Permalink to this headline"></a></h3>
+<section id="rshcmd">
+<h4>rshcmd<a class="headerlink" href="#rshcmd" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;ssh</span> <span class="pre">-q</span> <span class="pre">-i</span> <span class="pre">/root/.ssh/id_master2slave</span> <span class="pre">-o</span> <span class="pre">StrictHostKeyChecking=accept-new&quot;</span></code></p>
+</dd>
+</dl>
+<p>This value will be passed as the <code class="docutils literal notranslate"><span class="pre">--rsh</span></code> parameter of <code class="docutils literal notranslate"><span class="pre">rsync</span></code> (don't use <code class="docutils literal notranslate"><span class="pre">-p</span></code> to specify the port here, use the <code class="docutils literal notranslate"><span class="pre">remotehostlist</span></code> config below instead), this can be used to specify which SSH key to use, for example. NOTE THAT THIS OPTION IS MANDATORY (if you don't have anything to specify here, you can just say <code class="docutils literal notranslate"><span class="pre">ssh</span></code>). If you followed the standard installation procedure, the &quot;example&quot; value specified below will work.</p>
+</section>
+<section id="remoteuser">
+<h4>remoteuser<a class="headerlink" href="#remoteuser" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">string</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;bastionsync&quot;</span></code></p>
+</dd>
+</dl>
+<p>The remote user to connect as, using <code class="docutils literal notranslate"><span class="pre">ssh</span></code> while rsyncing to secondaries. You probably don't need to change this.</p>
+</section>
+<section id="remotehostlist">
+<h4>remotehostlist<a class="headerlink" href="#remotehostlist" title="Permalink to this headline"></a></h4>
+<dl class="field-list simple">
+<dt class="field-odd">Type</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">space-separated</span> <span class="pre">list</span> <span class="pre">of</span> <span class="pre">strings,</span> <span class="pre">each</span> <span class="pre">string</span> <span class="pre">being</span> <span class="pre">either</span> <span class="pre">'ip'</span> <span class="pre">or</span> <span class="pre">'ip:port'</span></code></p>
+</dd>
+<dt class="field-even">Default</dt>
+<dd class="field-even"><p><code class="docutils literal notranslate"><span class="pre">&quot;&quot;</span></code></p>
+</dd>
+<dt class="field-odd">Example</dt>
+<dd class="field-odd"><p><code class="docutils literal notranslate"><span class="pre">&quot;192.0.2.17</span> <span class="pre">192.0.2.12:2244&quot;</span></code></p>
+</dd>
+</dl>
+<p>The list of the secondary bastions to push our data to. If this list is empty, the daemon won't do anything.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="osh-encrypt-rsync_conf.html" class="btn btn-neutral float-left" title="osh-encrypt-rsync.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="osh-http-proxy_conf.html" class="btn btn-neutral float-right" title="osh-http-proxy.conf" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/logs.html b/administration/logs.html
new file mode 100644
index 000000000..943c440e3
--- /dev/null
+++ b/administration/logs.html
@@ -0,0 +1,694 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Logs &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Multi-Factor Authentication" href="mfa.html" />
+    <link rel="prev" title="osh-orphaned-homedir.conf" href="configuration/osh-orphaned-homedir_conf.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Logs</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#message-types">Message types</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#open">open</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#close">close</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#warn-die">warn, die</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#warn-info-die-info">warn-info, die-info</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#code-info">code-info</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#code-warning">code-warning</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#acl">acl</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#membership">membership</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#security">security</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#group">group</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#account">account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#syslog">Syslog</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#files-location">Files location</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#log-format">Log format</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#access-logs">Access logs</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#sqlite-logs">SQLite logs</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#terminal-recordings-ttyrec">Terminal recordings (<em>ttyrec</em>)</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Logs</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/administration/logs.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="logs">
+<h1><a class="toc-backref" href="#id2">Logs</a><a class="headerlink" href="#logs" title="Permalink to this headline"></a></h1>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>The Bastion comes with a lot of traceability features, you have to ensure that you've done your configuration
+correctly so that those logs are kept in a safe place when you need them. It is warmly advised to enable at least
+the syslog option, and push your logs to a remote syslog server.</p>
+</div>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#logs" id="id2">Logs</a></p>
+<ul>
+<li><p><a class="reference internal" href="#message-types" id="id3">Message types</a></p>
+<ul>
+<li><p><a class="reference internal" href="#open" id="id4">open</a></p></li>
+<li><p><a class="reference internal" href="#close" id="id5">close</a></p></li>
+<li><p><a class="reference internal" href="#warn-die" id="id6">warn, die</a></p></li>
+<li><p><a class="reference internal" href="#warn-info-die-info" id="id7">warn-info, die-info</a></p></li>
+<li><p><a class="reference internal" href="#code-info" id="id8">code-info</a></p></li>
+<li><p><a class="reference internal" href="#code-warning" id="id9">code-warning</a></p></li>
+<li><p><a class="reference internal" href="#acl" id="id10">acl</a></p></li>
+<li><p><a class="reference internal" href="#membership" id="id11">membership</a></p></li>
+<li><p><a class="reference internal" href="#security" id="id12">security</a></p></li>
+<li><p><a class="reference internal" href="#group" id="id13">group</a></p></li>
+<li><p><a class="reference internal" href="#account" id="id14">account</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#syslog" id="id15">Syslog</a></p>
+<ul>
+<li><p><a class="reference internal" href="#files-location" id="id16">Files location</a></p></li>
+<li><p><a class="reference internal" href="#log-format" id="id17">Log format</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#access-logs" id="id18">Access logs</a></p></li>
+<li><p><a class="reference internal" href="#sqlite-logs" id="id19">SQLite logs</a></p></li>
+<li><p><a class="reference internal" href="#terminal-recordings-ttyrec" id="id20">Terminal recordings (<em>ttyrec</em>)</a></p></li>
+</ul>
+</li>
+</ul>
+</div>
+<section id="message-types">
+<h2><a class="toc-backref" href="#id3">Message types</a><a class="headerlink" href="#message-types" title="Permalink to this headline"></a></h2>
+<p>The Bastion has several configurable ways of logging events, but before detailing those,
+let's see the different message types that can be logged.
+The Bastion currently has 12 different message types, listed below:</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#log-open"><span class="std std-ref">open</span></a></p></li>
+<li><p><a class="reference internal" href="#log-close"><span class="std std-ref">close</span></a></p></li>
+<li><p><a class="reference internal" href="#log-warn"><span class="std std-ref">warn, die</span></a></p></li>
+<li><p><a class="reference internal" href="#log-warninfo"><span class="std std-ref">warn-info, die-info</span></a></p></li>
+<li><p><a class="reference internal" href="#log-codewarn"><span class="std std-ref">code-warning</span></a></p></li>
+<li><p><a class="reference internal" href="#log-acl"><span class="std std-ref">acl</span></a></p></li>
+<li><p><a class="reference internal" href="#log-membership"><span class="std std-ref">membership</span></a></p></li>
+<li><p><a class="reference internal" href="#log-security"><span class="std std-ref">security</span></a></p></li>
+<li><p><a class="reference internal" href="#log-group"><span class="std std-ref">group</span></a></p></li>
+<li><p><a class="reference internal" href="#log-account"><span class="std std-ref">account</span></a></p></li>
+</ul>
+<p>First, let's list the fields that are common to all the message types:</p>
+<dl class="simple">
+<dt>uniqid</dt><dd><p>This is the unique connection ID, you can find all the logs relevant to the same connection
+by filtering on the <code class="docutils literal notranslate"><span class="pre">uniqid</span></code>. This ID is also, by default, part of the filename given to the <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> files,
+for easier correlation. The same ID is also used in the sqlite logs, if you enabled those. In some rare cases,
+the value can be &quot;-&quot;, for example if a satellite script has something to log,
+not linked to an actual connection or session.</p>
+</dd>
+<dt>version</dt><dd><p>This indicates the version of The Bastion software that is writing the log</p>
+</dd>
+<dt>pid, ppid</dt><dd><p>This is the system PID (resp. system parent PID) of the process writing the log,
+for easier correlation with system audit logs if you have them</p>
+</dd>
+<dt>sysuser</dt><dd><p>This is the system user under which the process writing the log is currently running on,
+can be useful to detect abnormalities</p>
+</dd>
+<dt>sudo_user</dt><dd><p>When the value is present, it contains the system user name that has launched the <code class="docutils literal notranslate"><span class="pre">sudo</span></code> command the code is
+currently running under (this will be the case if a so-called &quot;bastion helper&quot; is pushing a log, for example).
+However this field will often have an empty value, it means that the code that is writing the log
+is not running under <code class="docutils literal notranslate"><span class="pre">sudo</span></code></p>
+</dd>
+<dt>uid, gid</dt><dd><p>This is the system user ID aka UID (resp. group ID aka GID) under which
+the process writing the log is currently running</p>
+</dd>
+<dt>account</dt><dd><p>This is the name of the bastion account that launched the command that produced the log</p>
+</dd>
+</dl>
+<p>The other fields depend on the message type, as detailed in the next sections.</p>
+<section id="open">
+<span id="log-open"></span><h3><a class="toc-backref" href="#id4">open</a><a class="headerlink" href="#open" title="Permalink to this headline"></a></h3>
+<p>This log is produced when a user established a session with the bastion.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: open <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;e9e4baf6873b&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.03&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;18721&quot;</span> <span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;18720&quot;</span>
+<span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;gthreepw&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;99998&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;99998&quot;</span> <span class="nv">account</span><span class="o">=</span><span class="s2">&quot;gthreepw&quot;</span> <span class="nv">cmdtype</span><span class="o">=</span><span class="s2">&quot;ssh&quot;</span> <span class="nv">allowed</span><span class="o">=</span><span class="s2">&quot;true&quot;</span>
+<span class="nv">ip_from</span><span class="o">=</span><span class="s2">&quot;172.17.0.1&quot;</span> <span class="nv">port_from</span><span class="o">=</span><span class="s2">&quot;39696&quot;</span> <span class="nv">host_from</span><span class="o">=</span><span class="s2">&quot;172.17.0.1&quot;</span> <span class="nv">ip_bastion</span><span class="o">=</span><span class="s2">&quot;172.17.0.2&quot;</span> <span class="nv">port_bastion</span><span class="o">=</span><span class="s2">&quot;22&quot;</span>
+<span class="nv">host_bastion</span><span class="o">=</span><span class="s2">&quot;myhostname.example.org&quot;</span> <span class="nv">user</span><span class="o">=</span><span class="s2">&quot;foo&quot;</span> <span class="nv">ip_to</span><span class="o">=</span><span class="s2">&quot;172.17.0.123&quot;</span> <span class="nv">port_to</span><span class="o">=</span><span class="s2">&quot;22&quot;</span> <span class="nv">host_to</span><span class="o">=</span><span class="s2">&quot;srv123.example.org&quot;</span>
+<span class="nv">plugin</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">globalsql</span><span class="o">=</span><span class="s2">&quot;ok&quot;</span> <span class="nv">accountsql</span><span class="o">=</span><span class="s2">&quot;ok&quot;</span> <span class="nv">comment</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">params</span><span class="o">=</span><span class="s2">&quot;ttyrec -f</span>
+<span class="s2">/home/gthreepw/ttyrec/172.17.0.123/2020-12-28.11-12-26.074894.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec -F</span>
+<span class="s2">/home/gthreepw/ttyrec/172.17.0.123/%Y--%d.%H-%M-%S.#usec#.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec --</span>
+<span class="s2">/usr/bin/ssh 172.17.0.123 -l foo -p 22 -i /home/gthreepw/.ssh/id_rsa4096_private.1594384739 -i</span>
+<span class="s2">/home/keykeeper/keyagroup/id_ed25519_agroup.1607524914 -o PreferredAuthentications=publickey&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>cmdtype</dt><dd><p>Indicates which category of command has been requested by the user:</p>
+<ul class="simple">
+<li><p>ssh: the user is trying to establish an SSH egress connection to a remote server</p></li>
+<li><p>telnet: the user is trying to establish a telnet egress connection to a remote server</p></li>
+<li><p>abort: the action requested by the user has been aborted early, possibly because of permission issues
+or impossibility to understand the request, more information is available in the <strong>bastion_comment</strong> field</p></li>
+<li><p>osh: the user is trying to execute a bastion plugin with the <code class="docutils literal notranslate"><span class="pre">--osh</span></code> command</p></li>
+<li><p>interactive: the user just entered interactive mode. Note that all the commands launched through
+the interactive mode will still have their own log.</p></li>
+<li><p>sshas: an administrator is currently establishing a connection on behalf of another user.
+This connection will also have its own log.</p></li>
+<li><p>proxyhttp_daemon: the HTTPS proxy daemon received a request</p></li>
+<li><p>proxyhttp_worker: the HTTPS proxy worker specifically spawned for the user by the daemon is handling the request</p></li>
+</ul>
+</dd>
+<dt>allowed</dt><dd><p>Indicates whether the requested action was allowed or not by the bastion, after executing the authorization phase.
+Will be either &quot;true&quot; or &quot;false&quot;.</p>
+</dd>
+<dt>ip_from, port_from, host_from</dt><dd><p>These are the IP and source port as seen by the bastion, from which the ingress connection originates.
+If the bastion can resolve the reverse of the IP to a hostname, it'll be indicated in host_from,
+otherwise the IP will be repeated there.</p>
+</dd>
+<dt>ip_bastion, port_bastion, host_bastion</dt><dd><p>These are the IP and port of the bastion to which the ingress connection terminates.
+If your bastion has several IPs and/or interfaces, this can be useful.
+If the bastion can resolve the reverse of the IP to a hostname, it'll be indicated in host_bastion,
+otherwise the IP will be repeated there.</p>
+</dd>
+<dt>ip_to, port_to, host_to</dt><dd><p>These are the IP and destination port to which the bastion will connect on the egress side,
+on behalf of the requesting user. If the bastion can resolve the reverse of the IP to a hostname,
+it'll be indicated in host_to, otherwise the IP will be repeated there.</p>
+</dd>
+<dt>plugin</dt><dd><p>When <code class="docutils literal notranslate"><span class="pre">cmdtype</span></code> is <code class="docutils literal notranslate"><span class="pre">osh</span></code>, the name of the command (or <em>plugin</em>) will appear in this field.
+Otherwise it'll be blank.</p>
+</dd>
+<dt>accountsql</dt><dd><p>This field will contain either:</p>
+<ul class="simple">
+<li><p>ok: when <a class="reference internal" href="configuration/bastion_conf.html#enableaccountsqllog"><span class="std std-ref">enableAccountSqlLog</span></a> is enabled, and we successfully inserted a new row for the log</p></li>
+<li><p>no: when <a class="reference internal" href="configuration/bastion_conf.html#enableaccountsqllog"><span class="std std-ref">enableAccountSqlLog</span></a> is disabled</p></li>
+<li><p>error: when we couldn't insert a new row, <strong>error</strong> followed by a detailed error message,
+for example &quot;error SQL error [global] err 8 while doing [inserting data (execute)]:
+attempt to write a readonly database&quot;.</p></li>
+</ul>
+</dd>
+<dt>globalsql</dt><dd><p>This field can contain the same values than <strong>accountsql</strong> above,
+but for <code class="docutils literal notranslate"><span class="pre">enableGlobalSqlLog</span></code> instead of <code class="docutils literal notranslate"><span class="pre">enableAccountSqlLog</span></code></p>
+</dd>
+<dt>comment</dt><dd><p>Some more information about the current event, depending on the <code class="docutils literal notranslate"><span class="pre">cmdtype</span></code> value.</p>
+</dd>
+<dt>params</dt><dd><p>This is the fully expanded command line that will be launched under the currently running user rights,
+to establish the egress connection, if applicable.</p>
+</dd>
+</dl>
+</section>
+<section id="close">
+<span id="log-close"></span><h3><a class="toc-backref" href="#id5">close</a><a class="headerlink" href="#close" title="Permalink to this headline"></a></h3>
+<p>This log is produced when a user terminates a currently running session with The Bastion.
+It is always matched (through the <code class="docutils literal notranslate"><span class="pre">uniqid</span></code>) to another log with the <code class="docutils literal notranslate"><span class="pre">open</span></code> message type.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: open <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;e9e4baf6873b&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.03&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;18721&quot;</span> <span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;18720&quot;</span>
+<span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;gthreepw&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;99998&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;99998&quot;</span> <span class="nv">account</span><span class="o">=</span><span class="s2">&quot;gthreepw&quot;</span> <span class="nv">cmdtype</span><span class="o">=</span><span class="s2">&quot;ssh&quot;</span> <span class="nv">allowed</span><span class="o">=</span><span class="s2">&quot;true&quot;</span>
+<span class="nv">ip_from</span><span class="o">=</span><span class="s2">&quot;172.17.0.1&quot;</span> <span class="nv">port_from</span><span class="o">=</span><span class="s2">&quot;39696&quot;</span> <span class="nv">host_from</span><span class="o">=</span><span class="s2">&quot;172.17.0.1&quot;</span> <span class="nv">ip_bastion</span><span class="o">=</span><span class="s2">&quot;172.17.0.2&quot;</span> <span class="nv">port_bastion</span><span class="o">=</span><span class="s2">&quot;22&quot;</span>
+<span class="nv">host_bastion</span><span class="o">=</span><span class="s2">&quot;myhostname.example.org&quot;</span> <span class="nv">user</span><span class="o">=</span><span class="s2">&quot;foo&quot;</span> <span class="nv">ip_to</span><span class="o">=</span><span class="s2">&quot;172.17.0.123&quot;</span> <span class="nv">port_to</span><span class="o">=</span><span class="s2">&quot;22&quot;</span>
+<span class="nv">host_to</span><span class="o">=</span><span class="s2">&quot;srv123.example.org&quot;</span> <span class="nv">plugin</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">globalsql</span><span class="o">=</span><span class="s2">&quot;ok&quot;</span> <span class="nv">accountsql</span><span class="o">=</span><span class="s2">&quot;ok&quot;</span> <span class="nv">comment</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">params</span><span class="o">=</span><span class="s2">&quot;ttyrec -f</span>
+<span class="s2">/home/gthreepw/ttyrec/172.17.0.123/2020-12-28.11-12-26.074894.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec -F</span>
+<span class="s2">/home/gthreepw/ttyrec/172.17.0.123/%Y--%d.%H-%M-%S.#usec#.e9e4baf6873b.gthreepw.foo.172.17.0.123.22.ttyrec --</span>
+<span class="s2">/usr/bin/ssh 172.17.0.123 -l foo -p 22 -i /home/gthreepw/.ssh/id_rsa4096_private.1594384739 -i</span>
+<span class="s2">/home/keykeeper/keyagroup/id_ed25519_agroup.1607524914 -o PreferredAuthentications=publickey&quot;</span> <span class="nv">sysret</span><span class="o">=</span><span class="s2">&quot;0&quot;</span>
+<span class="nv">signal</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">comment_close</span><span class="o">=</span><span class="s2">&quot;hostkey_changed passauth_disabled&quot;</span> <span class="nv">duration</span><span class="o">=</span><span class="s2">&quot;43.692&quot;</span>
+</pre></div>
+</div>
+<p>All the fields from the corresponding <code class="docutils literal notranslate"><span class="pre">open</span></code> log are repeated in this log line, in addition to the following fields:</p>
+<dl class="simple">
+<dt>sysret</dt><dd><p>Return code of the launched system command (that established the egress connection)
+or the plugin (if an <code class="docutils literal notranslate"><span class="pre">--osh</span></code> command was passed).
+If we don't have a return code, for example because we were interrupted by a signal, the value will be empty.</p>
+</dd>
+<dt>signal</dt><dd><p>Name of the UNIX signal that terminated the command, if any. For example &quot;HUP&quot; or &quot;SEGV&quot;.
+If we got no signal, the value will be empty.</p>
+</dd>
+<dt>comment_close</dt><dd><p>A space-separated list of messages giving some hints gathered at the end of a session.
+For example <cite>hostkey_changed passauth_disabled</cite> means that we detected that our egress ssh client
+emitted a warning telling us that the remote keys changed, and also that password authentication has been disabled.</p>
+</dd>
+<dt>duration</dt><dd><p>Amount of seconds (with a millisecond precision) between the session open and the session close.</p>
+</dd>
+</dl>
+</section>
+<section id="warn-die">
+<span id="log-warn"></span><h3><a class="toc-backref" href="#id6">warn, die</a><a class="headerlink" href="#warn-die" title="Permalink to this headline"></a></h3>
+<p>These logs are produced when Perl emits a warning (using the <code class="docutils literal notranslate"><span class="pre">warn()</span></code> call),
+or respectively when Perl halts abruptly due to a <code class="docutils literal notranslate"><span class="pre">die()</span></code> call.
+This should not happen during nominal use. You might want to keep a look on those messages if they're produced.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: warn <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;a46e51b5dce4&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.02&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;3308212&quot;</span> <span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;3308206&quot;</span>
+<span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;99994&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;99994&quot;</span> <span class="nv">msg</span><span class="o">=</span><span class="s2">&quot;Cannot find termcap: TERM not set at</span>
+<span class="s2">/usr/share/perl/5.28/Term/ReadLine.pm line 379.  &quot;</span> <span class="nv">program</span><span class="o">=</span><span class="s2">&quot;/opt/bastion/bin/shell/osh.pl&quot;</span> <span class="nv">cmdline</span><span class="o">=</span><span class="s2">&quot;-c^-i ssh</span>
+<span class="s2">root@172.17.0.222 id&quot;</span> <span class="nv">trace</span><span class="o">=</span><span class="s2">&quot; at /opt/bastion/bin/shell/../../lib/perl/OVH/Bastion.pm</span>
+<span class="s2">line 41.   OVH::Bastion::__ANON__(\&quot;Cannot find termcap: TERM not set at /usr/share/perl/5.28/Ter\&quot;...)</span>
+<span class="s2">called at /usr/share/perl/5.28/Term/ReadLine.pm line</span>
+<span class="s2">391     Term::ReadLine::TermCap::ornaments(Term::ReadLine::Stub=ARRAY(0x5575da36b690), 1) called at</span>
+<span class="s2">/opt/bastion/lib/perl/OVH/Bastion/interactive.inc line 77   OVH::Bastion::interactive(\&quot;realOptions\&quot;, \&quot;-i ssh</span>
+<span class="s2">root\\@172.17.0.222 id\&quot;..., \&quot;timeoutHandler\&quot;, CODE(0x5575da15aa78), \&quot;self\&quot;, \&quot;lechuck\&quot;)</span>
+<span class="s2">called at /opt/bastion/bin/shell/osh.pl line 485 &quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>msg</dt><dd><p>This is the message used as a parameter to the <code class="docutils literal notranslate"><span class="pre">warn()</span></code> or <code class="docutils literal notranslate"><span class="pre">die()</span></code> call</p>
+</dd>
+<dt>program</dt><dd><p>Contains the name of the currently running program (first parameter of <code class="docutils literal notranslate"><span class="pre">execve()</span></code>)</p>
+</dd>
+<dt>cmdline</dt><dd><p>Contains the full command line passed to the currently running program (remaining parameters of <code class="docutils literal notranslate"><span class="pre">execve()</span></code>).
+The command-line fields are separated by <code class="docutils literal notranslate"><span class="pre">^</span></code>'s.</p>
+</dd>
+<dt>trace</dt><dd><p>The call trace leading to this <code class="docutils literal notranslate"><span class="pre">warn()</span></code> or <code class="docutils literal notranslate"><span class="pre">die()</span></code></p>
+</dd>
+</dl>
+</section>
+<section id="warn-info-die-info">
+<span id="log-warninfo"></span><h3><a class="toc-backref" href="#id7">warn-info, die-info</a><a class="headerlink" href="#warn-info-die-info" title="Permalink to this headline"></a></h3>
+<p>These logs are produced when some known portion of code (including libraries) called <code class="docutils literal notranslate"><span class="pre">warn()</span></code> or <code class="docutils literal notranslate"><span class="pre">die()</span></code>
+but in a known case that can happen during nominal use.
+Don't use these logs to directly trigger an alert, but you can keep an eye on those, as e.g. an unusually
+high number of occurences in a short time may be a weak signal that somebody or something is misbehaving.</p>
+<p>The fields are the same than the ones specified above for <strong>warn</strong> and <strong>die</strong>.</p>
+</section>
+<section id="code-info">
+<span id="log-codeinfo"></span><h3><a class="toc-backref" href="#id8">code-info</a><a class="headerlink" href="#code-info" title="Permalink to this headline"></a></h3>
+<p>These logs are produced when some portion of the code encounters an minor issue that is worth logging,
+to e.g. help debugging an issue or understanding what happened in a specific use-case,
+for example if a user-session ended abruptly.
+These logs are not the result of an error on the bastion configuration and don't mandate immediate admin attention.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">25</span> <span class="m">14</span>:56:11 myhostname bastion: code-info <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;98d2f32b1a2d&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.07.00&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;3708843&quot;</span>
+<span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;3708842&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;8423&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;8423&quot;</span> <span class="nv">msg</span><span class="o">=</span><span class="s2">&quot;execute():</span>
+<span class="s2">error while syswriting(Broken pipe) on stderr, aborting this cycle&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>msg</dt><dd><p>A human-readable text describing the error</p>
+</dd>
+</dl>
+</section>
+<section id="code-warning">
+<span id="log-codewarn"></span><h3><a class="toc-backref" href="#id9">code-warning</a><a class="headerlink" href="#code-warning" title="Permalink to this headline"></a></h3>
+<p>These logs are produced when some portion of the code encounters an unexpected issue or abnormality
+that is worth logging. They'll usually not be emitted due to a bad user interaction, but rather if the bastion
+is misconfigured, or for anything that might need some attention or fixing from the admins.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: code-warning <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;ffee33abd1ba&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.03&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;3709643&quot;</span>
+<span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;3709642&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;8423&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;8423&quot;</span> <span class="nv">msg</span><span class="o">=</span><span class="s2">&quot;Configuration error</span>
+<span class="s2">for plugin selfGenerateEgressKey on the &#39;disabled&#39; key: expected a boolean, casted &#39;no&#39; into false&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>msg</dt><dd><p>A human-readable text describing the error</p>
+</dd>
+</dl>
+</section>
+<section id="acl">
+<span id="log-acl"></span><h3><a class="toc-backref" href="#id10">acl</a><a class="headerlink" href="#acl" title="Permalink to this headline"></a></h3>
+<p>This log is produced when an access control list is modified,
+either personal accesses of an account, or a group servers list.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: acl <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;f25fe71c6635&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.02&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;3116604&quot;</span>
+<span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;3116603&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;keysomegroup&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;10006&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;10057&quot;</span> <span class="nv">action</span><span class="o">=</span><span class="s2">&quot;add&quot;</span>
+<span class="nv">type</span><span class="o">=</span><span class="s2">&quot;group&quot;</span> <span class="nv">group</span><span class="o">=</span><span class="s2">&quot;somegroup&quot;</span> <span class="nv">account</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">user</span><span class="o">=</span><span class="s2">&quot;root&quot;</span> <span class="nv">ip</span><span class="o">=</span><span class="s2">&quot;172.16.2.2&quot;</span> <span class="nv">port</span><span class="o">=</span><span class="s2">&quot;22&quot;</span> <span class="nv">ttl</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">force_key</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">comment</span><span class="o">=</span><span class="s2">&quot;&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>action</dt><dd><p>Will be either <em>add</em> if an access is added, or <em>del</em> if an access is removed</p>
+</dd>
+<dt>type</dt><dd><p>Will be either <em>group</em> if we're modifying a group server list, in which case the <em>group</em> field will be filled,
+or <em>account</em> if we're modifying personal accesses of an account, in which case the <em>account</em> field will be filled</p>
+</dd>
+<dt>group</dt><dd><p>If <strong>type</strong> is <em>group</em>, indicates which group servers list has been modified</p>
+</dd>
+<dt>account</dt><dd><p>If <strong>type</strong> is <em>account</em>, indicates which account personal accesses have been modified</p>
+</dd>
+<dt>user</dt><dd><p>The remote user part of the access we're adding/removing</p>
+</dd>
+<dt>ip</dt><dd><p>The IP or IP block of the access we're adding/removing</p>
+</dd>
+<dt>port</dt><dd><p>The port of the access we're adding/removing</p>
+</dd>
+<dt>ttl</dt><dd><p>If set, represents the TTL after which the access will automatically be removed</p>
+</dd>
+<dt>force_key</dt><dd><p>If set, this contains the fingerprint of the key that'll be used for this access</p>
+</dd>
+<dt>comment</dt><dd><p>Any comment set by the user adding/removing the access</p>
+</dd>
+</dl>
+</section>
+<section id="membership">
+<span id="log-membership"></span><h3><a class="toc-backref" href="#id11">membership</a><a class="headerlink" href="#membership" title="Permalink to this headline"></a></h3>
+<p>This log is produced when one of a group's role list is modified:
+either an owner, member, guest, aclkeeper or gatekeeper.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: membership <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;a00993ec6767&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.02&quot;</span>
+<span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;1072528&quot;</span> <span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;1072497&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;2070&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;2070&quot;</span> <span class="nv">action</span><span class="o">=</span><span class="s2">&quot;add&quot;</span>
+<span class="nv">type</span><span class="o">=</span><span class="s2">&quot;member&quot;</span> <span class="nv">group</span><span class="o">=</span><span class="s2">&quot;monkeys&quot;</span> <span class="nv">account</span><span class="o">=</span><span class="s2">&quot;stan&quot;</span> <span class="nv">self</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">host</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">port</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">ttl</span><span class="o">=</span><span class="s2">&quot;&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>action</dt><dd><p>Either <em>add</em> when an account is added to a group role list, or <em>del</em> when an account is removed</p>
+</dd>
+<dt>type</dt><dd><p>Type of the role list we're modifying, either <em>member</em>, <em>aclkeeper</em>, <em>gatekeeper</em>, <em>guest</em> or <em>owner</em></p>
+</dd>
+<dt>group</dt><dd><p>Group whose one of the role list is being modified</p>
+</dd>
+<dt>account</dt><dd><p>Account being added/removed to/from the group role list</p>
+</dd>
+<dt>self</dt><dd><p>Account performing the change</p>
+</dd>
+<dt>user</dt><dd><p>When <strong>type</strong> is <em>guest</em>, the remote user part of the access we're adding/removing</p>
+</dd>
+<dt>host</dt><dd><p>When <strong>type</strong> is <em>guest</em>, the IP or IP block part of the access we're adding/removing</p>
+</dd>
+<dt>port</dt><dd><p>When <strong>type</strong> is <em>guest</em>, the port of the access we're adding/removing</p>
+</dd>
+<dt>ttl</dt><dd><p>When <strong>type</strong> is <em>guest</em> and <strong>action</strong> is <em>add</em>, if a TTL has been specified for the access, it appears here</p>
+</dd>
+</dl>
+</section>
+<section id="security">
+<span id="log-security"></span><h3><a class="toc-backref" href="#id12">security</a><a class="headerlink" href="#security" title="Permalink to this headline"></a></h3>
+<p>This log is produced when an important security event has occurred, such as when an admin impersonates another user,
+or when a super owner uses his implicit global ownership to modify a group. You might want to watch those closely.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: security <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;601a17b5e5ba&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.03&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;20519&quot;</span>
+<span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;20518&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;2604&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;2604&quot;</span> <span class="nv">type</span><span class="o">=</span><span class="s2">&quot;admin-ssh-as&quot;</span> <span class="nv">account</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span>
+sudo-as<span class="o">=</span><span class="s2">&quot;gthreepw&quot;</span> <span class="nv">plugin</span><span class="o">=</span><span class="s2">&quot;ssh&quot;</span> <span class="nv">params</span><span class="o">=</span><span class="s2">&quot;--user root --host supersecretserver.example.org --port 22&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>type</dt><dd><p>Type of the security event that occurred. Can be:</p>
+<ul class="simple">
+<li><p>admin-ssh-as: an admin impersonated another user to establish an egress connection</p></li>
+<li><p>admin-sudo: an admin impersonated another user and launched an osh plugin on their behalf</p></li>
+<li><p>superowner-override: a super owner used his implicit ownership on all groups to modify a group</p></li>
+</ul>
+</dd>
+<dt>account</dt><dd><p>Account that emitted the security event</p>
+</dd>
+<dt>sudo-as</dt><dd><p>When <strong>type</strong> is <em>admin-ssh-as</em> or <em>admin-sudo</em>, name of the account that was impersonated</p>
+</dd>
+<dt>plugin</dt><dd><p>Name of the osh plugin that was launched</p>
+</dd>
+<dt>params</dt><dd><p>Parameters passed to the plugin, or command line used to establish the egress connection</p>
+</dd>
+</dl>
+</section>
+<section id="group">
+<span id="log-group"></span><h3><a class="toc-backref" href="#id13">group</a><a class="headerlink" href="#group" title="Permalink to this headline"></a></h3>
+<p>This log is produced when a group is created or deleted.
+Note that membership modifications are referenced with the <strong>membership</strong> type instead, see above.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:12:26 myhostname bastion: group <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;56f321fb3e58&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.03&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;1325901&quot;</span>
+<span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;1325900&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;root&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;0&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;0&quot;</span> <span class="nv">action</span><span class="o">=</span><span class="s2">&quot;create&quot;</span> <span class="nv">group</span><span class="o">=</span><span class="s2">&quot;themonkeys&quot;</span>
+<span class="nv">owner</span><span class="o">=</span><span class="s2">&quot;stan&quot;</span> <span class="nv">egress_ssh_key_algorithm</span><span class="o">=</span><span class="s2">&quot;ed25519&quot;</span> <span class="nv">egress_ssh_key_size</span><span class="o">=</span><span class="s2">&quot;256&quot;</span> <span class="nv">egress_ssh_key_encrypted</span><span class="o">=</span><span class="s2">&quot;false&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>action</dt><dd><p>Either <em>create</em> or <em>delete</em>, indicating whether the group has just been created or deleted</p>
+</dd>
+<dt>group</dt><dd><p>The group name being created or deleted</p>
+</dd>
+<dt>owner</dt><dd><p>When <strong>action</strong> is <em>create</em>, the name of the owner of the new group we're creating</p>
+</dd>
+<dt>egress_ssh_key_algorithm, egress_ssh_key_size</dt><dd><p>When <strong>action</strong> is <em>create</em>, the algorithm (and size) used to generate the first pair of SSH keys,
+can be empty if <code class="docutils literal notranslate"><span class="pre">--no-key</span></code> was specified</p>
+</dd>
+<dt>egress_ssh_key_encrypted</dt><dd><p>When <strong>action</strong> is <em>create</em>, if a key was generated,
+will be <em>true</em> if <code class="docutils literal notranslate"><span class="pre">--encrypted</span></code> has been used, <em>false</em> otherwise</p>
+</dd>
+</dl>
+</section>
+<section id="account">
+<span id="log-account"></span><h3><a class="toc-backref" href="#id14">account</a><a class="headerlink" href="#account" title="Permalink to this headline"></a></h3>
+<p>This log is produced when an account is created or deleted.</p>
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">21</span> <span class="m">14</span>:30:26 myhostname bastion: account <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;ee4c91000b75&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.02&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;537253&quot;</span> <span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;537252&quot;</span>
+<span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;root&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;lechuck&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;0&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;0&quot;</span> <span class="nv">action</span><span class="o">=</span><span class="s2">&quot;create&quot;</span> <span class="nv">account</span><span class="o">=</span><span class="s2">&quot;stan&quot;</span> <span class="nv">account_uid</span><span class="o">=</span><span class="s2">&quot;8431&quot;</span>
+<span class="nv">public_key</span><span class="o">=</span><span class="s2">&quot;ssh-rsa AAAAB[...]&quot;</span> <span class="nv">always_active</span><span class="o">=</span><span class="s2">&quot;false&quot;</span> <span class="nv">uid_auto</span><span class="o">=</span><span class="s2">&quot;false&quot;</span> <span class="nv">osh_only</span><span class="o">=</span><span class="s2">&quot;false&quot;</span> <span class="nv">immutable_key</span><span class="o">=</span><span class="s2">&quot;false&quot;</span>
+<span class="nv">comment</span><span class="o">=</span><span class="s2">&quot;CREATED_BY=lechuck BASTION_VERSION=3.01.02 CREATION_TIME=Mon Dec 21 14:30:26 2020</span>
+<span class="s2">CREATION_TIMESTAMP=1608561026 COMMENT=requested_by_the_sword_master_of_melee_island_see_ticket_no_1337&quot;</span>
+</pre></div>
+</div>
+<p>Fields:</p>
+<dl class="simple">
+<dt>action</dt><dd><p>Either <em>create</em> or <em>delete</em>, indicating whether the account has just been created or deleted</p>
+</dd>
+<dt>account</dt><dd><p>The account name being created or deleted</p>
+</dd>
+<dt>account_uid</dt><dd><p>When <strong>action</strong> is <em>create</em>, the UID associated corresponding to the account we're creating</p>
+</dd>
+<dt>public_key</dt><dd><p>When <strong>action</strong> is <em>create</em>, the public key we've generated for the new account</p>
+</dd>
+<dt>always_active, uid_auto, osh_only, immutable_key</dt><dd><p>When <strong>action</strong> is <em>create</em>, <em>true</em> if the corresponding option was specified (<code class="docutils literal notranslate"><span class="pre">--always-active</span></code>,
+<code class="docutils literal notranslate"><span class="pre">--uid-auto</span></code>, <code class="docutils literal notranslate"><span class="pre">--osh-only</span></code> or <code class="docutils literal notranslate"><span class="pre">--immutable-key</span></code>), <em>false</em> otherwise</p>
+</dd>
+<dt>comment</dt><dd><p>When <strong>action</strong> is <em>create</em>, the comment specified at creation if any, with some metadata that'll be stored in
+the account properties (<em>created_by</em>, <em>bastion_version</em>, <em>creation_time</em>, <em>creation_timestamp</em>)</p>
+</dd>
+<dt>tty_group</dt><dd><p>When <strong>action</strong> is <em>delete</em>, the name of the tty group specific to this account that was deleted at the same time</p>
+</dd>
+</dl>
+</section>
+</section>
+<section id="syslog">
+<span id="id1"></span><h2><a class="toc-backref" href="#id15">Syslog</a><a class="headerlink" href="#syslog" title="Permalink to this headline"></a></h2>
+<section id="files-location">
+<h3><a class="toc-backref" href="#id16">Files location</a><a class="headerlink" href="#files-location" title="Permalink to this headline"></a></h3>
+<p>If you use <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code> and installed the provided templates (which is the default if you used
+the <code class="docutils literal notranslate"><span class="pre">--new-install</span></code> option to the install script), you'll have 4 files in your system log directory:</p>
+<dl class="simple">
+<dt>/var/log/bastion/bastion.log</dt><dd><p>This is where all the bastion usage logs will be written. All the above message types can be found in this file.</p>
+</dd>
+<dt>/var/log/bastion/bastion-die.log</dt><dd><p>This is where Perl crashes will be logged, with the message type <code class="docutils literal notranslate"><span class="pre">die</span></code>.
+On a production bastion, this file should normally be empty.</p>
+</dd>
+<dt>/var/log/bastion/bastion-warn.log</dt><dd><p>This is where Perl warnings will be logged, with the message type <code class="docutils literal notranslate"><span class="pre">warning</span></code>.
+On a production bastion, this file should mostly be empty.</p>
+</dd>
+<dt>/var/log/bastion/bastion-scripts.log</dt><dd><p>This is where all the satellite scripts (mostly found in the <code class="docutils literal notranslate"><span class="pre">bin/cron/</span></code> directory) will log their output.</p>
+</dd>
+</dl>
+</section>
+<section id="log-format">
+<h3><a class="toc-backref" href="#id17">Log format</a><a class="headerlink" href="#log-format" title="Permalink to this headline"></a></h3>
+<p>A syslog message will always match the following generic format:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>SYSLOG_TIME SYSLOG_HOST bastion: MSGTYPE <span class="nv">field1</span><span class="o">=</span><span class="s2">&quot;value1&quot;</span> <span class="nv">field2</span><span class="o">=</span><span class="s2">&quot;second value&quot;</span> ...
+</pre></div>
+</div>
+<p>Where SYSLOG_TIME is the usual datetime field added by your local syslog daemon,
+and SYSLOG_HOST the hostname of the local machine.
+The MSGTYPE indicates the message type of the log line (the list of types is further below).
+Then, a possibly long list of fields with quoted values, depending on the MSGTYPE.</p>
+<p>An example follows:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Dec <span class="m">28</span> <span class="m">11</span>:14:23 myhostname bastion: code-warning <span class="nv">uniqid</span><span class="o">=</span><span class="s2">&quot;e192fce7553a&quot;</span> <span class="nv">version</span><span class="o">=</span><span class="s2">&quot;3.01.03&quot;</span>
+<span class="nv">pid</span><span class="o">=</span><span class="s2">&quot;18803&quot;</span> <span class="nv">ppid</span><span class="o">=</span><span class="s2">&quot;18802&quot;</span> <span class="nv">sysuser</span><span class="o">=</span><span class="s2">&quot;gthreepw&quot;</span> <span class="nv">sudo_user</span><span class="o">=</span><span class="s2">&quot;&quot;</span> <span class="nv">uid</span><span class="o">=</span><span class="s2">&quot;99998&quot;</span> <span class="nv">gid</span><span class="o">=</span><span class="s2">&quot;99998&quot;</span>
+<span class="nv">msg</span><span class="o">=</span><span class="s2">&quot;Configuration error: specified adminAccounts &#39;joe&#39; is not a valid account, ignoring&quot;</span>
+</pre></div>
+</div>
+<p>In that case, the MSGTYPE is <code class="docutils literal notranslate"><span class="pre">code-warning</span></code>, and we have a few field/value couples with some metadata of interest,
+followed by a human-readable message, indicated by the <code class="docutils literal notranslate"><span class="pre">msg</span></code> field.</p>
+<p>Only satellite scripts will miss the field/value construction, which will just be replaced by a plain text message.
+These logs are stored in <code class="file docutils literal notranslate"><span class="pre">/var/log/bastion/bastion-scripts.log</span></code> by default.</p>
+</section>
+</section>
+<section id="access-logs">
+<h2><a class="toc-backref" href="#id18">Access logs</a><a class="headerlink" href="#access-logs" title="Permalink to this headline"></a></h2>
+<p>If you don't or can't use <a class="reference internal" href="#syslog"><span class="std std-ref">Syslog</span></a>, the bastion can create and use access log files on its own,
+without relying on a syslog daemon. Note that you can enable both syslog and these access logs, if you want.</p>
+<p>These access logs will only contain <a class="reference internal" href="#log-open"><span class="std std-ref">open</span></a> and <a class="reference internal" href="#log-close"><span class="std std-ref">close</span></a> log types, which can be seen as &quot;access logs&quot;.
+All the other log types, such as <a class="reference internal" href="#log-warn"><span class="std std-ref">warn, die</span></a>, <a class="reference internal" href="#log-membership"><span class="std std-ref">membership</span></a>, etc. are only logged through syslog.</p>
+<p>These logs are enabled through the <a class="reference internal" href="configuration/bastion_conf.html#enableglobalaccesslog"><span class="std std-ref">enableGlobalAccessLog</span></a> and <a class="reference internal" href="configuration/bastion_conf.html#enableaccountaccesslog"><span class="std std-ref">enableAccountAccessLog</span></a> options.</p>
+<dl class="simple">
+<dt>enableGlobalAccessLog</dt><dd><p>When enabled, a single log file will be used, located in <code class="file docutils literal notranslate"><span class="pre">/home/logkeeper/global-log-YYYYMM.log</span></code>.
+There will be one file per month. Note that it can grow quite large if you have a busy bastion.</p>
+</dd>
+<dt>enableAccountAccessLog</dt><dd><p>When enabled, one log file per account will be used, located in <code class="file docutils literal notranslate"><span class="pre">/home/USER/USER-log-YYYYMM.log</span></code>.
+There will be one file per month.</p>
+</dd>
+</dl>
+<p>If both options are enabled, it means that every access log will be logged twice, to two different locations.
+If you also enabled syslog, it's even three times!</p>
+</section>
+<section id="sqlite-logs">
+<h2><a class="toc-backref" href="#id19">SQLite logs</a><a class="headerlink" href="#sqlite-logs" title="Permalink to this headline"></a></h2>
+<p>If you want to store access logs into local sqlite databases, you can enable either <a class="reference internal" href="configuration/bastion_conf.html#enableglobalsqllog"><span class="std std-ref">enableGlobalSqlLog</span></a>,
+<a class="reference internal" href="configuration/bastion_conf.html#enableaccountsqllog"><span class="std std-ref">enableAccountSqlLog</span></a>, or both.</p>
+<dl class="simple">
+<dt>enableGlobalSqlLog</dt><dd><p>When enabled, a global sqlite database will be created in <code class="file docutils literal notranslate"><span class="pre">/home/logkeeper/global-log-YYYYMM.sqlite</span></code>.
+It'll contain one row per access (created at the same time the <a class="reference internal" href="#log-open"><span class="std std-ref">open</span></a> log is emitted).
+The following columns exist: id, timestamp, account, cmdtype, allowed, ipfrom, ipto, portto, user, plugin, uniqid.
+Refer to the <a class="reference internal" href="#log-open"><span class="std std-ref">open</span></a> log description to get the meaning of each column.</p>
+</dd>
+<dt>enableAccountSqlLog</dt><dd><p>When enabled, an sqlite database per account will be created in <code class="file docutils literal notranslate"><span class="pre">/home/USER/USER-log-YYYYMM.sqlite</span></code>.
+It'll contain one row per access (created at the same time the <a class="reference internal" href="#log-open"><span class="std std-ref">open</span></a> log is emitted),
+and the same row will be updated by the <a class="reference internal" href="#log-close"><span class="std std-ref">close</span></a> event when it is emitted. The following columns exist:
+id, timestamp, timestampusec, account, cmdtype, allowed, hostfrom, ipfrom, bastionip, bastionport, hostto,
+ipto, portto, user, plugin, ttyrecfilee, params, timestampend, timestampendusec, returnvalue, comment, uniqid.
+Refer to the <a class="reference internal" href="#log-open"><span class="std std-ref">open</span></a> log and <a class="reference internal" href="#log-close"><span class="std std-ref">close</span></a> log descriptions to get the meaning of each column.
+Note that the <a class="reference internal" href="configuration/bastion_conf.html#enableaccountsqllog"><span class="std std-ref">enableAccountSqlLog</span></a> option is required if you want the <a class="reference internal" href="../plugins/open/selfListSessions.html"><span class="doc">selfListSessions</span></a>
+and <a class="reference internal" href="../plugins/open/selfPlaySession.html"><span class="doc">selfPlaySession</span></a> plugins to work, as they use this database.</p>
+</dd>
+</dl>
+<p>Note that enabling these on a very busy bastion (several new connections per second) can create lock contention,
+especially on the global log: ensure you have a fast storage. In any case, if a connection can't get the lock after
+a few seconds, it'll proceed anyway, and skip writing the sql log. In that case, if you enabled syslog or
+local access logs, the <strong>globalsql</strong> and/or the <strong>accountsql</strong> field will contain the error detail.</p>
+</section>
+<section id="terminal-recordings-ttyrec">
+<h2><a class="toc-backref" href="#id20">Terminal recordings (<em>ttyrec</em>)</a><a class="headerlink" href="#terminal-recordings-ttyrec" title="Permalink to this headline"></a></h2>
+<p>Every egress connection is started under <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code>, which means that everything appearing on the console is recorded.
+If a password is asked by some program, for example, and typing the password prints '*' or doesn't print
+anything at all, this won't be recorded. This is by design. In other words, the keystrokes are not recorded,
+except if they produce something on the screen.</p>
+<p>The ttyrec files location is always <code class="file docutils literal notranslate"><span class="pre">/home/USER/ttyrec/REMOTEIP/file.ttyrec</span></code>, where the actual <cite>file.ttyrec</cite>
+name can be configured by the <a class="reference internal" href="configuration/bastion_conf.html#ttyrecfilenameformat"><span class="std std-ref">ttyrecFilenameFormat</span></a> option.
+By default, it'll contain the date, time, account, remote ip, port and user used to start the egress connection,
+as well as the uniqid, for easier correlation between all the logs produced by the same connection.
+Note that for long connections, or connections producing a lot of output, ttyrec files will be transparently rotated,
+without interrupting the connection.
+This is to avoid ending up with ttyrec files of several gigabytes that would still be opened, written to,
+hence impossible to compress, encrypt, and push to an escrow filer.
+The uniqid will be the same for all the ttyrec files corresponding to the same connection.</p>
+<p>To play ttyrec files, you can either use <a class="reference internal" href="../plugins/open/selfPlaySession.html"><span class="doc">selfPlaySession</span></a> for yourself, or,
+for admins having local access to the bastion machine, the <code class="docutils literal notranslate"><span class="pre">ttyplay</span></code> program can be used.
+Another software, perhaps more powerful than ttyplay, can also be used:
+<a class="reference external" href="https://www.chiark.greenend.org.uk/~sgtatham/ipbt/">IPBT</a> (<a class="reference external" href="https://nethackwiki.com/wiki/IPBT">wiki</a>),
+aka &quot;It's PlayBack Time&quot;, by the PuTTY author.
+It can do more advanced things such as look for words appearing on any frame recorded in the ttyrec file,
+play files using a logarithmic speed, or display an OSD with the exact time output you're seeing has appeared.
+As ttyrec is a well-known format that has been around for a while,
+there are a bunch of other programs you can use to read or convert these files.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="configuration/osh-orphaned-homedir_conf.html" class="btn btn-neutral float-left" title="osh-orphaned-homedir.conf" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="mfa.html" class="btn btn-neutral float-right" title="Multi-Factor Authentication" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/mfa.html b/administration/mfa.html
new file mode 100644
index 000000000..566e8a163
--- /dev/null
+++ b/administration/mfa.html
@@ -0,0 +1,586 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Multi-Factor Authentication &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Security Advisories" href="security_advisories.html" />
+    <link rel="prev" title="Logs" href="logs.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="logs.html">Logs</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Multi-Factor Authentication</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#introduction">Introduction</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#flavors">Flavors</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#supported-additional-factors">Supported additional factors</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#immediate-mfa">Immediate MFA</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#detailed-explanation-of-the-ssh-server-and-pam-configuration">Detailed explanation of the SSH server and PAM configuration</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#sshd-config-snippet">sshd_config snippet</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#pam-ssh-snippet">PAM ssh snippet</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="#how-to-use-immediate-mfa">How to use Immediate MFA</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#requiring-all-users-to-setup-their-mfa">Requiring all users to setup their MFA</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#requiring-only-a-subset-of-users-to-setup-their-mfa">Requiring only a subset of users to setup their MFA</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#jit-mfa">JIT MFA</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#proper-setup-of-sshd-config">Proper setup of sshd_config</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#on-a-per-plugin-basis">On a per-plugin basis</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#on-a-per-group-basis">On a per-group basis</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#on-a-per-account-basis">On a per-account basis</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#bypassing-mfa-for-automated-workflows">Bypassing MFA for automated workflows</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#additional-information">Additional information</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#mfa-and-interactive-mode">MFA and interactive mode</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#mfa-and-osh-batch">MFA and --osh batch</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Multi-Factor Authentication</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/administration/mfa.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="multi-factor-authentication">
+<h1><a class="toc-backref" href="#id2">Multi-Factor Authentication</a><a class="headerlink" href="#multi-factor-authentication" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#multi-factor-authentication" id="id2">Multi-Factor Authentication</a></p>
+<ul>
+<li><p><a class="reference internal" href="#introduction" id="id3">Introduction</a></p>
+<ul>
+<li><p><a class="reference internal" href="#flavors" id="id4">Flavors</a></p></li>
+<li><p><a class="reference internal" href="#supported-additional-factors" id="id5">Supported additional factors</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#immediate-mfa" id="id6">Immediate MFA</a></p>
+<ul>
+<li><p><a class="reference internal" href="#detailed-explanation-of-the-ssh-server-and-pam-configuration" id="id7">Detailed explanation of the SSH server and PAM configuration</a></p>
+<ul>
+<li><p><a class="reference internal" href="#sshd-config-snippet" id="id8">sshd_config snippet</a></p></li>
+<li><p><a class="reference internal" href="#pam-ssh-snippet" id="id9">PAM ssh snippet</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#how-to-use-immediate-mfa" id="id10">How to use Immediate MFA</a></p>
+<ul>
+<li><p><a class="reference internal" href="#requiring-all-users-to-setup-their-mfa" id="id11">Requiring all users to setup their MFA</a></p></li>
+<li><p><a class="reference internal" href="#requiring-only-a-subset-of-users-to-setup-their-mfa" id="id12">Requiring only a subset of users to setup their MFA</a></p></li>
+</ul>
+</li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#jit-mfa" id="id13">JIT MFA</a></p>
+<ul>
+<li><p><a class="reference internal" href="#proper-setup-of-sshd-config" id="id14">Proper setup of sshd_config</a></p></li>
+<li><p><a class="reference internal" href="#on-a-per-plugin-basis" id="id15">On a per-plugin basis</a></p></li>
+<li><p><a class="reference internal" href="#on-a-per-group-basis" id="id16">On a per-group basis</a></p></li>
+<li><p><a class="reference internal" href="#on-a-per-account-basis" id="id17">On a per-account basis</a></p></li>
+<li><p><a class="reference internal" href="#bypassing-mfa-for-automated-workflows" id="id18">Bypassing MFA for automated workflows</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#additional-information" id="id19">Additional information</a></p>
+<ul>
+<li><p><a class="reference internal" href="#mfa-and-interactive-mode" id="id20">MFA and interactive mode</a></p></li>
+<li><p><a class="reference internal" href="#mfa-and-osh-batch" id="id21">MFA and --osh batch</a></p></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</div>
+<section id="introduction">
+<h2><a class="toc-backref" href="#id3">Introduction</a><a class="headerlink" href="#introduction" title="Permalink to this headline"></a></h2>
+<section id="flavors">
+<h3><a class="toc-backref" href="#id4">Flavors</a><a class="headerlink" href="#flavors" title="Permalink to this headline"></a></h3>
+<p>The Bastion supports two flavors of Multi-Factor Authentication (MFA, sometimes called 2FA):</p>
+<ul class="simple">
+<li><p><cite>Immediate MFA</cite>, mandatory on a per-account basis during the SSH authentication phase on the ingress side,
+done by the system even before executing the bastion code, regardless of which actions (plugin calls,
+remote connection, ...) are to be done by the account currently being authenticated</p></li>
+<li><p><cite>JIT MFA</cite>, done after the authentication phase, by the bastion code, conditionally (<em>just-in-time</em>), when
+an action that is about to be done requires it by (configurable) policy</p></li>
+</ul>
+<p>Each of these methods and their differences are detailed below, so you can choose the one that fits your environment.</p>
+</section>
+<section id="supported-additional-factors">
+<h3><a class="toc-backref" href="#id5">Supported additional factors</a><a class="headerlink" href="#supported-additional-factors" title="Permalink to this headline"></a></h3>
+<p>The first factor is always the SSH publickey. Two additional factors are supported:</p>
+<ul class="simple">
+<li><p><cite>password</cite>, in which case a password is attached to the account. This password's policy is configurable through
+<a class="reference internal" href="configuration/bastion_conf.html#mfapasswordmindays"><span class="std std-ref">MFAPasswordMinDays</span></a>,
+<a class="reference internal" href="configuration/bastion_conf.html#mfapasswordmaxdays"><span class="std std-ref">MFAPasswordMaxDays</span></a>,
+<a class="reference internal" href="configuration/bastion_conf.html#mfapasswordwarndays"><span class="std std-ref">MFAPasswordWarnDays</span></a>,
+<a class="reference internal" href="configuration/bastion_conf.html#mfapasswordinactivedays"><span class="std std-ref">MFAPasswordInactiveDays</span></a>.</p></li>
+<li><p><cite>TOTP</cite>, aka &quot;Time-based One-Time Password&quot;, which requires a smartphone app and generates a new pin-code every
+60 seconds.</p></li>
+</ul>
+</section>
+</section>
+<section id="immediate-mfa">
+<h2><a class="toc-backref" href="#id6">Immediate MFA</a><a class="headerlink" href="#immediate-mfa" title="Permalink to this headline"></a></h2>
+<p>This method implements MFA directly using PAM during the initial SSH authentication phase, on the ingress
+side, e.g. when accounts are connecting to the bastion. This entirely resides on SSH/PAM and doesn't even depend
+on The Bastion code (appart from the setup side of the additional factor for each account).</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>Use this method if you want to enable MFA for some or all accounts unconditionally, regardless of which action
+they're about to conduct on The Bastion (i.e. use an <code class="docutils literal notranslate"><span class="pre">--osh</span></code> command, or attempt to connect somewhere,
+or just display the help). If you want to enable MFA only for some precise <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands or some remote hosts,
+you'll want to use <a class="reference internal" href="#jit-mfa"><span class="std std-ref">JIT MFA</span></a> instead.</p>
+</div>
+<p>This method requires proper configuration of both the SSH server, and PAM. The included templates of
+<code class="file docutils literal notranslate"><span class="pre">/etc/ssh/sshd_config</span></code> and <code class="file docutils literal notranslate"><span class="pre">/etc/pam.d/ssh</span></code> files do support it out of the box.</p>
+<section id="detailed-explanation-of-the-ssh-server-and-pam-configuration">
+<h3><a class="toc-backref" href="#id7">Detailed explanation of the SSH server and PAM configuration</a><a class="headerlink" href="#detailed-explanation-of-the-ssh-server-and-pam-configuration" title="Permalink to this headline"></a></h3>
+<p>This works by modifying the <code class="docutils literal notranslate"><span class="pre">AuthenticationMethods</span></code> in <code class="file docutils literal notranslate"><span class="pre">sshd_config</span></code> to add <code class="docutils literal notranslate"><span class="pre">keyboard-interactive:pam</span></code>,
+which instructs the SSH server to rely on PAM for part of the authentication phase. Then, the PAM file defines
+several authentications methods, which include several factors that can be configured per-account.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>You can skip this subsection if you're not interested in how this works exactly, but mainly want to know how
+to setup MFA. If you're using the included <code class="file docutils literal notranslate"><span class="pre">sshd_config</span></code> and <code class="file docutils literal notranslate"><span class="pre">pam.d/ssh</span></code> templates unmodified,
+which you are if you've followed the installation section, this will just work out of the box so you may skip
+over the details and jump to <a class="reference internal" href="#immediate-mfa-howto"><span class="std std-ref">How to use Immediate MFA</span></a>.</p>
+</div>
+<section id="sshd-config-snippet">
+<h4><a class="toc-backref" href="#id8">sshd_config snippet</a><a class="headerlink" href="#sshd-config-snippet" title="Permalink to this headline"></a></h4>
+<p>Let's take the last few lines of the <code class="file docutils literal notranslate"><span class="pre">ssh_config</span></code> file and explain them step by step. These are where the
+MFA logic is implemented. We've left the comments that can be found in the template, for clarity.</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># If 2FA has been configured for root, we force pubkey+PAM for it. If this is the case</span>
+<span class="c1"># on your system, uncomment the next two lines (see</span>
+<span class="c1"># https://ovh.github.io/the-bastion/installation/advanced.html#fa-root-authentication)</span>
+<span class="c1">#Match User root</span>
+<span class="c1">#    AuthenticationMethods publickey,keyboard-interactive:pam</span>
+</pre></div>
+</div>
+<p>As explained in the comments within the file, this section (commented by default) refers to the MFA that can be
+configured on the <code class="docutils literal notranslate"><span class="pre">root</span></code> account to protect The Bastion's own system. This is out of the scope of this documenation
+section, as we're focusing on the users MFA here, so refer to the <a class="reference internal" href="../installation/advanced.html#fa-root-authentication"><span class="std std-ref">2FA root authentication</span></a>
+section if that's what you want to achieve.</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># Unconditionally skip PAM auth for members of the bastion-nopam group</span>
+Match Group bastion-nopam
+    AuthenticationMethods publickey
+</pre></div>
+</div>
+<p>The snipper above tells the SSH server to NOT rely on PAM (hence disable MFA) for accounts that are part of the
+<code class="docutils literal notranslate"><span class="pre">bastion-nopam</span></code> group. This is an internal group that is used for accounts whose MFA setup has been set to
+bypass PAM authentication, with the following command:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh accountModify --account robot-sync --pam-auth-bypass yes
+</span>╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ modify the configuration of an account
+├───────────────────────────────────────────────────────────────────────────────
+│ Bypassing sshd PAM auth usage for this account...
+│ ... done, this account will no longer use PAM for authentication
+╰────────────────────────────────────────────────────────────&lt;/accountModify&gt;───
+</pre></div>
+</div>
+<p>This way, the account <code class="docutils literal notranslate"><span class="pre">robot-sync</span></code> will fall into the above configuration section <code class="docutils literal notranslate"><span class="pre">Match</span></code> case and end up
+only using classic <code class="docutils literal notranslate"><span class="pre">publickey</span></code> authentication, hence no MFA. As MFA is only meaningful for humans, use this setting
+for accounts that are used by any automated process you might have that interact with the bastion (for example using
+its <a class="reference internal" href="../using/api.html"><span class="doc">JSON API</span></a>).</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># if in one of the mfa groups AND the osh-pubkey-auth-optional group, use publickey+pam OR pam</span>
+Match Group mfa-totp-configd,mfa-password-configd Group osh-pubkey-auth-optional
+    AuthenticationMethods publickey,keyboard-interactive:pam keyboard-interactive:pam
+</pre></div>
+</div>
+<p>The snippet above tells SSH that for accounts having an authentication factor configured, namely either a TOTP or
+a password, and having the &quot;public key is optional&quot; flag, set by <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">accountModify</span> <span class="pre">--pubkey-auth-optional</span></code>,
+implies that those accounts can either authenticate through public key and an additional factor (through PAM),
+or through PAM only. In essence these accounts may use only a password, or a TOTP, or both, without having a
+public key in addition to the other factors. Hence, this is not MFA per-se, but is an additional functionaly available
+should you need this in your environment. You may remove (or comment) the two lines above if you're confident you'll
+never require the <cite>pubkey-auth-optional</cite> feature.</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># if in one of the mfa groups, use publickey AND pam</span>
+Match Group mfa-totp-configd,mfa-password-configd
+    AuthenticationMethods publickey,keyboard-interactive:pam
+</pre></div>
+</div>
+<p>The snippet above is the core of the mandatory MFA configuration of the SSH server: it instructs the SSH server to
+authenticate accounts that have at least one MFA factor configured with their public key first, then hand over the
+authentication phase to PAM to check the additional factors.</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># by default, always ask the publickey (no PAM)</span>
+Match All
+    AuthenticationMethods publickey
+</pre></div>
+</div>
+<p>Finally, the snippet above is for the general case, i.e. accounts not having MFA configured, in which case they're
+authenticated using their public key only.</p>
+</section>
+<section id="pam-ssh-snippet">
+<h4><a class="toc-backref" href="#id9">PAM ssh snippet</a><a class="headerlink" href="#pam-ssh-snippet" title="Permalink to this headline"></a></h4>
+<p>The template is <cite>heavily commented&lt;https://github.com/ovh/the-bastion/blob/master/etc/pam.d/sshd.debian12&gt;</cite>, line by line, please have a look at it if you want to know more.</p>
+</section>
+</section>
+<section id="how-to-use-immediate-mfa">
+<span id="immediate-mfa-howto"></span><h3><a class="toc-backref" href="#id10">How to use Immediate MFA</a><a class="headerlink" href="#how-to-use-immediate-mfa" title="Permalink to this headline"></a></h3>
+<p>If you want to setup immediate MFA, you'll need to setup the SSH server and PAM configurations correctly, as explained
+above. If you installed the provided templates for both (which is the default), you're good to go.</p>
+<p>You may want either to enable MFA for <em>all</em> the accounts existing on your bastion, or only a subset of these users,
+read on the proper section below for each case.</p>
+<section id="requiring-all-users-to-setup-their-mfa">
+<h4><a class="toc-backref" href="#id11">Requiring all users to setup their MFA</a><a class="headerlink" href="#requiring-all-users-to-setup-their-mfa" title="Permalink to this headline"></a></h4>
+<p>To ensure no user can use their account without configuring their MFA first, you have to set the <code class="docutils literal notranslate"><span class="pre">accountMFAPolicy</span></code>
+option of <code class="file docutils literal notranslate"><span class="pre">bastion.conf</span></code> to either <code class="docutils literal notranslate"><span class="pre">any-required</span></code>, <code class="docutils literal notranslate"><span class="pre">totp-required</span></code> or <code class="docutils literal notranslate"><span class="pre">password-required</span></code>. Detailed
+information about this configuration setting is available
+<a class="reference internal" href="configuration/bastion_conf.html#accountmfapolicy"><span class="std std-ref">here</span></a>.</p>
+<p>When this setting is configured to any of the 3 above values, no interaction will be allowed on the bastion (such as
+using plugins or connecting to a remote asset) as long as the user didn't set up their MFA:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>bssh --osh selfListAccesses
+│
+│ ⛔ Sorry johndoe, but you need to setup the Multi-Factor Authentication before using this bastion, please use either the `--osh selfMFASetupPassword&#39; or the `--osh selfMFASetupTOTP&#39; option, at your discretion, to do so
+</pre></div>
+</div>
+<p>The only allowed <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands allowed in such a case are <code class="docutils literal notranslate"><span class="pre">help</span></code>, <code class="docutils literal notranslate"><span class="pre">info</span></code> and the two ones referenced in the
+above error message, precisely to be able to setup the MFA on the account.</p>
+<p>In this mode, if you want to exclude a few accounts from requiring MFA (if you have accounts that are used by
+automation or any other M2M workflow), you can do so using <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--pam-auth-bypass</span> <span class="pre">yes</span></code>.</p>
+</section>
+<section id="requiring-only-a-subset-of-users-to-setup-their-mfa">
+<span id="immediate-mfa-subset-users"></span><h4><a class="toc-backref" href="#id12">Requiring only a subset of users to setup their MFA</a><a class="headerlink" href="#requiring-only-a-subset-of-users-to-setup-their-mfa" title="Permalink to this headline"></a></h4>
+<p>If instead of forcing all users to require MFA, you want to require a precise subset of users to have MFA, you should
+leave the <code class="docutils literal notranslate"><span class="pre">accountMFAPolicy</span></code> to <code class="docutils literal notranslate"><span class="pre">enabled</span></code>, and set the requirement flag on a per-account basis. This can be
+done using <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--mfa-password-required</span> <span class="pre">yes</span></code> and/or <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--mfa-totp-required</span> <span class="pre">yes</span></code>. If you
+set both flags on the same account, the bastion will require both factors to be set and provided on authentication,
+in addition to publickey authentication. In this case, 3 authentication factors would be required. This is why we
+call it <em>MFA</em> instead of <em>2FA</em>: the number of additional factors you want is configurable.</p>
+</section>
+</section>
+</section>
+<section id="jit-mfa">
+<span id="id1"></span><h2><a class="toc-backref" href="#id13">JIT MFA</a><a class="headerlink" href="#jit-mfa" title="Permalink to this headline"></a></h2>
+<p>This method implements MFA checking right before an action is allowed, depending on the bastion policy, instead of
+requiring it at the ingress authentication stage.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>Use this method if you want to enable MFA on a per-action basis. In this case, The Bastion will decide whether
+providing additional authentication factors is required right before a specific action is requested (such as
+connection to a given remote asset, or execution of a subset of <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands).
+You may also want to use this method if for some reason you can't setup the <code class="file docutils literal notranslate"><span class="pre">sshd_config</span></code> file
+as required by the <em>Immediate MFA</em> method</p>
+</div>
+<p>Note that the different ways detailed below can be cumulated: you might want to enable MFA for a few plugins, along
+with enabling it for sensitive remote hosts present in specific bastion groups, in addition to a few sensitive
+accounts that would require it no matter what.</p>
+<section id="proper-setup-of-sshd-config">
+<span id="jit-mfa-sshd-config"></span><h3><a class="toc-backref" href="#id14">Proper setup of sshd_config</a><a class="headerlink" href="#proper-setup-of-sshd-config" title="Permalink to this headline"></a></h3>
+<p>To use <cite>JIT MFA</cite>, your first have to disable <cite>Immediate MFA</cite>, as is the default if you're using the provided
+configuration template for your SSH server (which you are if you followed the default installation steps).
+You'll need to comment out two lines within the <code class="file docutils literal notranslate"><span class="pre">/etc/ssh/sshd_config</span></code> file, these are located near the
+end of the file:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># if in one of the mfa groups, use publickey AND pam</span>
+<span class="c1">#Match Group mfa-totp-configd,mfa-password-configd</span>
+<span class="c1">#    AuthenticationMethods publickey,keyboard-interactive:pam</span>
+</pre></div>
+</div>
+<p>You'll need to reload the SSH daemon for this to be taken into account. The next subsections explain how to setup
+policies depending on the actions you want to protect through <cite>JIT MFA</cite>.</p>
+</section>
+<section id="on-a-per-plugin-basis">
+<h3><a class="toc-backref" href="#id15">On a per-plugin basis</a><a class="headerlink" href="#on-a-per-plugin-basis" title="Permalink to this headline"></a></h3>
+<p>First ensure you've followed the <a class="reference internal" href="#jit-mfa-sshd-config"><span class="std std-ref">Proper setup of sshd_config</span></a>.</p>
+<p>To force MFA for a plugin, you may add the <code class="docutils literal notranslate"><span class="pre">mfa_required</span></code> option to its configuration. This configuration parameter
+allows 4 values:</p>
+<ul class="simple">
+<li><p><cite>any</cite>, in which case MFA is required with any supported factor (currently either password or TOTP)</p></li>
+<li><p><cite>password</cite>, in which case a password is required in addition to publickey authentication</p></li>
+<li><p><cite>totp</cite>, in which case a TOTP is required in addition to publickey authentication</p></li>
+<li><p><cite>none</cite>, in which case no MFA is required (which is the default if the <code class="docutils literal notranslate"><span class="pre">mfa_required</span></code> setting is omitted)</p></li>
+</ul>
+<p>To enable MFA for the <code class="docutils literal notranslate"><span class="pre">adminSudo</span></code> plugin, for example, you may add:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="o">{</span>
+   <span class="s2">&quot;mfa_required&quot;</span>: <span class="s2">&quot;any&quot;</span>
+<span class="o">}</span>
+</pre></div>
+</div>
+<p>to the <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.adminSudo.conf</span></code> file. Please ensure that this file is readable by the
+<code class="docutils literal notranslate"><span class="pre">bastion-users</span></code> system group (as all <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.*.conf</span></code> files should be), so that the code running
+under the bastion users permissions can read it.</p>
+<p>When configured like this, usage of the adminSudo plugin, in our example, will trigger the validation of additional
+authentication factors.
+Note that for this to work, you must have the <code class="file docutils literal notranslate"><span class="pre">/etc/pam.d/ssh</span></code> file set up correctly,
+as we're using PAM for this. The provided template is advised, and you're already using it if you followed the
+default installation steps.
+If you are not sure you're using the provided template, you may compare your current <code class="file docutils literal notranslate"><span class="pre">/etc/pam.d/ssh</span></code> file
+with the proper template for your distro, which can be found in <code class="file docutils literal notranslate"><span class="pre">/opt/bastion/etc/pam.d/sshd.*</span></code>.</p>
+<p>As you see, the MFA phase will be fired up for this plugin, but not for the <code class="docutils literal notranslate"><span class="pre">info</span></code> plugin for example:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh adminSudo
+</span>As this is required to run this plugin, entering MFA phase for johndoe.
+Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+Your password expires on 2023/10/31, in 89 days
+Password: ^C
+
+<span class="hll">bssh --osh info
+</span>╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ information
+├───────────────────────────────────────────────────────────────────────────────
+│ You are johndoe
+[...]
+</pre></div>
+</div>
+</section>
+<section id="on-a-per-group-basis">
+<h3><a class="toc-backref" href="#id16">On a per-group basis</a><a class="headerlink" href="#on-a-per-group-basis" title="Permalink to this headline"></a></h3>
+<p>First ensure you've followed the <a class="reference internal" href="#jit-mfa-sshd-config"><span class="std std-ref">Proper setup of sshd_config</span></a>.</p>
+<p>If you want to ensure that MFA is required to connect to a remote host through a bastion group,
+you should tag this group to require MFA. To do this, use the <code class="docutils literal notranslate"><span class="pre">groupModify</span></code> command:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">guybrush@bastion1(master)&gt; groupModify --group securegroup --mfa-required any
+</span>╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ modify the configuration of a group
+├───────────────────────────────────────────────────────────────────────────────
+│ Modifying mfa-required policy of group...
+│ ... done, policy is now: any
+╰──────────────────────────────────────────────────────────────&lt;/groupModify&gt;───
+
+<span class="hll">guybrush@bastion1(master)&gt; groupInfo --group securegroup
+</span>╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ group info
+├───────────────────────────────────────────────────────────────────────────────
+│ Group securegroup&#39;s Owners are: guybrush
+[...]
+│ ❗ MFA Required: when connecting to servers of this group, users will be asked for an additional authentication factor
+[...]
+
+<span class="hll">guybrush@bastion1(master)&gt; ssh root@127.1.2.3
+</span>│ Welcome to bastion1, guybrush, your last login was 00:00:27 ago (Wed 2023-08-02 15:36:03 UTC) from 172.17.0.1(172.17.0.1)
+[...]
+
+ will try the following accesses you have:
+  - group-member of securegroup with ED25519-256 key SHA256:94yETEnnWUy9yTG1dgAdXgunq6zzJPjlddFXjUH0Czw [2023/03/03]  (MFA REQUIRED: ANY)
+
+As this is required for this host, entering MFA phase for guybrush.
+Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+Your password expires on 2023/10/31, in 89 days
+Password:
+</pre></div>
+</div>
+<p>As you see, after setting the flag on the group, attempting to access an asset that is part of the group (see
+<code class="docutils literal notranslate"><span class="pre">groupListServers</span></code>) will require MFA.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>If an account has access to an asset via several groups, MFA will be required if at least one group requires it.
+Hence, a good way to ensure that all connections to an asset will require MFA would be to list the
+SSH keys on the remote server, match those to groups on the bastion, and ensure they all have <code class="docutils literal notranslate"><span class="pre">--mfa-required</span></code> enabled.</p>
+</div>
+</section>
+<section id="on-a-per-account-basis">
+<h3><a class="toc-backref" href="#id17">On a per-account basis</a><a class="headerlink" href="#on-a-per-account-basis" title="Permalink to this headline"></a></h3>
+<p>You may also use this method to enable MFA on a per-account basis (as is possible with the <cite>Immediate MFA</cite> method).</p>
+<p>To do this, you should follow the same steps than are outlined in the <a class="reference internal" href="#immediate-mfa-subset-users"><span class="std std-ref">Requiring only a subset of users to setup their MFA</span></a> subsection of the <cite>Immediate MFA</cite> setup.</p>
+<p>The only difference will be in your <code class="file docutils literal notranslate"><span class="pre">sshd_config</span></code> file, as for <cite>JIT MFA</cite> your should ensure you've followed the <a class="reference internal" href="#jit-mfa-sshd-config"><span class="std std-ref">Proper setup of sshd_config</span></a>.</p>
+<p>In the case of <cite>Immediate MFA</cite>, the uncommented <code class="file docutils literal notranslate"><span class="pre">sshd_config</span></code> file block asks the SSH server to hand over authentication to PAM, hereby
+requiring MFA at the authentication phase. For the <cite>JIT MFA</cite> on a per-account basis, this configuration is disabled, but the bastion code, after the
+authentication phase is over, verifies whether the account requires to provide additional authentication factors, and triggers a PAM call if this
+is the case.</p>
+</section>
+<section id="bypassing-mfa-for-automated-workflows">
+<h3><a class="toc-backref" href="#id18">Bypassing MFA for automated workflows</a><a class="headerlink" href="#bypassing-mfa-for-automated-workflows" title="Permalink to this headline"></a></h3>
+<p>If you have accounts that are used for automation, you'll want to exclude them from requiring MFA.</p>
+<p>To do this, use <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">accountModify</span> <span class="pre">--mfa-password-required</span> <span class="pre">bypass</span> <span class="pre">--mfa-totp-required</span> <span class="pre">bypass</span></code>. Accounts
+with this setting will no longer require to enter additional credentials even when the policy of <cite>JIT MFA</cite> would
+require them to.</p>
+</section>
+</section>
+<section id="additional-information">
+<h2><a class="toc-backref" href="#id19">Additional information</a><a class="headerlink" href="#additional-information" title="Permalink to this headline"></a></h2>
+<section id="mfa-and-interactive-mode">
+<h3><a class="toc-backref" href="#id20">MFA and interactive mode</a><a class="headerlink" href="#mfa-and-interactive-mode" title="Permalink to this headline"></a></h3>
+<p>When using the interactive mode, and <cite>JIT MFA</cite>, attempting to conduct an action that requires MFA will trigger the MFA authentication phase, as expected.</p>
+<p>However, when multiple MFA-required operations are to be done back to back, as is often the case when interactive mode
+is used, the MFA authentication phase will be triggered for each and every action, which can be cumbersome.</p>
+<p>As long as <a class="reference internal" href="configuration/bastion_conf.html#interactivemodeproactivemfaenabled"><span class="std std-ref">interactiveModeProactiveMFAenabled</span></a> is true, users can use the <strong>mfa</strong> command in interactive
+mode, to trigger the MFA authentication phase proactively, and enter an elevated session that will not require to enter MFA again. This elevated session
+will expire after <a class="reference internal" href="configuration/bastion_conf.html#interactivemodeproactivemfaexpiration"><span class="std std-ref">interactiveModeProactiveMFAexpiration</span></a> seconds (15 minutes by default). Users can exit
+the elevated session manually by typing <strong>nomfa</strong>.</p>
+<p>Here is how it looks like:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh -i
+</span>
+Welcome to bastion1 interactive mode, type `help&#39; for available commands.
+You can use &lt;tab&gt; and &lt;tab&gt;&lt;tab&gt; for autocompletion.
+You&#39;ll be disconnected after 60 seconds of inactivity.
+Loading... 90 commands and 0 autocompletion rules loaded.
+
+<span class="hll">guybrush@bastion1(master)&gt; mfa
+</span>As proactive MFA validation has been requested, entering MFA phase.
+Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+Your password expires on 2023/10/31, in 88 days
+<span class="hll">Password:
+</span>pamtester: successfully authenticated
+Proactive MFA enabled, any command requiring MFA from now on will not ask you again.
+This mode will expire in 00:15:00 (Thu 2023-08-03 12:35:08 UTC)
+To exit this mode manually, type &#39;nomfa&#39;.
+
+<span class="hll">guybrush@bastion1(master)[MFA-OK]&gt; groupAddServer
+</span>╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ adding a server to a group
+├───────────────────────────────────────────────────────────────────────────────
+[...]
+
+<span class="hll">guybrush@bastion1(master)[MFA-OK]&gt; nomfa
+</span>Your proactive MFA validation has been forgotten.
+
+<span class="hll">guybrush@bastion1(master)&gt;
+</span></pre></div>
+</div>
+<p>As you seen, once <code class="docutils literal notranslate"><span class="pre">mfa</span></code> has been entered and the MFA validated, the prompt changes to <code class="docutils literal notranslate"><span class="pre">[MFA-OK]</span></code> implying that
+any command usually requiring MFA will not ask for it again (such as <code class="docutils literal notranslate"><span class="pre">groupAddServer</span></code> in the above example, as
+we've configured it to). We then explicitely exit the MFA elevated session by entering <code class="docutils literal notranslate"><span class="pre">nomfa</span></code>.</p>
+</section>
+<section id="mfa-and-osh-batch">
+<h3><a class="toc-backref" href="#id21">MFA and --osh batch</a><a class="headerlink" href="#mfa-and-osh-batch" title="Permalink to this headline"></a></h3>
+<p>The <a class="reference internal" href="../plugins/open/batch.html"><span class="doc">batch</span></a> plugin is useful to enter several <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands in a batch way. However, if
+any of those commands require MFA, it would ask us repeatedly for our MFA, which can be cumbersome.</p>
+<p>To avoid this behavior, and if you know that some of the commands you want to use in batch more will require MFA,
+you may use the <code class="docutils literal notranslate"><span class="pre">--proactive-mfa</span></code> option to the bastion, which will ask for your MFA <em>before</em> executing the
+<a class="reference internal" href="../plugins/open/batch.html"><span class="doc">batch</span></a> plugin, and any command requiring MFA will not ask for it again:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --proactive-mfa --osh batch
+</span>
+As proactive MFA has been requested, entering MFA phase for guybrush.
+Your account has Multi-Factor Authentication enabled, an additional authentication factor is required (password).
+Your password expires on 2023/11/01, in 89 days
+<span class="hll">Password:
+</span>pamtester: successfully authenticated
+╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ batch
+├───────────────────────────────────────────────────────────────────────────────
+│ Feed me osh commands line by line on stdin, I&#39;ll execute them sequentially.
+│ Use &#39;exit&#39;, &#39;quit&#39; or ^D to stop.
+│ --- waiting for input
+[...]
+</pre></div>
+</div>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="logs.html" class="btn btn-neutral float-left" title="Logs" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="security_advisories.html" class="btn btn-neutral float-right" title="Security Advisories" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/security_advisories.html b/administration/security_advisories.html
new file mode 100644
index 000000000..bd3480523
--- /dev/null
+++ b/administration/security_advisories.html
@@ -0,0 +1,157 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Security Advisories &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="CVE-2023-45140" href="security_advisories/cve_2023_45140.html" />
+    <link rel="prev" title="Multi-Factor Authentication" href="mfa.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Security Advisories</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="security_advisories/cve_2023_45140.html">CVE-2023-45140</a></li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Security Advisories</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/administration/security_advisories.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="security-advisories">
+<h1>Security Advisories<a class="headerlink" href="#security-advisories" title="Permalink to this headline"></a></h1>
+<p>This section contains all the security advisories since The Bastion has been published.</p>
+<p>If you find any behavior or bug that you suspect might have a security impact, please
+<a class="reference external" href="https://github.com/ovh/the-bastion/security">report it here</a>.</p>
+<div class="toctree-wrapper compound">
+<p class="caption" role="heading"><span class="caption-text">CVE List</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="security_advisories/cve_2023_45140.html">CVE-2023-45140</a></li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="mfa.html" class="btn btn-neutral float-left" title="Multi-Factor Authentication" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="security_advisories/cve_2023_45140.html" class="btn btn-neutral float-right" title="CVE-2023-45140" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/administration/security_advisories/cve_2023_45140.html b/administration/security_advisories/cve_2023_45140.html
new file mode 100644
index 000000000..05ca45d26
--- /dev/null
+++ b/administration/security_advisories/cve_2023_45140.html
@@ -0,0 +1,236 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>CVE-2023-45140 &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="Environment setup" href="../../development/setup.html" />
+    <link rel="prev" title="Security Advisories" href="../security_advisories.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../security_advisories.html">Security Advisories</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">CVE-2023-45140</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#summary">Summary</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#details">Details</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#how-to-reproduce-for-group-based-jit-mfa">How to reproduce for group-based JIT MFA</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#how-to-reproduce-for-account-based-jit-mfa">How to reproduce for account-based JIT MFA</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#impact-for-group-based-jit-mfa">Impact for group-based JIT MFA</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#impact-for-account-based-jit-mfa">Impact for account-based JIT MFA</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#mitigation">Mitigation</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#timeline">Timeline</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="../security_advisories.html">Security Advisories</a> &raquo;</li>
+      <li>CVE-2023-45140</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/administration/security_advisories/cve_2023_45140.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="cve-2023-45140">
+<h1>CVE-2023-45140<a class="headerlink" href="#cve-2023-45140" title="Permalink to this headline"></a></h1>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">Severity</span></code>: <strong>4.8</strong> (CVSS V3)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">Vector:</span> <span class="pre">CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N</span></code></p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">Affected</span> <span class="pre">versions</span></code>: from 3.0.0 included to 3.14.15 excluded</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">Patched</span> <span class="pre">versions</span></code>: 3.14.15 and up</p></li>
+</ul>
+<p><a class="reference external" href="https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x">This advisory is also available online</a>.</p>
+<section id="summary">
+<h2>Summary<a class="headerlink" href="#summary" title="Permalink to this headline"></a></h2>
+<p>SCP and SFTP plugins don't honor group-based and account-based JIT MFA.</p>
+</section>
+<section id="details">
+<h2>Details<a class="headerlink" href="#details" title="Permalink to this headline"></a></h2>
+<p>Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to <a class="reference external" href="https://ovh.github.io/the-bastion/administration/mfa.html#on-a-per-group-basis">per-group-based JIT MFA</a> and <a class="reference external" href="https://ovh.github.io/the-bastion/administration/mfa.ht↪·ml#on-a-per-account-basis">JIT MFA on a per-account basis</a>.</p>
+<p>Other MFA setup types, such as <a class="reference external" href="https://ovh.github.io/the-bastion/administration/mfa.html#immediate-mfa">Immediate MFA</a> and <a class="reference external" href="https://ovh.github.io/the-bastion/administration/mfa.html#on-a-per-plugin-basis">JIT MFA on a per-plugin basis</a> are not affected.</p>
+<p>Normal SSH access (i.e. not SCP nor SFTP) is not affected.</p>
+</section>
+<section id="how-to-reproduce-for-group-based-jit-mfa">
+<h2>How to reproduce for group-based JIT MFA<a class="headerlink" href="#how-to-reproduce-for-group-based-jit-mfa" title="Permalink to this headline"></a></h2>
+<ul class="simple">
+<li><p>Create a group</p></li>
+<li><p>Apply <code class="docutils literal notranslate"><span class="pre">groupModify</span> <span class="pre">--mfa-required</span> <span class="pre">any</span></code> to this group</p></li>
+<li><p>Grant SSH access to someone via this group on a given IP</p></li>
+<li><p>Grant <code class="docutils literal notranslate"><span class="pre">scp</span></code> download right (or <code class="docutils literal notranslate"><span class="pre">sftp</span></code> right) to the same person via this group on the same IP</p></li>
+<li><p>This group should now force MFA for any connection of the person allowed through the group's rights set. This is the case for SSH, but not for SCP or SFTP as would be expected.</p></li>
+</ul>
+</section>
+<section id="how-to-reproduce-for-account-based-jit-mfa">
+<h2>How to reproduce for account-based JIT MFA<a class="headerlink" href="#how-to-reproduce-for-account-based-jit-mfa" title="Permalink to this headline"></a></h2>
+<ul class="simple">
+<li><p>Create an account</p></li>
+<li><p>Apply <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--personal-egress-mfa-required</span> <span class="pre">any</span></code> to this account</p></li>
+<li><p>Grant a personal SSH access to this account on a given IP</p></li>
+<li><p>Grant <code class="docutils literal notranslate"><span class="pre">scp</span></code> download right (or <code class="docutils literal notranslate"><span class="pre">sftp</span></code> right) to the same account via their personal access on the same IP</p></li>
+<li><p>This account should now have forced MFA for any egress connection allowed through their personal rights set. This is the case for SSH, but not for SCP or SFTP as would be expected.</p></li>
+</ul>
+</section>
+<section id="impact-for-group-based-jit-mfa">
+<h2>Impact for group-based JIT MFA<a class="headerlink" href="#impact-for-group-based-jit-mfa" title="Permalink to this headline"></a></h2>
+<p>For an actor to be able to bypass MFA for scp/sftp to a given remote server, ALL the following conditions must apply:</p>
+<ul class="simple">
+<li><p>The target server must be part of a group (and have the egress group's public key trusted in its <code class="file docutils literal notranslate"><span class="pre">authorized_keys</span></code> file)</p></li>
+<li><p>The group must have JIT MFA enabled on it (through <code class="docutils literal notranslate"><span class="pre">groupModify</span> <span class="pre">--mfa-required</span> <span class="pre">any</span></code>)</p></li>
+<li><p>The actor must have an account on the bastion</p></li>
+<li><p>The actor must be a member of the group (granted by the groups's gatekeepers)</p></li>
+<li><p>scp and/or sftp must be globally enabled on the bastion (this is the default)</p></li>
+<li><p>scp and/or sftp must be explicitly allowed to the given remote server through the group (granted by the groups's aclkeepers)</p></li>
+</ul>
+<p>When all conditions above apply, the actor would be able to use scp or sftp on the target server without requiring to provide an additional factor where it should.</p>
+</section>
+<section id="impact-for-account-based-jit-mfa">
+<h2>Impact for account-based JIT MFA<a class="headerlink" href="#impact-for-account-based-jit-mfa" title="Permalink to this headline"></a></h2>
+<p>For an actor to be able to bypass MFA for scp/sftp to a given remote server, ALL the following conditions must apply:</p>
+<ul class="simple">
+<li><p>The target server must be part of the actor's account personal accesses (and have the account's egress public key trusted in its <code class="file docutils literal notranslate"><span class="pre">authorized_keys</span></code> file)</p></li>
+<li><p>The account must have JIT MFA enabled on it (through <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--personal-egress-mfa-required</span> <span class="pre">any</span></code>)</p></li>
+<li><p>scp and/or sftp must be globally enabled on the bastion (this is the default)</p></li>
+<li><p>scp and/or sftp must be explicitly allowed to the given remote server through this account's personal accesses (granted by either <code class="docutils literal notranslate"><span class="pre">selfAddPersonalAccess</span></code> or <code class="docutils literal notranslate"><span class="pre">accountAddPersonalAccess</span></code>)</p></li>
+</ul>
+<p>When all conditions above apply, the actor would be able to use scp or sftp on the target server without requiring to provide an additional factor where it should.</p>
+</section>
+<section id="mitigation">
+<h2>Mitigation<a class="headerlink" href="#mitigation" title="Permalink to this headline"></a></h2>
+<p>If you don't use the <a class="reference external" href="https://ovh.github.io/the-bastion/administration/mfa.html#on-a-per-group-basis">per-group-based JIT MFA</a> on any of your groups (through <code class="docutils literal notranslate"><span class="pre">groupModify</span> <span class="pre">--mfa-required</span></code>), and don't use the <a class="reference external" href="https://ovh.gi↪·thub.io/the-bastion/administration/mfa.ht↪·ml#on-a-per-account-basis">JIT MFA on a per-account basis</a> (through <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--personal-egress-mfa-required</span></code>), you don't need to mitigate the issue as you don't use the impacted feature (see above for impact details).</p>
+<p>Otherwise, if you can't immediately upgrade to v3.14.15 or more recent, and you feel that the aforementioned impacts are important enough in your environment, you may choose to temporarily disable the <code class="docutils literal notranslate"><span class="pre">scp</span></code> and <code class="docutils literal notranslate"><span class="pre">sftp</span></code> plugins globally on the bastion, by setting <code class="docutils literal notranslate"><span class="pre">&quot;disabled&quot;:</span> <span class="pre">true</span></code> in these plugins configuration files, which can be found in <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.scp.conf</span></code> and <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.sftp.conf</span></code> respectively. If these files don't exist, create them with the contents as <code class="docutils literal notranslate"><span class="pre">{</span> <span class="pre">&quot;disabled&quot;:</span> <span class="pre">true</span> <span class="pre">}</span></code>. They should be readable by anyone but modifiable only by root (i.e. <code class="docutils literal notranslate"><span class="pre">chmod</span> <span class="pre">664;</span> <span class="pre">chown</span> <span class="pre">root:root</span></code>)</p>
+</section>
+<section id="timeline">
+<h2>Timeline<a class="headerlink" href="#timeline" title="Permalink to this headline"></a></h2>
+<ul class="simple">
+<li><p>2023-10-06: security bug report filed on GitHub</p></li>
+<li><p>2023-10-06: bug report accepted and confirmed as having a security impact</p></li>
+<li><p>2023-10-11: CVE ID requested</p></li>
+<li><p>2023-10-11: CVE ID assigned</p></li>
+<li><p>2023-11-07: fix pushed to a private fork for review</p></li>
+<li><p>2023-11-08: v3.14.15 released with the fix</p></li>
+</ul>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../security_advisories.html" class="btn btn-neutral float-left" title="Security Advisories" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../../development/setup.html" class="btn btn-neutral float-right" title="Environment setup" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/development/setup.html b/development/setup.html
new file mode 100644
index 000000000..59f36463c
--- /dev/null
+++ b/development/setup.html
@@ -0,0 +1,318 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Environment setup &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Writing tests" href="tests.html" />
+    <link rel="prev" title="CVE-2023-45140" href="../administration/security_advisories/cve_2023_45140.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Environment setup</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#available-tools">Available tools</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#git-pre-commit-hook">Git pre-commit hook</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#running-integration-tests">Running integration tests</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#using-docker">Using Docker</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#without-docker">Without Docker</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Environment setup</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/development/setup.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="environment-setup">
+<h1><a class="toc-backref" href="#id1">Environment setup</a><a class="headerlink" href="#environment-setup" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#environment-setup" id="id1">Environment setup</a></p>
+<ul>
+<li><p><a class="reference internal" href="#available-tools" id="id2">Available tools</a></p></li>
+<li><p><a class="reference internal" href="#git-pre-commit-hook" id="id3">Git pre-commit hook</a></p></li>
+<li><p><a class="reference internal" href="#running-integration-tests" id="id4">Running integration tests</a></p>
+<ul>
+<li><p><a class="reference internal" href="#using-docker" id="id5">Using Docker</a></p></li>
+<li><p><a class="reference internal" href="#without-docker" id="id6">Without Docker</a></p></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</div>
+<p>This documentation section outlines the few steps needed to build a development environment for The Bastion,
+easing code modification, tests, checks, and ultimately, pull requests.</p>
+<section id="available-tools">
+<h2><a class="toc-backref" href="#id2">Available tools</a><a class="headerlink" href="#available-tools" title="Permalink to this headline"></a></h2>
+<p>The provided <code class="file docutils literal notranslate"><span class="pre">docker/devenv/run-tool.sh</span></code> script will build a development docker for you, under which it'll
+run several tools. Your local git folder will be mounted as a volume inside this docker so that it can
+access the files, and potentially modify them (such as for <code class="docutils literal notranslate"><span class="pre">perltidy</span></code>).</p>
+<p>The supported tools are as follows:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">Usage: ./docker/devenv/run-tool.sh COMMAND [OPTIONS]
+</span>
+  COMMAND may be one of the following:
+
+  tidy       [FILES..] runs perltidy on several or all the Perl source files, modifying them if needed
+  tidycheck  [FILES..] runs perltidy in dry-run mode, and returns an error if files are not tidy
+  perlcritic           runs perlcritic on all the Perl source files
+  shellcheck [FILES..] runs shellcheck on all the shell source files
+  lint                 runs tidy, perlcritic and shellcheck on all files in one command
+  doc                  generates the documentation
+  sphinx-view-objects  shows the named objects of the Sphinx documentation that can be referenced
+  rebuild              forces the rebuild of the devenv docker image that is needed to run all the above commands
+  run &lt;COMMAND&gt;        spawn an interactive shell to run any arbitrary command in the devenv docker
+  doc-serve &lt;PORT&gt;     starts a local HTTP python server on PORT to view generated documentation
+</pre></div>
+</div>
+<p>Before submitting a pull request, you'll need at minimum to run <code class="docutils literal notranslate"><span class="pre">lint</span></code>. It might be a good idea to setup a
+git pre-commit hook to do this on modified files, see below.</p>
+</section>
+<section id="git-pre-commit-hook">
+<h2><a class="toc-backref" href="#id3">Git pre-commit hook</a><a class="headerlink" href="#git-pre-commit-hook" title="Permalink to this headline"></a></h2>
+<p>Some lint checks are enforced through GitHub Actions, but it'll save you a lot of back-and-forth if you ensure that
+these checks are passing locally on your development environment.</p>
+<p>To this effect, you'll need to setup pre-commit hooks on your local copy of the git repository, so that your code
+is automatically checked by <code class="docutils literal notranslate"><span class="pre">perlcritic</span></code>, <code class="docutils literal notranslate"><span class="pre">perltidy</span></code> and <code class="docutils literal notranslate"><span class="pre">shellcheck</span></code> each time you commit.</p>
+<p>If you previously cloned the repository with such a command:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">git clone https://github.com/ovh/the-bastion
+</span></pre></div>
+</div>
+<p>Then you can copy the provided <code class="file docutils literal notranslate"><span class="pre">pre-commit</span></code> script into your local <code class="file docutils literal notranslate"><span class="pre">.git</span></code> folder:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">cp contrib/git/pre-commit .git/hooks/pre-commit
+</span></pre></div>
+</div>
+<p>To verify that it works checkout a new test branch and add two dummy files like this:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">git checkout -B mybranch
+</span><span class="hll">printf &quot;%b&quot; &quot;#! /usr/bin/env bash\nunused=1\n&quot; &gt; bin/shell/dummy.sh
+</span><span class="hll">printf &quot;%b&quot; &quot;#! /usr/bin/env perl\nsub dummy { 1; };\n&quot; &gt; lib/perl/dummy.pm
+</span><span class="hll">git add bin/shell/dummy.sh lib/perl/dummy.pm
+</span><span class="hll">git commit -m dummy
+</span>
+*** Checking shell files syntax using system shellcheck
+`-&gt; bin/shell/dummy.sh
+
+In bin/shell/dummy.sh line 2:
+unused=1
+^----^ SC2034: unused appears unused. Verify use (or export if used externally).
+
+`-&gt; [ERR.]
+
+ERROR: shell-check failed on bin/shell/dummy.sh
+*** Checking perl tidiness
+`-&gt; lib/perl/dummy.pm
+./lib/perl/dummy.pm ./lib/perl/dummy.pm.tdy differ: char 38, line 2
+--- ./lib/perl/dummy.pm 2023-10-03 08:19:55.605950307 +0000
++++ ./lib/perl/dummy.pm.tdy     2023-10-03 08:20:43.618577295 +0000
+@@ -1,2 +1,2 @@
+ #! /usr/bin/env perl
+-sub dummy { 1; };
++sub dummy { 1; }
+
+ERROR: perl tidy failed on lib/perl/dummy.pm
+
+!!! COMMIT ABORTED !!!
+If you want to commit nevertheless, use -n.
+</pre></div>
+</div>
+<p>As you see, the checks are running before the commit is validated and abort it should any check fail.</p>
+</section>
+<section id="running-integration-tests">
+<h2><a class="toc-backref" href="#id4">Running integration tests</a><a class="headerlink" href="#running-integration-tests" title="Permalink to this headline"></a></h2>
+<section id="using-docker">
+<h3><a class="toc-backref" href="#id5">Using Docker</a><a class="headerlink" href="#using-docker" title="Permalink to this headline"></a></h3>
+<p>Functional tests use <code class="docutils literal notranslate"><span class="pre">Docker</span></code> to spawn an environment matching a bastion install.
+One of the docker instances will be used as client, which will connect to the other instance
+which is used as the bastion server. The client instance sends commands to the server instance
+and tests the return values against expected output.</p>
+<p>To test the current code, use the following script, which will run <code class="docutils literal notranslate"><span class="pre">docker</span> <span class="pre">build</span></code> and launch the tests:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">tests/functional/docker/docker_build_and_run_tests.sh &lt;TARGET&gt;
+</span></pre></div>
+</div>
+<p>Where target is one of the supported OSes. Currently only Linux targets are supported.
+You'll get a list of the supported targets by calling the command without argument.</p>
+<p>For example, if you want to test it under Debian (which is a good default OS if you don't have any preference):</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">tests/functional/docker/docker_build_and_run_tests.sh debian12
+</span></pre></div>
+</div>
+<p>The full tests usually take 25 to 50 minutes to run, depending on your hardware specs.
+If you want to launch only a subset of the integration tests, you may specify it:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">tests/functional/docker/docker_build_and_run_tests.sh debian12 --module=320-base.sh
+</span></pre></div>
+</div>
+<p>Other options are supported, and passed through as-is to the underlying test script, use <code class="docutils literal notranslate"><span class="pre">--help</span></code> as below to
+get the list (the output in this documentation might not be up to date, please actually launch it yourself
+to get up-to-date information):</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">tests/functional/launch_tests_on_instance.sh --help
+</span>
+Usage: /home/user/bastion/tests/functional/launch_tests_on_instance.sh [OPTIONS] &lt;IP&gt; &lt;SSH_Port&gt; &lt;HTTP_Proxy_Port_or_Zero&gt; &lt;Remote_Admin_User_Name&gt; &lt;Admin_User_SSH_Key_Path&gt; &lt;Root_SSH_Key_Path&gt;
+
+Test Options:
+    --skip-consistency-check   Speed up tests by skipping the consistency check between every test
+    --no-pause-on-fail         Don&#39;t pause when a test fails
+    --log-prefix=X             Prefix all logs by this name
+    --module=X                 Only test this module (specify a filename found in `functional/tests.d/`), can be specified multiple times
+
+Remote OS directory locations:
+    --remote-etc-bastion=X     Override the default remote bastion configuration directory (default: /etc/bastion)
+    --remote-basedir=X         Override the default remote basedir location (default: /home/user/bastion)
+
+Specifying features support of the underlying OS of the tested bastion:
+    --has-ed25519=[0|1]        Ed25519 keys are supported (default: 1)
+    --has-mfa=[0|1]            PAM is usable to check passwords and TOTP (default: 1)
+    --has-mfa-password=[0|1]   PAM is usable to check passwords (default: 0)
+    --has-pamtester=[0|1]      The `pamtester` binary is available, and PAM is usable (default: 1)
+    --has-piv=[0|1]            The `yubico-piv-tool` binary is available (default: 1)
+    --has-sk=[0|1]             The openssh-server supports Secure Keys (FIDO2) (default: 0)
+</pre></div>
+</div>
+</section>
+<section id="without-docker">
+<h3><a class="toc-backref" href="#id6">Without Docker</a><a class="headerlink" href="#without-docker" title="Permalink to this headline"></a></h3>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This method is discouraged, prefer using the Docker method above when possible</p>
+</div>
+<p>You can test the code against a BSD (or any other OS) without using Docker, by spawning a server
+under the target OS (for example, on a VM), and installing the bastion on it.</p>
+<p>Then, from another machine, run:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">test/functional/launch_tests_on_instance.sh &lt;IP&gt; &lt;port&gt; &lt;remote_user_name&gt; &lt;ssh_key_path&gt; [outdir]
+</span></pre></div>
+</div>
+<p>Where <code class="docutils literal notranslate"><span class="pre">IP</span></code> and <code class="docutils literal notranslate"><span class="pre">port</span></code> are the information needed to connect to the remote server to test,
+<code class="docutils literal notranslate"><span class="pre">remote_user_name</span></code> is the name of the account created on the remote bastion to use for the tests,
+and <code class="docutils literal notranslate"><span class="pre">ssh_key_path</span></code> is the private SSH key path used to connect to the account.
+The <code class="docutils literal notranslate"><span class="pre">outdir</span></code> parameter is optional, if you want to keep the raw output of each test.</p>
+<p>This script is also the script used by the Docker client instance,
+so you're sure to get the proper results even without using Docker.</p>
+<p>Please do <strong>NOT</strong> run any of those tests on a production bastion!</p>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../administration/security_advisories/cve_2023_45140.html" class="btn btn-neutral float-left" title="CVE-2023-45140" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="tests.html" class="btn btn-neutral float-right" title="Writing tests" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/development/tests.html b/development/tests.html
new file mode 100644
index 000000000..20792860e
--- /dev/null
+++ b/development/tests.html
@@ -0,0 +1,361 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Writing tests &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="admin plugins" href="../plugins/admin/index.html" />
+    <link rel="prev" title="Environment setup" href="setup.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="setup.html">Environment setup</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Writing tests</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#example">Example</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#reference">Reference</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#launch-a-test">Launch a test</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#run">run</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#success">success</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#plgfail">plgfail</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="#verify-a-test-validity">Verify a test validity</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#retvalshouldbe">retvalshouldbe</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#contain">contain</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#nocontain">nocontain</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#json">json</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Writing tests</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/development/tests.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="writing-tests">
+<h1><a class="toc-backref" href="#id4">Writing tests</a><a class="headerlink" href="#writing-tests" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#writing-tests" id="id4">Writing tests</a></p>
+<ul>
+<li><p><a class="reference internal" href="#example" id="id5">Example</a></p></li>
+<li><p><a class="reference internal" href="#reference" id="id6">Reference</a></p>
+<ul>
+<li><p><a class="reference internal" href="#launch-a-test" id="id7">Launch a test</a></p>
+<ul>
+<li><p><a class="reference internal" href="#run" id="id8">run</a></p></li>
+<li><p><a class="reference internal" href="#success" id="id9">success</a></p></li>
+<li><p><a class="reference internal" href="#plgfail" id="id10">plgfail</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#verify-a-test-validity" id="id11">Verify a test validity</a></p>
+<ul>
+<li><p><a class="reference internal" href="#retvalshouldbe" id="id12">retvalshouldbe</a></p></li>
+<li><p><a class="reference internal" href="#contain" id="id13">contain</a></p></li>
+<li><p><a class="reference internal" href="#nocontain" id="id14">nocontain</a></p></li>
+<li><p><a class="reference internal" href="#json" id="id15">json</a></p></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</div>
+<p>When modifying code, adding features or fixing bugs, you're expected to write one or more tests to ensure that
+the feature your adding works correctly, or that the bug you've fixed doesn't come back.</p>
+<p>Integration tests modules live in the <code class="file docutils literal notranslate"><span class="pre">tests/functional/tests.d</span></code> folder.
+You may either add a new file to test your feature, or modify an existing file.</p>
+<p>These modules are shell scripts, and are sourced by the main integration test engine. Having a look at one of
+these modules will help you understand how they work, the <code class="file docutils literal notranslate"><span class="pre">tests/functional/tests.d/320-base.sh</span></code> is a good
+example you might want to look at.</p>
+<section id="example">
+<h2><a class="toc-backref" href="#id5">Example</a><a class="headerlink" href="#example" title="Permalink to this headline"></a></h2>
+<p>Here is a simple test taken from <code class="file docutils literal notranslate"><span class="pre">320-base.sh</span></code>:</p>
+<div class="literal-block-wrapper docutils container" id="id1">
+<div class="code-block-caption"><span class="caption-text">a simple test</span><a class="headerlink" href="#id1" title="Permalink to this code"></a></div>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>success   help2     $a0 --osh help
+contain &quot;OSH help&quot;
+json .error_code OK .command help .value null
+</pre></div>
+</div>
+</div>
+<p>A complete reference of such commands can be found below, but let's explain this example in a few words:</p>
+<p>The command <code class="docutils literal notranslate"><span class="pre">success</span></code> implies that we're running a new test command, and that we expect it to work (we might
+also want to test invalid commands and ensure they fail as they should).
+The tester docker will connect to the target docker (that is running the bastion code) as a bastion user, and
+run the <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">help</span></code> command there. This is expected to exit with a code indicating success (0),
+otherwise this test fails.</p>
+<p>The output of the command, once run on the bastion, should contain the text <code class="docutils literal notranslate"><span class="pre">OSH</span> <span class="pre">help</span></code>, or the test will fail.</p>
+<p>In the JSON output (see <a class="reference internal" href="../using/api.html"><span class="doc">JSON API</span></a>) of this command, we expect to find the <code class="docutils literal notranslate"><span class="pre">error_code</span></code> field set to <code class="docutils literal notranslate"><span class="pre">OK</span></code>,
+the <code class="docutils literal notranslate"><span class="pre">command</span></code> field set to <code class="docutils literal notranslate"><span class="pre">help</span></code>, and the <code class="docutils literal notranslate"><span class="pre">value</span></code> field set to <code class="docutils literal notranslate"><span class="pre">null</span></code>, or the test will fail.</p>
+<p>Running just this test will yield the following output:</p>
+<div class="literal-block-wrapper docutils container" id="id2">
+<div class="code-block-caption"><span class="caption-text">a simple test output</span><a class="headerlink" href="#id2" title="Permalink to this code"></a></div>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>00m04 [--] *** [0010/0021] 320-base::help2 (timeout --foreground 30 ssh -F /tmp/bastiontest.pgoA5h/ssh_config -i /tmp/bastiontest.pgoA5h/account0key1file user.5000@bastion_debian10_target -p 22 -- --json-greppable --osh help)
+00m05 [--] [ OK ] RETURN VALUE (0)
+00m05 [--] [ OK ] MUST CONTAIN (OSH help)
+00m05 [--] [ OK ] JSON VALUE (.error_code =&gt; OK) [  ]
+00m05 [--] [ OK ] JSON VALUE (.command =&gt; help) [  ]
+00m05 [--] [ OK ] JSON VALUE (.value =&gt; null) [  ]
+</pre></div>
+</div>
+</div>
+<p>As you can see, this simple test actually checked 5 things: the return value, whether the output text contained
+a given string, and 3 fields of the JSON output.</p>
+</section>
+<section id="reference">
+<h2><a class="toc-backref" href="#id6">Reference</a><a class="headerlink" href="#reference" title="Permalink to this headline"></a></h2>
+<p>These are functions that are defined by the integration test engine and should be used in the test modules.</p>
+<section id="launch-a-test">
+<h3><a class="toc-backref" href="#id7">Launch a test</a><a class="headerlink" href="#launch-a-test" title="Permalink to this headline"></a></h3>
+<section id="run">
+<h4><a class="toc-backref" href="#id8">run</a><a class="headerlink" href="#run" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>run &lt;name&gt; &lt;command&gt;</p></li>
+</ul>
+</div>
+<p>This function runs a new test named <code class="docutils literal notranslate"><span class="pre">&lt;name&gt;</span></code>, which will execute <code class="docutils literal notranslate"><span class="pre">&lt;command&gt;</span></code> on the tester docker.
+Usually <code class="docutils literal notranslate"><span class="pre">&lt;command&gt;</span></code> will connect to the target docker (running the bastion code) using one of the test accounts,
+and run a command there.</p>
+<p>A few accounts are preconfigured:</p>
+<ul class="simple">
+<li><p>The main account (&quot;account 0&quot;): this one is guaranteed to always exist at all times, and is a bastion admin.
+There are a few variables that can be referenced to use this account:</p>
+<ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">$a0</span></code> is the ssh command-line to connect to the remote bastion as this account</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">$account0</span></code> is the account name, to be used in parameters of <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands where needed</p></li>
+</ul>
+</li>
+<li><p>A few secondary accounts that are created, deleted, modified during the tests:</p>
+<ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">$a1</span></code>, <code class="docutils literal notranslate"><span class="pre">$a2</span></code> and <code class="docutils literal notranslate"><span class="pre">$a3</span></code> are the ssh command-lines to connect to the remote bastion as these accounts</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">$account1</span></code>, <code class="docutils literal notranslate"><span class="pre">$account2</span></code> and <code class="docutils literal notranslate"><span class="pre">$account3</span></code> are the accounts names</p></li>
+</ul>
+</li>
+<li><p>Another special non-bastion-account command exists:</p>
+<ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">$r0</span></code> is the required command-line to directly connect to the remote docker on which the bastion code is running,
+as root, with a bash shell. Only use this to modify the remote bastion files, such as config files, between tests</p></li>
+</ul>
+</li>
+</ul>
+<p>A few examples follow:</p>
+<div class="literal-block-wrapper docutils container" id="id3">
+<div class="code-block-caption"><span class="caption-text">running a few test commands</span><a class="headerlink" href="#id3" title="Permalink to this code"></a></div>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>run test1 $a0 --osh info
+run test2 $a0 --osh accountInfo --account $account1
+run test3 $a1 --osh accountDelete --account $account2
+</pre></div>
+</div>
+</div>
+<p>Note that the <code class="docutils literal notranslate"><span class="pre">run</span></code> function just runs the given command, but doesn't check whether it exited normally, you'll
+need other functions to verify this, see below.</p>
+</section>
+<section id="success">
+<h4><a class="toc-backref" href="#id9">success</a><a class="headerlink" href="#success" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>success &lt;name&gt; &lt;command&gt;</p></li>
+</ul>
+</div>
+<p>This function is exactly the same as the <code class="docutils literal notranslate"><span class="pre">run</span></code> command above, except that it expects the given <code class="docutils literal notranslate"><span class="pre">&lt;command&gt;</span></code> to
+return a valid error code (zero). Most of the time, you should be using this instead of <code class="docutils literal notranslate"><span class="pre">run</span></code>, except if you're
+expecting the command to fail, in which case you should use <code class="docutils literal notranslate"><span class="pre">run</span></code> + <code class="docutils literal notranslate"><span class="pre">retvalshouldbe</span></code>, see below.</p>
+</section>
+<section id="plgfail">
+<h4><a class="toc-backref" href="#id10">plgfail</a><a class="headerlink" href="#plgfail" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>plgfail &lt;name&gt; &lt;command&gt;</p></li>
+</ul>
+</div>
+<p>This function is exactly the same as the <code class="docutils literal notranslate"><span class="pre">run</span></code> command above, except that it expects the given <code class="docutils literal notranslate"><span class="pre">&lt;command&gt;</span></code> to
+return an error code of 100, which is the standard exit value when an osh command fails.</p>
+<p>This function is equivalent to using <code class="docutils literal notranslate"><span class="pre">run</span></code> followed by <code class="docutils literal notranslate"><span class="pre">retvalshouldbe</span> <span class="pre">100</span></code> (see below).</p>
+</section>
+</section>
+<section id="verify-a-test-validity">
+<h3><a class="toc-backref" href="#id11">Verify a test validity</a><a class="headerlink" href="#verify-a-test-validity" title="Permalink to this headline"></a></h3>
+<section id="retvalshouldbe">
+<h4><a class="toc-backref" href="#id12">retvalshouldbe</a><a class="headerlink" href="#retvalshouldbe" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>retvalshouldbe &lt;value&gt;</p></li>
+</ul>
+</div>
+<p>Verify that the return value of a test launched right before with the <code class="docutils literal notranslate"><span class="pre">run</span></code> function is <code class="docutils literal notranslate"><span class="pre">&lt;value&gt;</span></code>.
+You should use this if you expect the previous test to return a non-zero value.</p>
+<p>Note that the <code class="docutils literal notranslate"><span class="pre">success</span></code> function is equivalent to using <code class="docutils literal notranslate"><span class="pre">run</span></code> followed by <code class="docutils literal notranslate"><span class="pre">retvalshouldbe</span> <span class="pre">0</span></code>.</p>
+</section>
+<section id="contain">
+<h4><a class="toc-backref" href="#id13">contain</a><a class="headerlink" href="#contain" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>contain &lt;text&gt;</p></li>
+<li><p>contain REGEX &lt;regex&gt;</p></li>
+</ul>
+</div>
+<p>This function verifies that the output of the test contains a given <code class="docutils literal notranslate"><span class="pre">&lt;text&gt;</span></code>. If you need to use a regex
+to match the output, you can use the <code class="docutils literal notranslate"><span class="pre">contain</span> <span class="pre">REGEX</span></code> construction, followed by the regex.</p>
+</section>
+<section id="nocontain">
+<h4><a class="toc-backref" href="#id14">nocontain</a><a class="headerlink" href="#nocontain" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>nocontain &lt;text&gt;</p></li>
+<li><p>nocontain REGEX &lt;regex&gt;</p></li>
+</ul>
+</div>
+<p>This function does the exact opposite of the <code class="docutils literal notranslate"><span class="pre">contain</span></code> function just above, and ensure that a given text
+or regex is NOT present in the output.</p>
+</section>
+<section id="json">
+<h4><a class="toc-backref" href="#id15">json</a><a class="headerlink" href="#json" title="Permalink to this headline"></a></h4>
+<div class="cmdusage admonition">
+<p class="admonition-title">syntax</p>
+<ul class="simple">
+<li><p>json &lt;field1&gt; &lt;value1&gt; [&lt;field2&gt; &lt;value2&gt; ...]</p></li>
+</ul>
+</div>
+<p>This function checks the JSON API output of the test, and validates that it contains the correct value for each
+specified field. The <code class="docutils literal notranslate"><span class="pre">&lt;fieldX&gt;</span></code> entries must be valid <cite>jq</cite> filters.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="setup.html" class="btn btn-neutral float-left" title="Environment setup" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../plugins/admin/index.html" class="btn btn-neutral float-right" title="admin plugins" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/faq.html b/faq.html
new file mode 100644
index 000000000..a53b3fe66
--- /dev/null
+++ b/faq.html
@@ -0,0 +1,300 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>FAQ &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
+        <script src="_static/jquery.js"></script>
+        <script src="_static/underscore.js"></script>
+        <script src="_static/doctools.js"></script>
+    <script src="_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="Basic Installation" href="installation/basic.html" />
+    <link rel="prev" title="Security" href="presentation/security.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/security.html">Security</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">FAQ</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#the-bastion-really">&quot;The Bastion&quot;, really?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#why-using-common-sense">Why using common::sense?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#why-perl">Why Perl?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#why-not-using-a-pki">Why not using a PKI?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#what-does-osh-mean-in-osh">What does <cite>osh</cite> mean in <code class="docutils literal notranslate"><span class="pre">--osh</span></code>?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#what-are-the-recommended-hardware-specifications">What are the recommended hardware specifications?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#can-i-run-it-under-docker-in-production">Can I run it under Docker in production?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#can-i-install-it-on-my-already-existing-server">Can I install it on my already existing server?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#how-to-use-the-bastion-with-the-ssh-proxycommand-option">How to use The Bastion with the SSH <code class="docutils literal notranslate"><span class="pre">ProxyCommand</span></code> option?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#what-is-session-locking">What is <em>session locking</em>?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#can-i-use-ansible-over-the-bastion">Can I use Ansible over The Bastion?</a></li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>FAQ</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="_sources/faq.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="faq">
+<h1>FAQ<a class="headerlink" href="#faq" title="Permalink to this headline"></a></h1>
+<section id="the-bastion-really">
+<h2>&quot;The Bastion&quot;, really?<a class="headerlink" href="#the-bastion-really" title="Permalink to this headline"></a></h2>
+<p>We've been using this software for quite a while at OVHcloud, and there it has always been known as &quot;the bastion&quot;:
+nobody ever bothered to find a fancy name for it.
+So, when we decided to release it in opensource, the naming problem arose.
+After going through some possible names, we realized that nothing would work, as everybody would keep
+naming it &quot;the bastion&quot; anyway, so, we decided to call it just <em>The Bastion</em>.</p>
+</section>
+<section id="why-using-common-sense">
+<h2>Why using common::sense?<a class="headerlink" href="#why-using-common-sense" title="Permalink to this headline"></a></h2>
+<p>Because it's usually a good idea to ensure you use common::sense before writing code!
+On a more serious note, this is almost like using <code class="docutils literal notranslate"><span class="pre">strict</span></code> and <code class="docutils literal notranslate"><span class="pre">warnings</span></code>,
+but with a very reduced memory footprint.
+When you run a bastion with thousands of simultaneous active sessions with that many users, it starts to matter.</p>
+</section>
+<section id="why-perl">
+<h2>Why Perl?<a class="headerlink" href="#why-perl" title="Permalink to this headline"></a></h2>
+<p>There is probably and endless list of why it's the perfect language for this,
+and another similarly endless list of why Perl is completely irrelevant and other $COOL_LANGUAGE would be a better fit,
+but some &quot;why&quot; reasons include:</p>
+<ul class="simple">
+<li><p>It works everywhere, and most OSes have it installed by default</p></li>
+<li><p>Perl has this cool &quot;taint&quot; mode that adds security to untrusted program inputs, we use this on sensitive code</p></li>
+<li><p>One of the design choice of The Bastion has always been to be very close to the system,
+leveraging some low-level Operating System functions, which are easier to interact with using a scripting language</p></li>
+<li><p>The Bastion has a loose origin from an old script written at OVHcloud in the early days,
+back when the de-facto usual language used internally was Perl</p></li>
+</ul>
+</section>
+<section id="why-not-using-a-pki">
+<h2>Why not using a PKI?<a class="headerlink" href="#why-not-using-a-pki" title="Permalink to this headline"></a></h2>
+<p>Well, you can, of course! However this is a very centralized way of managing your accesses,
+with all the power in the hands of whoever controls your CA.
+It can be a highly successful if done very carefully, with a lot of security and processes around the
+certificates delivery workflows. Managing a CA correctly is no joke and can bite you quite hard if done improperly.
+This also happens to be a somewhat recent addition to OpenSSH, and if you have a lot of heterogeneous
+systems to handle, this might be a no-go.
+You can read more about this topic here: <a class="reference external" href="https://blog.ovhcloud.com/the-ovhcloud-bastion-part-1/">https://blog.ovhcloud.com/the-ovhcloud-bastion-part-1/</a></p>
+</section>
+<section id="what-does-osh-mean-in-osh">
+<h2>What does <cite>osh</cite> mean in <code class="docutils literal notranslate"><span class="pre">--osh</span></code>?<a class="headerlink" href="#what-does-osh-mean-in-osh" title="Permalink to this headline"></a></h2>
+<p>This has long been forgotten. Some people say it used to mean &quot;Ovh SHell&quot; at some point,
+but nobody knows whether it's true or just a legend.</p>
+</section>
+<section id="what-are-the-recommended-hardware-specifications">
+<h2>What are the recommended hardware specifications?<a class="headerlink" href="#what-are-the-recommended-hardware-specifications" title="Permalink to this headline"></a></h2>
+<p>They're actually quite low. Down to its basics, the bastion is merely a fancy wrapper around <code class="docutils literal notranslate"><span class="pre">ssh</span></code>,
+so if you have a device that handles <code class="docutils literal notranslate"><span class="pre">ssh</span></code> well, it'll handle the bastion just fine.</p>
+<p>Now to give you some data points, we've observed that 250 concurrent users take up 2.5 Gb of RAM (including
+the operating system's own footprint, and the usual daemons such as auditd, syslog, etc.).
+So a rule of thumb would be 1 Gb per 100 simultaneous sessions.
+If you expect to get a lot of new connections per minute (not necessarily long-lived),
+it's advised to use SSD drives however, as the bastion workload pattern for disk I/O is a lot of random seeks
+to write logs and ttyrecs. Mechanical hard drives are very bad at this.</p>
+</section>
+<section id="can-i-run-it-under-docker-in-production">
+<span id="faq-docker"></span><h2>Can I run it under Docker in production?<a class="headerlink" href="#can-i-run-it-under-docker-in-production" title="Permalink to this headline"></a></h2>
+<p>Technically you can, but you have to think about what are the implications (this is true regardless
+of the containerization technology). What's important to understand is that it adds another layer of abstraction,
+and can give you a false sense of security.
+If you either have the complete control of the host running Docker (and hardened it properly),
+or you fully trust whoever is running the host for you, then this is fine.
+Otherwise, <em>somebody</em> might have access to all your keys and you have no way to know or block it.</p>
+<p>Note that the provided Dockerfiles are a good start, but no volumes are defined.
+To ensure that all the accounts don't disappear on a <code class="docutils literal notranslate"><span class="pre">docker</span> <span class="pre">rm</span></code>, you would at least need to ensure that
+<code class="docutils literal notranslate"><span class="pre">/home</span></code>, <code class="docutils literal notranslate"><span class="pre">/etc/passwd</span></code>, <code class="docutils literal notranslate"><span class="pre">/etc/shadow</span></code>, <code class="docutils literal notranslate"><span class="pre">/etc/group</span></code>, <code class="docutils literal notranslate"><span class="pre">/etc/gshadow</span></code> are stored in a volume,
+in addition to <code class="docutils literal notranslate"><span class="pre">/etc/bastion</span></code> and <code class="docutils literal notranslate"><span class="pre">/root/.gpg</span></code>.
+You'll also need an SSH server, obviously, and probably a <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code> daemon.</p>
+</section>
+<section id="can-i-install-it-on-my-already-existing-server">
+<span id="faq-existing-server"></span><h2>Can I install it on my already existing server?<a class="headerlink" href="#can-i-install-it-on-my-already-existing-server" title="Permalink to this headline"></a></h2>
+<p>This is discouraged if your server is already doing something else, such as hosting a website,
+handling your e-mails or running a database.</p>
+<p>From a security standpoint, it's a bad idea because if your server gets hacked due to one of
+the other services you're hosting, the SSH keys could get compromised even if The Bastion itself has no security issue.</p>
+<p>This is also discouraged due to the design of The Bastion: being deeply intertwined with the OS it's running on,
+it might make changes that seem intrusive from the point of view of other running services.
+Such as creating and deleting system accounts and groups from time to time, modifying the PAM configuration,
+or hardening the SSH client and server configurations system-wide,
+which could break other services or workflows that expect to be running on a default (non-hardened) SSH configuration.</p>
+</section>
+<section id="how-to-use-the-bastion-with-the-ssh-proxycommand-option">
+<span id="faq-jumphost"></span><h2>How to use The Bastion with the SSH <code class="docutils literal notranslate"><span class="pre">ProxyCommand</span></code> option?<a class="headerlink" href="#how-to-use-the-bastion-with-the-ssh-proxycommand-option" title="Permalink to this headline"></a></h2>
+<p><strong>tl;dr</strong>: you can't.</p>
+<p><strong>Fast answer</strong>: you can't, because The Bastion is not a proxy, nor what is often called an &quot;ssh jumphost&quot;.
+Granted, sometimes these are also called &quot;bastions&quot;, hence the confusion.
+Note that this also applies to the <code class="docutils literal notranslate"><span class="pre">-J</span></code> or <code class="docutils literal notranslate"><span class="pre">JumpHost</span></code> ssh option, which is just a simplified <code class="docutils literal notranslate"><span class="pre">ProxyCommand</span></code>.</p>
+<p><strong>Long answer</strong>: The Bastion is acting as a trusted party between you (the admin or the robot) and the server
+of the infrastructure you need to access. To achieve this, when you use the bastion to connect to the server,
+there are two distinct ssh connections present at the same time:</p>
+<blockquote>
+<div><ul class="simple">
+<li><p>The ingress ssh connection, between you and the bastion.
+For this connection your local private ssh key is used to authenticate yourself to the bastion</p></li>
+<li><p>The egress ssh connection, between the bastion and the remote server you need to access.
+For this connection your bastion egress private ssh key (or a group egress private ssh key you're member of)
+is used to authenticate the bastion to the remote server</p></li>
+</ul>
+</div></blockquote>
+<p>Those two connections are distinct, and the bastion logic merges those two so that you're under the impression
+that you're directly connected to the remote server. There is no dynamic port forwarding happening on the bastion
+to enable access to the remote server from your desktop, network-wise (which is what <code class="docutils literal notranslate"><span class="pre">JumpHost</span></code> does).</p>
+<p>Using <code class="docutils literal notranslate"><span class="pre">ProxyCommand</span></code> with the bastion doesn't make sense because with this option, your local ssh client expects
+to talk the SSH dialect on the STDIN of the ProxyCommand you're giving, and it'll try to use your local SSH key
+to authenticate you through it, which won't work as it's only used for the ingress connection.
+However, when you use the usual bastion alias, in STDIN you have the remote server terminal directly,
+all the SSH stuff has already been done.</p>
+<p>Attempting to summarize this a bit would be: <code class="docutils literal notranslate"><span class="pre">ProxyCommand</span></code> and <code class="docutils literal notranslate"><span class="pre">JumpHost</span></code> are useful when the server
+you're trying to connect to can't be accessed <em>network-wise</em> from where you stand, and needs to be accessed
+through some kind of proxy instead, where The Bastion's logic is to use two distinct SSH connections,
+and two distinct authentication phases, with two distinct SSH keys (yours for the ingress connection,
+and your bastion egress key for the egress connection).</p>
+</section>
+<section id="what-is-session-locking">
+<h2>What is <em>session locking</em>?<a class="headerlink" href="#what-is-session-locking" title="Permalink to this headline"></a></h2>
+<p>Session locking can be enabled in the global configuration, through the <a class="reference internal" href="administration/configuration/bastion_conf.html#idlelocktimeout"><span class="std std-ref">idleLockTimeout</span></a> option.</p>
+<p>When enabled, the interactive SSH session will automatically lock itself after a defined amount of idle time.
+Unlocking such a session can be done, but re-authentication is required, i.e. connecting to the bastion
+from another console, and using the <a class="reference internal" href="plugins/open/unlock.html"><span class="doc">unlock</span></a> command.
+Here, idle time is defined as keyboard input idle time, so even if a remote command might be running
+(such as <code class="docutils literal notranslate"><span class="pre">tail</span> <span class="pre">-f</span></code>), the connection will still be considered idle if no input is detected. This is by design.</p>
+<p>Such as configuration can be required by policy or regulations, in some sensitive environments,
+to ensure opened connections are automatically cut off when unused.
+Locking such sessions can be an alternative to cutting (see the <a class="reference internal" href="administration/configuration/bastion_conf.html#idlekilltimeout"><span class="std std-ref">idleKillTimeout</span></a> option) as it gives
+a chance to unlock the session before tearing the connection down.
+Both can also be used, such as locking first, then tearing down after more time has passed without the session
+being unlocked. Note that while a session is locked, any potentially running remote command will still be running,
+as locking the session will just hide the normal console output, and prevent any input to be registered.
+Unlocking the session will simply resume display to the console.
+Session locking can be seen as the equivalent of a desktop screensaver, but for SSH interactive sessions.</p>
+<p>A locked session looks like this:</p>
+<img alt="_images/locked_session.png" src="_images/locked_session.png" />
+</section>
+<section id="can-i-use-ansible-over-the-bastion">
+<h2>Can I use Ansible over The Bastion?<a class="headerlink" href="#can-i-use-ansible-over-the-bastion" title="Permalink to this headline"></a></h2>
+<p>Yes, you can, by using a wrapper available <a class="reference external" href="https://github.com/ovh/the-bastion-ansible-wrapper">here</a>.</p>
+<p>Please note however that some Ansible modules may not use the builtin SSH command of Ansible,
+which we override with our wrapper, but some other mechanism we can't hook into.
+This is for example the case of the <cite>network_cli</cite> module of Ansible, which underneath uses Paramiko,
+a Python library to handle SSH connections, which prevents our wrapper to be used (see
+<a class="reference external" href="https://github.com/ovh/the-bastion/issues/254">this GitHub issue</a> for more information).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="presentation/security.html" class="btn btn-neutral float-left" title="Security" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="installation/basic.html" class="btn btn-neutral float-right" title="Basic Installation" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/genindex.html b/genindex.html
new file mode 100644
index 000000000..a73498e9e
--- /dev/null
+++ b/genindex.html
@@ -0,0 +1,2357 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Index &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
+        <script src="_static/jquery.js"></script>
+        <script src="_static/underscore.js"></script>
+        <script src="_static/doctools.js"></script>
+    <script src="_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="#" />
+    <link rel="search" title="Search" href="search.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Index</li>
+      <li class="wy-breadcrumbs-aside">
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+
+<h1 id="index">Index</h1>
+
+<div class="genindex-jumpbox">
+ <a href="#Symbols"><strong>Symbols</strong></a>
+ | <a href="#A"><strong>A</strong></a>
+ | <a href="#B"><strong>B</strong></a>
+ | <a href="#C"><strong>C</strong></a>
+ | <a href="#G"><strong>G</strong></a>
+ | <a href="#I"><strong>I</strong></a>
+ | <a href="#M"><strong>M</strong></a>
+ | <a href="#N"><strong>N</strong></a>
+ | <a href="#P"><strong>P</strong></a>
+ | <a href="#R"><strong>R</strong></a>
+ | <a href="#S"><strong>S</strong></a>
+ | <a href="#W"><strong>W</strong></a>
+ 
+</div>
+<h2 id="Symbols">Symbols</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    --account
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-account">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-account">accountDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --account ACCOUNT
+
+      <ul>
+        <li><a href="plugins/restricted/accountDelete.html#cmdoption-accountDelete-account">accountDelete command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountFreeze.html#cmdoption-accountFreeze-account">accountFreeze command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountGeneratePassword.html#cmdoption-accountGeneratePassword-account">accountGeneratePassword command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountGrantCommand.html#cmdoption-accountGrantCommand-account">accountGrantCommand command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-account">accountInfo command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-account">accountList command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-account">accountListAccesses command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountListEgressKeys.html#cmdoption-accountListEgressKeys-account">accountListEgressKeys command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountListIngressKeys.html#cmdoption-accountListIngressKeys-account">accountListIngressKeys command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountListPasswords.html#cmdoption-accountListPasswords-account">accountListPasswords command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountMFAResetPassword.html#cmdoption-accountMFAResetPassword-account">accountMFAResetPassword command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountMFAResetTOTP.html#cmdoption-accountMFAResetTOTP-account">accountMFAResetTOTP command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-account">accountModify command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountPIV.html#cmdoption-accountPIV-account">accountPIV command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountRevokeCommand.html#cmdoption-accountRevokeCommand-account">accountRevokeCommand command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountUnexpire.html#cmdoption-accountUnexpire-account">accountUnexpire command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountUnfreeze.html#cmdoption-accountUnfreeze-account">accountUnfreeze command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountUnlock.html#cmdoption-accountUnlock-account">accountUnlock command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddAclkeeper.html#cmdoption-groupAddAclkeeper-account">groupAddAclkeeper command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddGatekeeper.html#cmdoption-groupAddGatekeeper-account">groupAddGatekeeper command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-account">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddMember.html#cmdoption-groupAddMember-account">groupAddMember command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddOwner.html#cmdoption-groupAddOwner-account">groupAddOwner command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelAclkeeper.html#cmdoption-groupDelAclkeeper-account">groupDelAclkeeper command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelGatekeeper.html#cmdoption-groupDelGatekeeper-account">groupDelGatekeeper command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelMember.html#cmdoption-groupDelMember-account">groupDelMember command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelOwner.html#cmdoption-groupDelOwner-account">groupDelOwner command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-account">groupListGuestAccesses command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupTransmitOwnership.html#cmdoption-groupTransmitOwnership-account">groupTransmitOwnership command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --account NAME
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-account">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --after WHEN
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-after">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --algo
+
+      <ul>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-algo">groupCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --algo ALGO
+
+      <ul>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-algo">groupGenerateEgressKey command line option</a>
+</li>
+        <li><a href="plugins/open/selfGenerateEgressKey.html#cmdoption-selfGenerateEgressKey-algo">selfGenerateEgressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --all
+
+      <ul>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-all">accountInfo command line option</a>
+</li>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-all">groupInfo command line option</a>
+</li>
+        <li><a href="plugins/open/groupList.html#cmdoption-groupList-all">groupList command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --allowed
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-allowed">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --always-active
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-always-active">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --always-active yes|no
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-always-active">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --audit
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-audit">accountList command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --before WHEN
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-before">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --command &#39;&#34;remote cmd&#34;&#39;
+
+      <ul>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-command">clush command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --command COMMAND
+
+      <ul>
+        <li><a href="plugins/restricted/accountGrantCommand.html#cmdoption-accountGrantCommand-command">accountGrantCommand command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountRevokeCommand.html#cmdoption-accountRevokeCommand-command">accountRevokeCommand command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --comment &#34;&#39;ANY TEXT&#39;&#34;
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-comment">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-comment">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --comment &#39;&#34;ANY TEXT&#34;&#39;
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-comment">groupAddGuestAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --comment &#39;&#34;ANY TEXT&#39;&#34;
+
+      <ul>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-comment">groupAddServer command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --comment &#39;&#34;STRING&#34;&#39;
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-comment">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --comment STRING
+
+      <ul>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-comment">realmCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --denied
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-denied">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --detailed
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-detailed">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --do-it
+
+      <ul>
+        <li><a href="plugins/restricted/accountGeneratePassword.html#cmdoption-accountGeneratePassword-do-it">accountGeneratePassword command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupGeneratePassword.html#cmdoption-groupGeneratePassword-do-it">groupGeneratePassword command line option</a>
+</li>
+        <li><a href="plugins/open/selfGeneratePassword.html#cmdoption-selfGeneratePassword-do-it">selfGeneratePassword command line option</a>
+</li>
+        <li><a href="plugins/open/selfGenerateProxyPassword.html#cmdoption-selfGenerateProxyPassword-do-it">selfGenerateProxyPassword command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --egress-strict-host-key-checking POLICY
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-egress-strict-host-key-checking">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --encrypted
+
+      <ul>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-encrypted">groupCreate command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-encrypted">groupGenerateEgressKey command line option</a>
+</li>
+        <li><a href="plugins/open/selfGenerateEgressKey.html#cmdoption-selfGenerateEgressKey-encrypted">selfGenerateEgressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --exclude PATTERN
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-exclude">accountList command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-exclude">accountListAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/groupList.html#cmdoption-groupList-exclude">groupList command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-exclude">groupListGuestAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-exclude">groupListServers command line option</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-exclude">selfListAccesses command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --fingerprint-to-delete FP
+
+      <ul>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-f">selfDelIngressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --force
+
+      <ul>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-force">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-force">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --force-key FINGERPRINT
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-force-key">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-force-key">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-force-key">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --force-password HASH
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-force-password">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-force-password">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-force-password">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --from
+
+      <ul>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-from">realmCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --group
+
+      <ul>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-group">groupCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --group             GROUP
+
+      <ul>
+        <li><a href="plugins/group-owner/groupModify.html#cmdoption-groupModify-group">groupModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --group GROUP
+
+      <ul>
+        <li><a href="plugins/group-owner/groupAddAclkeeper.html#cmdoption-groupAddAclkeeper-group">groupAddAclkeeper command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddGatekeeper.html#cmdoption-groupAddGatekeeper-group">groupAddGatekeeper command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-group">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddMember.html#cmdoption-groupAddMember-group">groupAddMember command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddOwner.html#cmdoption-groupAddOwner-group">groupAddOwner command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-group">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelAclkeeper.html#cmdoption-groupDelAclkeeper-group">groupDelAclkeeper command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelEgressKey.html#cmdoption-groupDelEgressKey-group">groupDelEgressKey command line option</a>
+</li>
+        <li><a href="plugins/restricted/groupDelete.html#cmdoption-groupDelete-group">groupDelete command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelGatekeeper.html#cmdoption-groupDelGatekeeper-group">groupDelGatekeeper command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-group">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelMember.html#cmdoption-groupDelMember-group">groupDelMember command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelOwner.html#cmdoption-groupDelOwner-group">groupDelOwner command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-group">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDestroy.html#cmdoption-groupDestroy-group">groupDestroy command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-group">groupGenerateEgressKey command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupGeneratePassword.html#cmdoption-groupGeneratePassword-group">groupGeneratePassword command line option</a>
+</li>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-group">groupInfo command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-group">groupListGuestAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/groupListPasswords.html#cmdoption-groupListPasswords-group">groupListPasswords command line option</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-group">groupListServers command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupTransmitOwnership.html#cmdoption-groupTransmitOwnership-group">groupTransmitOwnership command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --guest-ttl-limit   DURATION
+
+      <ul>
+        <li><a href="plugins/group-owner/groupModify.html#cmdoption-groupModify-guest-ttl-limit">groupModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --hide-groups
+
+      <ul>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-hide-groups">accountListAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-hide-groups">selfListAccesses command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --host HOST
+
+      <ul>
+        <li><a href="plugins/open/nc.html#cmdoption-nc-host">nc command line option</a>
+</li>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-host">ping command line option</a>
+</li>
+        <li><a href="plugins/open/selfForgetHostKey.html#cmdoption-selfForgetHostKey-host">selfForgetHostKey command line option</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-host">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --host HOSTNAME
+
+      <ul>
+        <li><a href="plugins/open/alive.html#cmdoption-alive-host">alive command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --host HOST|IP
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-host">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-host">groupDelGuestAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --host HOST|IP|NET/CIDR
+
+      <ul>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-host">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-host">groupDelServer command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --host IP|HOST|IP/MASK
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-host">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-host">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-host">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-host">selfDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --host SERVER
+
+      <ul>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-host">whoHasAccessTo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --id ID
+
+      <ul>
+        <li><a href="plugins/group-owner/groupDelEgressKey.html#cmdoption-groupDelEgressKey-id">groupDelEgressKey command line option</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-id">selfListSessions command line option</a>
+</li>
+        <li><a href="plugins/open/selfPlaySession.html#cmdoption-selfPlaySession-id">selfPlaySession command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --id-to-delete ID
+
+      <ul>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-l">selfDelIngressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --idle-ignore yes|no
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-idle-ignore">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --ignore-group GROUP
+
+      <ul>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-ignore-group">whoHasAccessTo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --ignore-personal
+
+      <ul>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-ignore-personal">whoHasAccessTo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --immutable-key
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-immutable-key">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --inactive-only
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-inactive-only">accountList command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --include PATTERN
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-include">accountList command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-include">accountListAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/groupList.html#cmdoption-groupList-include">groupList command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-include">groupListGuestAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-include">groupListServers command line option</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-include">selfListAccesses command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --limit LIMIT
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-limit">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --list HOSTLIST
+
+      <ul>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-list">clush command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --lock
+
+      <ul>
+        <li><a href="plugins/admin/adminMaintenance.html#cmdoption-adminMaintenance-lock">adminMaintenance command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --max-inactive-days DAYS
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-max-inactive-days">accountCreate command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-max-inactive-days">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --message MESSAGE
+
+      <ul>
+        <li><a href="plugins/admin/adminMaintenance.html#cmdoption-adminMaintenance-message">adminMaintenance command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    --mfa-password-required yes|no|bypass
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-mfa-password-required">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --mfa-required      password|totp|any|none
+
+      <ul>
+        <li><a href="plugins/group-owner/groupModify.html#cmdoption-groupModify-mfa-required">groupModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --mfa-totp-required yes|no|bypass
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-mfa-totp-required">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --no-confirm
+
+      <ul>
+        <li><a href="plugins/restricted/accountDelete.html#cmdoption-accountDelete-no-confirm">accountDelete command line option</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-no-confirm">clush command line option</a>
+</li>
+        <li><a href="plugins/restricted/groupDelete.html#cmdoption-groupDelete-no-confirm">groupDelete command line option</a>
+</li>
+        <li><a href="plugins/group-owner/groupDestroy.html#cmdoption-groupDestroy-no-confirm">groupDestroy command line option</a>
+</li>
+        <li><a href="plugins/open/selfMFASetupTOTP.html#cmdoption-selfMFASetupTOTP-no-confirm">selfMFASetupTOTP command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --no-key
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-no-key">accountCreate command line option</a>
+</li>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-no-key">groupCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --no-output
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-no-output">accountList command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --no-password-info
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-no-password-info">accountList command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --no-pause-on-failure
+
+      <ul>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-no-pause-on-failure">clush command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --osh-only
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-osh-only">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --osh-only yes|no
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-osh-only">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --owner
+
+      <ul>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-owner">groupCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --pam-auth-bypass yes|no
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-pam-auth-bypass">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --personal-egress-mfa-required POLICY
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-personal-egress-mfa-required">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --piv
+
+      <ul>
+        <li><a href="plugins/open/selfAddIngressKey.html#cmdoption-selfAddIngressKey-piv">selfAddIngressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --policy  POLICY
+
+      <ul>
+        <li><a href="plugins/restricted/accountPIV.html#cmdoption-accountPIV-policy">accountPIV command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --port PORT
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-port">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-port">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-port">clush command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-port">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-port">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-port">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-port">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/open/nc.html#cmdoption-nc-port">nc command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-port">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-port">selfDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/open/selfForgetHostKey.html#cmdoption-selfForgetHostKey-port">selfForgetHostKey command line option</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-port">whoHasAccessTo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --port-any
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-port-any">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-port-any">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-port-any">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-port-any">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-port-any">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-port-any">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-port-any">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-port-any">selfDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --pubkey-auth-optional yes|no
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-pubkey-auth-optional">accountModify command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --public-key &#39;&#34;KEY&#34;&#39;
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-public-key">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --public-key KEY
+
+      <ul>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-public-key">realmCreate command line option</a>
+</li>
+        <li><a href="plugins/open/selfAddIngressKey.html#cmdoption-selfAddIngressKey-public-key">selfAddIngressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --realm   REALM
+
+      <ul>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-realm">realmCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --realm REALM
+
+      <ul>
+        <li><a href="plugins/restricted/realmDelete.html#cmdoption-realmDelete-realm">realmDelete command line option</a>
+</li>
+        <li><a href="plugins/restricted/realmInfo.html#cmdoption-realmInfo-realm">realmInfo command line option</a>
+</li>
+        <li><a href="plugins/restricted/realmList.html#cmdoption-realmList-realm">realmList command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --reason  &#34;&#39;SOME REASON&#39;&#34;
+
+      <ul>
+        <li><a href="plugins/restricted/accountFreeze.html#cmdoption-accountFreeze-reason">accountFreeze command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --report
+
+      <ul>
+        <li><a href="plugins/open/mtr.html#cmdoption-mtr-report">mtr command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --reverse-dns
+
+      <ul>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-reverse-dns">accountListAccesses command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-reverse-dns">groupListGuestAccesses command line option</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-reverse-dns">groupListServers command line option</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-reverse-dns">selfListAccesses command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --scpdown
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-scpdown">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-scpdown">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-scpdown">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-scpdown">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-scpdown">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-scpdown">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-scpdown">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-scpdown">selfDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --scpup
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-scpup">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-scpup">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-scpup">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-scpup">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-scpup">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-scpup">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-scpup">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-scpup">selfDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --sftp
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-sftp">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-sftp">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-sftp">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-sftp">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-sftp">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-sftp">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-sftp">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-sftp">selfDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --show-wildcards
+
+      <ul>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-show-wildcards">whoHasAccessTo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --size
+
+      <ul>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-size">groupCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --size    SIZE
+
+      <ul>
+        <li><a href="plugins/restricted/accountGeneratePassword.html#cmdoption-accountGeneratePassword-size">accountGeneratePassword command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --size  SIZE
+
+      <ul>
+        <li><a href="plugins/group-owner/groupGeneratePassword.html#cmdoption-groupGeneratePassword-size">groupGeneratePassword command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --size SIZE
+
+      <ul>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-size">groupGenerateEgressKey command line option</a>
+</li>
+        <li><a href="plugins/open/selfGenerateEgressKey.html#cmdoption-selfGenerateEgressKey-size">selfGenerateEgressKey command line option</a>
+</li>
+        <li><a href="plugins/open/selfGeneratePassword.html#cmdoption-selfGeneratePassword-size">selfGeneratePassword command line option</a>
+</li>
+        <li><a href="plugins/open/selfGenerateProxyPassword.html#cmdoption-selfGenerateProxyPassword-size">selfGenerateProxyPassword command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --step-by-step
+
+      <ul>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-step-by-step">clush command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --sudo-as ACCOUNT
+
+      <ul>
+        <li><a href="plugins/admin/adminSudo.html#cmdoption-adminSudo-sudo-as">adminSudo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --sudo-cmd PLUGIN
+
+      <ul>
+        <li><a href="plugins/admin/adminSudo.html#cmdoption-adminSudo-sudo-cmd">adminSudo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --to-port PORT
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-to-port">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --ttl SECONDS|DURATION
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-ttl">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-ttl">accountCreate command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountPIV.html#cmdoption-accountPIV-ttl">accountPIV command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-ttl">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-ttl">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-ttl">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --type TYPE
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-type">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --uid UID
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-uid">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --uid-auto
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-uid-auto">accountCreate command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --unlock
+
+      <ul>
+        <li><a href="plugins/admin/adminMaintenance.html#cmdoption-adminMaintenance-unlock">adminMaintenance command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --user USER
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-user">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-user">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-user">clush command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-user">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-user">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-user">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-user">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-user">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-user">selfDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-user">selfListSessions command line option</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-user">whoHasAccessTo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --user-any
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-user-any">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-user-any">accountDelPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-user-any">groupAddGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-user-any">groupAddServer command line option</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-user-any">groupDelGuestAccess command line option</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-user-any">groupDelServer command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-user-any">selfAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-user-any">selfDelPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --via HOST
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-via">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --via-port PORT
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-via-port">selfListSessions command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --with[out]-egress-keys
+
+      <ul>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-egress-keys">accountInfo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --with[out]-everything
+
+      <ul>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-everything">accountInfo command line option</a>
+</li>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-with-out-everything">groupInfo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --with[out]-groups
+
+      <ul>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-groups">accountInfo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --with[out]-keys
+
+      <ul>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-with-out-keys">groupInfo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --with[out]-mfa-password-info
+
+      <ul>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-mfa-password-info">accountInfo command line option</a>
+</li>
+      </ul></li>
+      <li>
+    --yes
+
+      <ul>
+        <li><a href="plugins/open/selfMFASetupPassword.html#cmdoption-selfMFASetupPassword-yes">selfMFASetupPassword command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -c COUNT
+
+      <ul>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-c">ping command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -f
+
+      <ul>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-f">selfDelIngressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -l
+
+      <ul>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-l">selfDelIngressKey command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -s SIZE
+
+      <ul>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-s">ping command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -t TTL
+
+      <ul>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-t">ping command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -w SECONDS
+
+      <ul>
+        <li><a href="plugins/open/nc.html#cmdoption-nc-w">nc command line option</a>
+</li>
+      </ul></li>
+      <li>
+    -w TIMEOUT
+
+      <ul>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-w">ping command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="A">A</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    accountAddPersonalAccess command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-account">--account</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-comment">--comment &#34;&#39;ANY TEXT&#39;&#34;</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-force-key">--force-key FINGERPRINT</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-force-password">--force-password HASH</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-host">--host IP|HOST|IP/MASK</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-port">--port PORT</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-ttl">--ttl SECONDS|DURATION</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-user">--user USER</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-user-any">--user-any</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">between 0 and 32)</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-self_remote_user_only">boolean)</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">integer</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-self_remote_user_only">self_remote_user_only (optional</a>
+</li>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">widest_v4_prefix (optional</a>
+</li>
+      </ul></li>
+      <li>
+    accountCreate command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-account">--account NAME</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-always-active">--always-active</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-comment">--comment &#39;&#34;STRING&#34;&#39;</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-immutable-key">--immutable-key</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-max-inactive-days">--max-inactive-days DAYS</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-no-key">--no-key</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-osh-only">--osh-only</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-public-key">--public-key &#39;&#34;KEY&#34;&#39;</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-ttl">--ttl SECONDS|DURATION</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-uid">--uid UID</a>
+</li>
+        <li><a href="plugins/restricted/accountCreate.html#cmdoption-accountCreate-uid-auto">--uid-auto</a>
+</li>
+      </ul></li>
+      <li>
+    accountDelete command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountDelete.html#cmdoption-accountDelete-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountDelete.html#cmdoption-accountDelete-no-confirm">--no-confirm</a>
+</li>
+      </ul></li>
+      <li>
+    accountDelPersonalAccess command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-account">--account</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-host">--host IP|HOST|IP/MASK</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-port">--port PORT</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-user">--user USER</a>
+</li>
+        <li><a href="plugins/restricted/accountDelPersonalAccess.html#cmdoption-accountDelPersonalAccess-user-any">--user-any</a>
+</li>
+      </ul></li>
+      <li>
+    accountFreeze command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountFreeze.html#cmdoption-accountFreeze-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountFreeze.html#cmdoption-accountFreeze-reason">--reason  &#34;&#39;SOME REASON&#39;&#34;</a>
+</li>
+      </ul></li>
+      <li>
+    accountGeneratePassword command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountGeneratePassword.html#cmdoption-accountGeneratePassword-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountGeneratePassword.html#cmdoption-accountGeneratePassword-do-it">--do-it</a>
+</li>
+        <li><a href="plugins/restricted/accountGeneratePassword.html#cmdoption-accountGeneratePassword-size">--size    SIZE</a>
+</li>
+      </ul></li>
+      <li>
+    accountGrantCommand command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountGrantCommand.html#cmdoption-accountGrantCommand-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountGrantCommand.html#cmdoption-accountGrantCommand-command">--command COMMAND</a>
+</li>
+      </ul></li>
+      <li>
+    accountInfo command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-all">--all</a>
+</li>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-egress-keys">--with[out]-egress-keys</a>
+</li>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-everything">--with[out]-everything</a>
+</li>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-groups">--with[out]-groups</a>
+</li>
+        <li><a href="plugins/restricted/accountInfo.html#cmdoption-accountInfo-with-out-mfa-password-info">--with[out]-mfa-password-info</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    accountList command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-audit">--audit</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-exclude">--exclude PATTERN</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-inactive-only">--inactive-only</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-include">--include PATTERN</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-no-output">--no-output</a>
+</li>
+        <li><a href="plugins/restricted/accountList.html#cmdoption-accountList-no-password-info">--no-password-info</a>
+</li>
+      </ul></li>
+      <li>
+    accountListAccesses command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-exclude">--exclude PATTERN</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-hide-groups">--hide-groups</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-include">--include PATTERN</a>
+</li>
+        <li><a href="plugins/restricted/accountListAccesses.html#cmdoption-accountListAccesses-reverse-dns">--reverse-dns</a>
+</li>
+      </ul></li>
+      <li>
+    accountListEgressKeys command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountListEgressKeys.html#cmdoption-accountListEgressKeys-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountListIngressKeys command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountListIngressKeys.html#cmdoption-accountListIngressKeys-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountListPasswords command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountListPasswords.html#cmdoption-accountListPasswords-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountMFAResetPassword command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountMFAResetPassword.html#cmdoption-accountMFAResetPassword-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountMFAResetTOTP command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountMFAResetTOTP.html#cmdoption-accountMFAResetTOTP-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountModify command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-always-active">--always-active yes|no</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-egress-strict-host-key-checking">--egress-strict-host-key-checking POLICY</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-idle-ignore">--idle-ignore yes|no</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-max-inactive-days">--max-inactive-days DAYS</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-mfa-password-required">--mfa-password-required yes|no|bypass</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-mfa-totp-required">--mfa-totp-required yes|no|bypass</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-osh-only">--osh-only yes|no</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-pam-auth-bypass">--pam-auth-bypass yes|no</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-personal-egress-mfa-required">--personal-egress-mfa-required POLICY</a>
+</li>
+        <li><a href="plugins/restricted/accountModify.html#cmdoption-accountModify-pubkey-auth-optional">--pubkey-auth-optional yes|no</a>
+</li>
+      </ul></li>
+      <li>
+    accountPIV command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountPIV.html#cmdoption-accountPIV-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountPIV.html#cmdoption-accountPIV-policy">--policy  POLICY</a>
+</li>
+        <li><a href="plugins/restricted/accountPIV.html#cmdoption-accountPIV-ttl">--ttl SECONDS|DURATION</a>
+</li>
+      </ul></li>
+      <li>
+    accountRevokeCommand command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountRevokeCommand.html#cmdoption-accountRevokeCommand-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/restricted/accountRevokeCommand.html#cmdoption-accountRevokeCommand-command">--command COMMAND</a>
+</li>
+      </ul></li>
+      <li>
+    accountUnexpire command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountUnexpire.html#cmdoption-accountUnexpire-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountUnfreeze command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountUnfreeze.html#cmdoption-accountUnfreeze-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    accountUnlock command line option
+
+      <ul>
+        <li><a href="plugins/restricted/accountUnlock.html#cmdoption-accountUnlock-account">--account ACCOUNT</a>
+</li>
+      </ul></li>
+      <li>
+    admin_show_system_info (optional
+
+      <ul>
+        <li><a href="plugins/open/info.html#cmdoption-info-arg-admin_show_system_info">info command line option</a>
+</li>
+      </ul></li>
+      <li>
+    adminMaintenance command line option
+
+      <ul>
+        <li><a href="plugins/admin/adminMaintenance.html#cmdoption-adminMaintenance-lock">--lock</a>
+</li>
+        <li><a href="plugins/admin/adminMaintenance.html#cmdoption-adminMaintenance-message">--message MESSAGE</a>
+</li>
+        <li><a href="plugins/admin/adminMaintenance.html#cmdoption-adminMaintenance-unlock">--unlock</a>
+</li>
+      </ul></li>
+      <li>
+    adminSudo command line option
+
+      <ul>
+        <li><a href="plugins/admin/adminSudo.html#cmdoption-adminSudo-sudo-as">--sudo-as ACCOUNT</a>
+</li>
+        <li><a href="plugins/admin/adminSudo.html#cmdoption-adminSudo-sudo-cmd">--sudo-cmd PLUGIN</a>
+</li>
+      </ul></li>
+      <li>
+    alive command line option
+
+      <ul>
+        <li><a href="plugins/open/alive.html#cmdoption-alive-host">--host HOSTNAME</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="B">B</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    between 0 and 32)
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    boolean)
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-self_remote_user_only">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/open/info.html#cmdoption-info-arg-admin_show_system_info">info command line option</a>, <a href="plugins/open/info.html#cmdoption-info-arg-show_fortune">[1]</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-self_remote_user_only">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="C">C</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    clush command line option
+
+      <ul>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-command">--command &#39;&#34;remote cmd&#34;&#39;</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-list">--list HOSTLIST</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-no-confirm">--no-confirm</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-no-pause-on-failure">--no-pause-on-failure</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-port">--port PORT</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-step-by-step">--step-by-step</a>
+</li>
+        <li><a href="plugins/open/clush.html#cmdoption-clush-user">--user USER</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="G">G</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    groupAddAclkeeper command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupAddAclkeeper.html#cmdoption-groupAddAclkeeper-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddAclkeeper.html#cmdoption-groupAddAclkeeper-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupAddGatekeeper command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupAddGatekeeper.html#cmdoption-groupAddGatekeeper-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddGatekeeper.html#cmdoption-groupAddGatekeeper-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupAddGuestAccess command line option
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-comment">--comment &#39;&#34;ANY TEXT&#34;&#39;</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-host">--host HOST|IP</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-port">--port PORT</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-ttl">--ttl SECONDS|DURATION</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-user">--user USER</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddGuestAccess.html#cmdoption-groupAddGuestAccess-user-any">--user-any</a>
+</li>
+      </ul></li>
+      <li>
+    groupAddMember command line option
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupAddMember.html#cmdoption-groupAddMember-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupAddMember.html#cmdoption-groupAddMember-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupAddOwner command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupAddOwner.html#cmdoption-groupAddOwner-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupAddOwner.html#cmdoption-groupAddOwner-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupAddServer command line option
+
+      <ul>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-comment">--comment &#39;&#34;ANY TEXT&#39;&#34;</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-force">--force</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-force-key">--force-key FINGERPRINT</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-force-password">--force-password HASH</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-host">--host HOST|IP|NET/CIDR</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-port">--port PORT</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-ttl">--ttl SECONDS|DURATION</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-user">--user USER</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupAddServer.html#cmdoption-groupAddServer-user-any">--user-any</a>
+</li>
+      </ul></li>
+      <li>
+    groupCreate command line option
+
+      <ul>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-algo">--algo</a>
+</li>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-encrypted">--encrypted</a>
+</li>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-group">--group</a>
+</li>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-no-key">--no-key</a>
+</li>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-owner">--owner</a>
+</li>
+        <li><a href="plugins/restricted/groupCreate.html#cmdoption-groupCreate-size">--size</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelAclkeeper command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupDelAclkeeper.html#cmdoption-groupDelAclkeeper-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelAclkeeper.html#cmdoption-groupDelAclkeeper-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelEgressKey command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupDelEgressKey.html#cmdoption-groupDelEgressKey-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelEgressKey.html#cmdoption-groupDelEgressKey-id">--id ID</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelete command line option
+
+      <ul>
+        <li><a href="plugins/restricted/groupDelete.html#cmdoption-groupDelete-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/restricted/groupDelete.html#cmdoption-groupDelete-no-confirm">--no-confirm</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelGatekeeper command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupDelGatekeeper.html#cmdoption-groupDelGatekeeper-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelGatekeeper.html#cmdoption-groupDelGatekeeper-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelGuestAccess command line option
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-host">--host HOST|IP</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-port">--port PORT</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-user">--user USER</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelGuestAccess.html#cmdoption-groupDelGuestAccess-user-any">--user-any</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    groupDelMember command line option
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupDelMember.html#cmdoption-groupDelMember-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupDelMember.html#cmdoption-groupDelMember-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelOwner command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupDelOwner.html#cmdoption-groupDelOwner-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupDelOwner.html#cmdoption-groupDelOwner-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupDelServer command line option
+
+      <ul>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-host">--host HOST|IP|NET/CIDR</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-port">--port PORT</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-user">--user USER</a>
+</li>
+        <li><a href="plugins/group-aclkeeper/groupDelServer.html#cmdoption-groupDelServer-user-any">--user-any</a>
+</li>
+      </ul></li>
+      <li>
+    groupDestroy command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupDestroy.html#cmdoption-groupDestroy-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-owner/groupDestroy.html#cmdoption-groupDestroy-no-confirm">--no-confirm</a>
+</li>
+      </ul></li>
+      <li>
+    groupGenerateEgressKey command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-algo">--algo ALGO</a>
+</li>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-encrypted">--encrypted</a>
+</li>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-owner/groupGenerateEgressKey.html#cmdoption-groupGenerateEgressKey-size">--size SIZE</a>
+</li>
+      </ul></li>
+      <li>
+    groupGeneratePassword command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupGeneratePassword.html#cmdoption-groupGeneratePassword-do-it">--do-it</a>
+</li>
+        <li><a href="plugins/group-owner/groupGeneratePassword.html#cmdoption-groupGeneratePassword-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-owner/groupGeneratePassword.html#cmdoption-groupGeneratePassword-size">--size  SIZE</a>
+</li>
+      </ul></li>
+      <li>
+    groupInfo command line option
+
+      <ul>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-all">--all</a>
+</li>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-with-out-everything">--with[out]-everything</a>
+</li>
+        <li><a href="plugins/open/groupInfo.html#cmdoption-groupInfo-with-out-keys">--with[out]-keys</a>
+</li>
+      </ul></li>
+      <li>
+    groupList command line option
+
+      <ul>
+        <li><a href="plugins/open/groupList.html#cmdoption-groupList-all">--all</a>
+</li>
+        <li><a href="plugins/open/groupList.html#cmdoption-groupList-exclude">--exclude PATTERN</a>
+</li>
+        <li><a href="plugins/open/groupList.html#cmdoption-groupList-include">--include PATTERN</a>
+</li>
+      </ul></li>
+      <li>
+    groupListGuestAccesses command line option
+
+      <ul>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-exclude">--exclude PATTERN</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-include">--include PATTERN</a>
+</li>
+        <li><a href="plugins/group-gatekeeper/groupListGuestAccesses.html#cmdoption-groupListGuestAccesses-reverse-dns">--reverse-dns</a>
+</li>
+      </ul></li>
+      <li>
+    groupListPasswords command line option
+
+      <ul>
+        <li><a href="plugins/open/groupListPasswords.html#cmdoption-groupListPasswords-group">--group GROUP</a>
+</li>
+      </ul></li>
+      <li>
+    groupListServers command line option
+
+      <ul>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-exclude">--exclude PATTERN</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-group">--group GROUP</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-include">--include PATTERN</a>
+</li>
+        <li><a href="plugins/open/groupListServers.html#cmdoption-groupListServers-reverse-dns">--reverse-dns</a>
+</li>
+      </ul></li>
+      <li>
+    groupModify command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupModify.html#cmdoption-groupModify-group">--group             GROUP</a>
+</li>
+        <li><a href="plugins/group-owner/groupModify.html#cmdoption-groupModify-guest-ttl-limit">--guest-ttl-limit   DURATION</a>
+</li>
+        <li><a href="plugins/group-owner/groupModify.html#cmdoption-groupModify-mfa-required">--mfa-required      password|totp|any|none</a>
+</li>
+      </ul></li>
+      <li>
+    groupTransmitOwnership command line option
+
+      <ul>
+        <li><a href="plugins/group-owner/groupTransmitOwnership.html#cmdoption-groupTransmitOwnership-account">--account ACCOUNT</a>
+</li>
+        <li><a href="plugins/group-owner/groupTransmitOwnership.html#cmdoption-groupTransmitOwnership-group">--group GROUP</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="I">I</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    info command line option
+
+      <ul>
+        <li><a href="plugins/open/info.html#cmdoption-info-arg-admin_show_system_info">admin_show_system_info (optional</a>
+</li>
+        <li><a href="plugins/open/info.html#cmdoption-info-arg-admin_show_system_info">boolean)</a>, <a href="plugins/open/info.html#cmdoption-info-arg-show_fortune">[1]</a>
+</li>
+        <li><a href="plugins/open/info.html#cmdoption-info-arg-show_fortune">show_fortune (optional</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    integer
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="M">M</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    mtr command line option
+
+      <ul>
+        <li><a href="plugins/open/mtr.html#cmdoption-mtr-report">--report</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="N">N</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    nc command line option
+
+      <ul>
+        <li><a href="plugins/open/nc.html#cmdoption-nc-host">--host HOST</a>
+</li>
+        <li><a href="plugins/open/nc.html#cmdoption-nc-port">--port PORT</a>
+</li>
+        <li><a href="plugins/open/nc.html#cmdoption-nc-w">-w SECONDS</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="P">P</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    ping command line option
+
+      <ul>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-host">--host HOST</a>
+</li>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-c">-c COUNT</a>
+</li>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-s">-s SIZE</a>
+</li>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-t">-t TTL</a>
+</li>
+        <li><a href="plugins/open/ping.html#cmdoption-ping-w">-w TIMEOUT</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="R">R</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    realmCreate command line option
+
+      <ul>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-comment">--comment STRING</a>
+</li>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-from">--from</a>
+</li>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-public-key">--public-key KEY</a>
+</li>
+        <li><a href="plugins/restricted/realmCreate.html#cmdoption-realmCreate-realm">--realm   REALM</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    realmDelete command line option
+
+      <ul>
+        <li><a href="plugins/restricted/realmDelete.html#cmdoption-realmDelete-realm">--realm REALM</a>
+</li>
+      </ul></li>
+      <li>
+    realmInfo command line option
+
+      <ul>
+        <li><a href="plugins/restricted/realmInfo.html#cmdoption-realmInfo-realm">--realm REALM</a>
+</li>
+      </ul></li>
+      <li>
+    realmList command line option
+
+      <ul>
+        <li><a href="plugins/restricted/realmList.html#cmdoption-realmList-realm">--realm REALM</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="S">S</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    self_remote_user_only (optional
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-self_remote_user_only">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-self_remote_user_only">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+      <li>
+    selfAddIngressKey command line option
+
+      <ul>
+        <li><a href="plugins/open/selfAddIngressKey.html#cmdoption-selfAddIngressKey-piv">--piv</a>
+</li>
+        <li><a href="plugins/open/selfAddIngressKey.html#cmdoption-selfAddIngressKey-public-key">--public-key KEY</a>
+</li>
+      </ul></li>
+      <li>
+    selfAddPersonalAccess command line option
+
+      <ul>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-comment">--comment &#34;&#39;ANY TEXT&#39;&#34;</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-force">--force</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-force-key">--force-key FINGERPRINT</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-force-password">--force-password HASH</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-host">--host IP|HOST|IP/MASK</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-port">--port PORT</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-ttl">--ttl SECONDS|DURATION</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-user">--user USER</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-user-any">--user-any</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">between 0 and 32)</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-self_remote_user_only">boolean)</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">integer</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-self_remote_user_only">self_remote_user_only (optional</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">widest_v4_prefix (optional</a>
+</li>
+      </ul></li>
+      <li>
+    selfDelIngressKey command line option
+
+      <ul>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-f">--fingerprint-to-delete FP</a>
+</li>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-l">--id-to-delete ID</a>
+</li>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-f">-f</a>
+</li>
+        <li><a href="plugins/open/selfDelIngressKey.html#cmdoption-selfDelIngressKey-l">-l</a>
+</li>
+      </ul></li>
+      <li>
+    selfDelPersonalAccess command line option
+
+      <ul>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-host">--host IP|HOST|IP/MASK</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-port">--port PORT</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-port-any">--port-any</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-scpdown">--scpdown</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-scpup">--scpup</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-sftp">--sftp</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-user">--user USER</a>
+</li>
+        <li><a href="plugins/restricted/selfDelPersonalAccess.html#cmdoption-selfDelPersonalAccess-user-any">--user-any</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    selfForgetHostKey command line option
+
+      <ul>
+        <li><a href="plugins/open/selfForgetHostKey.html#cmdoption-selfForgetHostKey-host">--host HOST</a>
+</li>
+        <li><a href="plugins/open/selfForgetHostKey.html#cmdoption-selfForgetHostKey-port">--port PORT</a>
+</li>
+      </ul></li>
+      <li>
+    selfGenerateEgressKey command line option
+
+      <ul>
+        <li><a href="plugins/open/selfGenerateEgressKey.html#cmdoption-selfGenerateEgressKey-algo">--algo ALGO</a>
+</li>
+        <li><a href="plugins/open/selfGenerateEgressKey.html#cmdoption-selfGenerateEgressKey-encrypted">--encrypted</a>
+</li>
+        <li><a href="plugins/open/selfGenerateEgressKey.html#cmdoption-selfGenerateEgressKey-size">--size SIZE</a>
+</li>
+      </ul></li>
+      <li>
+    selfGeneratePassword command line option
+
+      <ul>
+        <li><a href="plugins/open/selfGeneratePassword.html#cmdoption-selfGeneratePassword-do-it">--do-it</a>
+</li>
+        <li><a href="plugins/open/selfGeneratePassword.html#cmdoption-selfGeneratePassword-size">--size SIZE</a>
+</li>
+      </ul></li>
+      <li>
+    selfGenerateProxyPassword command line option
+
+      <ul>
+        <li><a href="plugins/open/selfGenerateProxyPassword.html#cmdoption-selfGenerateProxyPassword-do-it">--do-it</a>
+</li>
+        <li><a href="plugins/open/selfGenerateProxyPassword.html#cmdoption-selfGenerateProxyPassword-size">--size SIZE</a>
+</li>
+      </ul></li>
+      <li>
+    selfListAccesses command line option
+
+      <ul>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-exclude">--exclude PATTERN</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-hide-groups">--hide-groups</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-include">--include PATTERN</a>
+</li>
+        <li><a href="plugins/open/selfListAccesses.html#cmdoption-selfListAccesses-reverse-dns">--reverse-dns</a>
+</li>
+      </ul></li>
+      <li>
+    selfListSessions command line option
+
+      <ul>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-after">--after WHEN</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-allowed">--allowed</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-before">--before WHEN</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-denied">--denied</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-detailed">--detailed</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-host">--host HOST</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-id">--id ID</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-limit">--limit LIMIT</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-to-port">--to-port PORT</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-type">--type TYPE</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-user">--user USER</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-via">--via HOST</a>
+</li>
+        <li><a href="plugins/open/selfListSessions.html#cmdoption-selfListSessions-via-port">--via-port PORT</a>
+</li>
+      </ul></li>
+      <li>
+    selfMFASetupPassword command line option
+
+      <ul>
+        <li><a href="plugins/open/selfMFASetupPassword.html#cmdoption-selfMFASetupPassword-yes">--yes</a>
+</li>
+      </ul></li>
+      <li>
+    selfMFASetupTOTP command line option
+
+      <ul>
+        <li><a href="plugins/open/selfMFASetupTOTP.html#cmdoption-selfMFASetupTOTP-no-confirm">--no-confirm</a>
+</li>
+      </ul></li>
+      <li>
+    selfPlaySession command line option
+
+      <ul>
+        <li><a href="plugins/open/selfPlaySession.html#cmdoption-selfPlaySession-id">--id ID</a>
+</li>
+      </ul></li>
+      <li>
+    show_fortune (optional
+
+      <ul>
+        <li><a href="plugins/open/info.html#cmdoption-info-arg-show_fortune">info command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+<h2 id="W">W</h2>
+<table style="width: 100%" class="indextable genindextable"><tr>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    whoHasAccessTo command line option
+
+      <ul>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-host">--host SERVER</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-ignore-group">--ignore-group GROUP</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-ignore-personal">--ignore-personal</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-port">--port PORT</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-show-wildcards">--show-wildcards</a>
+</li>
+        <li><a href="plugins/restricted/whoHasAccessTo.html#cmdoption-whoHasAccessTo-user">--user USER</a>
+</li>
+      </ul></li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
+      <li>
+    widest_v4_prefix (optional
+
+      <ul>
+        <li><a href="plugins/restricted/accountAddPersonalAccess.html#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">accountAddPersonalAccess command line option</a>
+</li>
+        <li><a href="plugins/restricted/selfAddPersonalAccess.html#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">selfAddPersonalAccess command line option</a>
+</li>
+      </ul></li>
+  </ul></td>
+</tr></table>
+
+
+
+           </div>
+          </div>
+          <footer>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/index.html b/index.html
new file mode 100644
index 000000000..73e4f01eb
--- /dev/null
+++ b/index.html
@@ -0,0 +1,437 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Welcome to The Bastion documentation! &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
+        <script src="_static/jquery.js"></script>
+        <script src="_static/underscore.js"></script>
+        <script src="_static/doctools.js"></script>
+    <script src="_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="Principles" href="presentation/principles.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="#" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="#">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="#" class="icon icon-home"></a> &raquo;</li>
+      <li>Welcome to The Bastion documentation!</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="_sources/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="welcome-to-the-bastion-documentation">
+<h1>Welcome to The Bastion documentation!<a class="headerlink" href="#welcome-to-the-bastion-documentation" title="Permalink to this headline"></a></h1>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>This documentation is in a WIP status, some edges might be rough!</p>
+</div>
+<section id="wait-what-s-a-bastion-exactly-in-140-ish-characters">
+<h2>Wait, what's a bastion exactly? (in 140-ish characters)<a class="headerlink" href="#wait-what-s-a-bastion-exactly-in-140-ish-characters" title="Permalink to this headline"></a></h2>
+<p>A so-called <strong>bastion</strong> is a machine used as a single entry point by operational teams (such as sysadmins, developers, devops, database admins, etc.) to securely connect to other machines of an infrastructure, usually using <cite>ssh</cite>.</p>
+<p>The bastion provides mechanisms for <em>authentication</em>, <em>authorization</em>, <em>traceability</em> and <em>auditability</em> for the whole infrastructure.</p>
+<section id="just-yet-another-ssh-relayhost-jumphost-gateway">
+<h3>Just yet another SSH relayhost/jumphost/gateway?<a class="headerlink" href="#just-yet-another-ssh-relayhost-jumphost-gateway" title="Permalink to this headline"></a></h3>
+<p>No, The Bastion is an entirely different beast.</p>
+<p>The key technical difference between those and The Bastion is that it strictly stands between you and the remote server, operating a protocol break in the process, which enables unique features such as tty recording, proper access auditability, builtin access and groups management commands, delegation of responsibilities all the way through, etc.</p>
+<p>Advanced uses even include doing other things than just SSHing to a remote server.</p>
+<p>Those wouldn't be possible with a &quot;simple&quot; jumphost. More technical details on the difference <a class="reference internal" href="faq.html#faq-jumphost"><span class="std std-ref">here</span></a>.</p>
+</section>
+</section>
+<section id="ok-tell-me-more">
+<h2>OK, tell me more!<a class="headerlink" href="#ok-tell-me-more" title="Permalink to this headline"></a></h2>
+<p>This documentation is organized in several sections. The first one is a <strong>PRESENTATION</strong> of the main functionalities, principles, and use cases of the bastion.</p>
+<p>The second section explains the <strong>INSTALLATION</strong> procedure, including how to set up a quick playground using Docker if you want to get your hands dirty quickly.</p>
+<p>The third section focuses on the <strong>USAGE</strong> of the bastion, from the perspective of the different roles, such as bastion users, group owners, bastion admins, etc.</p>
+<p>The fourth section is about the proper <strong>ADMINISTRATION</strong> of the bastion itself. If you're about to be the person in charge of managing the bastion for your company, you want to read that one carefully!</p>
+<p>The fifth section is about <strong>DEVELOPMENT</strong> and how to write code for the bastion. If you'd like to contribute, this is the section to read!</p>
+<p>The sixth section is the complete reference of all the <strong>PLUGINS</strong> that are the commands used to interact with the bastion accounts, groups, accesses, credentials, and more.</p>
+<p>The unavoidable and iconic FAQ is also available under the <strong>PRESENTATION</strong> section.</p>
+<div class="toctree-wrapper compound">
+<p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/security.html">Security</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="presentation/security.html#security-principles-at-the-core">Security principles at the core</a></li>
+<li class="toctree-l2"><a class="reference internal" href="presentation/security.html#auditability">Auditability</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="faq.html">FAQ</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#the-bastion-really">&quot;The Bastion&quot;, really?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#why-using-common-sense">Why using common::sense?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#why-perl">Why Perl?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#why-not-using-a-pki">Why not using a PKI?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#what-does-osh-mean-in-osh">What does <cite>osh</cite> mean in <code class="docutils literal notranslate"><span class="pre">--osh</span></code>?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#what-are-the-recommended-hardware-specifications">What are the recommended hardware specifications?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#can-i-run-it-under-docker-in-production">Can I run it under Docker in production?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#can-i-install-it-on-my-already-existing-server">Can I install it on my already existing server?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#how-to-use-the-bastion-with-the-ssh-proxycommand-option">How to use The Bastion with the SSH <code class="docutils literal notranslate"><span class="pre">ProxyCommand</span></code> option?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#what-is-session-locking">What is <em>session locking</em>?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="faq.html#can-i-use-ansible-over-the-bastion">Can I use Ansible over The Bastion?</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="toctree-wrapper compound">
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="installation/basic.html">Basic Installation</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#got-puppet">0. Got Puppet?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#operating-system">1. Operating system</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#connect-to-your-server-as-root">2. Connect to your server as root</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#get-the-code">3. Get the code</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#install-the-needed-packages">4. Install the needed packages</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#encrypt-home">5. Encrypt /home</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#setup-bastion-and-system-configuration">6. Setup bastion and system configuration</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#review-the-configuration">7. Review the configuration</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#check-that-the-code-works-on-your-machine">8. Check that the code works on your machine</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/basic.html#manually-create-our-first-bastion-account">9. Manually create our first bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="installation/advanced.html">Advanced Installation</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#encryption-signature-gpg-keys">Encryption &amp; signature GPG keys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#rotation-encryption-backup-of-ttyrec-files">Rotation, encryption &amp; backup of ttyrec files</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#configuring-keys-accounts-groups-remote-backup">Configuring keys, accounts &amp; groups remote backup</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#logs-syslog">Logs/Syslog</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#clustering-high-availability">Clustering (High Availability)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#creating-sshfp-dns-records">Creating SSHFP DNS records</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#hardening-the-ssh-configuration">Hardening the SSH configuration</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/advanced.html#fa-root-authentication">2FA root authentication</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="installation/upgrading.html">Upgrading</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="installation/upgrading.html#general-upgrade-instructions">General upgrade instructions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/upgrading.html#version-specific-upgrade-instructions">Version-specific upgrade instructions</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/restoring_from_backup.html">Restoring from backup</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="installation/restoring_from_backup.html#prerequisites">Prerequisites</a></li>
+<li class="toctree-l2"><a class="reference internal" href="installation/restoring_from_backup.html#steps">Steps</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="toctree-wrapper compound">
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="using/basics/index.html">The basics</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="using/basics/first_steps.html">First steps</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/basics/access_management.html">Access management</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="using/piv.html">PIV keys support</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="using/piv.html#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/piv.html#without-a-policy">Without a policy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/piv.html#per-account-policy">Per-account policy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/piv.html#global-policy">Global policy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/piv.html#temporary-grace-period">Temporary grace period</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="using/sftp_scp.html">SFTP &amp; SCP support</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="using/sftp_scp.html#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/sftp_scp.html#prerequisites">Prerequisites</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/sftp_scp.html#basic-usage">Basic usage</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/sftp_scp.html#access-model">Access model</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="using/http_proxy.html">HTTPS Proxy</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="using/http_proxy.html#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/http_proxy.html#query-workflow">Query workflow</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/http_proxy.html#setting-up-the-https-proxy">Setting up the HTTPS Proxy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/http_proxy.html#running-a-query-through-the-proxy">Running a query through the proxy</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="using/api.html">JSON API</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="using/api.html#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/api.html#examples">Examples</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/api.html#json-payload-format">JSON payload format</a></li>
+<li class="toctree-l2"><a class="reference internal" href="using/api.html#good-practices">Good practices</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="using/specific_ssh_clients_tutorials/putty.html">Using PuTTY with The Bastion</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="toctree-wrapper compound">
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="administration/configuration/index.html">Configuration files</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="administration/configuration/index.html#main-configuration-files">Main configuration files</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/configuration/index.html#configuration-files-for-satellite-scripts">Configuration files for satellite scripts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="administration/logs.html">Logs</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="administration/logs.html#message-types">Message types</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/logs.html#syslog">Syslog</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/logs.html#access-logs">Access logs</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/logs.html#sqlite-logs">SQLite logs</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/logs.html#terminal-recordings-ttyrec">Terminal recordings (<em>ttyrec</em>)</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="administration/mfa.html">Multi-Factor Authentication</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="administration/mfa.html#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/mfa.html#immediate-mfa">Immediate MFA</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/mfa.html#jit-mfa">JIT MFA</a></li>
+<li class="toctree-l2"><a class="reference internal" href="administration/mfa.html#additional-information">Additional information</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="administration/security_advisories.html">Security Advisories</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="administration/security_advisories/cve_2023_45140.html">CVE-2023-45140</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="toctree-wrapper compound">
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="development/setup.html">Environment setup</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="development/setup.html#available-tools">Available tools</a></li>
+<li class="toctree-l2"><a class="reference internal" href="development/setup.html#git-pre-commit-hook">Git pre-commit hook</a></li>
+<li class="toctree-l2"><a class="reference internal" href="development/setup.html#running-integration-tests">Running integration tests</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="development/tests.html">Writing tests</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="development/tests.html#example">Example</a></li>
+<li class="toctree-l2"><a class="reference internal" href="development/tests.html#reference">Reference</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="toctree-wrapper compound" id="plugins">
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="plugins/admin/index.html">admin plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="plugins/admin/adminMaintenance.html">adminMaintenance</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/admin/adminSudo.html">adminSudo</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-aclkeeper/groupAddServer.html">groupAddServer</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-aclkeeper/groupDelServer.html">groupDelServer</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-gatekeeper/groupAddGuestAccess.html">groupAddGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-gatekeeper/groupAddMember.html">groupAddMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-gatekeeper/groupDelGuestAccess.html">groupDelGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-gatekeeper/groupDelMember.html">groupDelMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-gatekeeper/groupListGuestAccesses.html">groupListGuestAccesses</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-owner/index.html">group-owner plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/group-owner/groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/open/index.html">open plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/open/unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/restricted/index.html">restricted plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="plugins/restricted/whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+<section id="indices-and-tables">
+<h2>Indices and tables<a class="headerlink" href="#indices-and-tables" title="Permalink to this headline"></a></h2>
+<ul class="simple">
+<li><p><a class="reference internal" href="genindex.html"><span class="std std-ref">Index</span></a></p></li>
+<li><p><a class="reference internal" href="search.html"><span class="std std-ref">Search Page</span></a></p></li>
+</ul>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="presentation/principles.html" class="btn btn-neutral float-right" title="Principles" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/installation/advanced.html b/installation/advanced.html
new file mode 100644
index 000000000..e2da7ce1c
--- /dev/null
+++ b/installation/advanced.html
@@ -0,0 +1,610 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Advanced Installation &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Upgrading" href="upgrading.html" />
+    <link rel="prev" title="Basic Installation" href="basic.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basic.html">Basic Installation</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Advanced Installation</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#encryption-signature-gpg-keys">Encryption &amp; signature GPG keys</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#generating-the-bastion-gpg-key">Generating the bastion GPG key</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#generating-and-importing-the-admins-gpg-key">Generating and importing the admins GPG key</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#rotation-encryption-backup-of-ttyrec-files">Rotation, encryption &amp; backup of ttyrec files</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#configuring-keys-accounts-groups-remote-backup">Configuring keys, accounts &amp; groups remote backup</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#logs-syslog">Logs/Syslog</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#clustering-high-availability">Clustering (High Availability)</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#allowing-the-master-to-connect-to-the-slave">Allowing the master to connect to the slave</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#pushing-the-accounts-and-groups-files-to-the-slave">Pushing the accounts and groups files to the slave</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#ensuring-the-uids-gids-are-in-sync">Ensuring the UIDs/GIDs are in sync</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#enabling-the-synchronization">Enabling the synchronization</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#creating-sshfp-dns-records">Creating SSHFP DNS records</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#hardening-the-ssh-configuration">Hardening the SSH configuration</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#fa-root-authentication">2FA root authentication</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Advanced Installation</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/installation/advanced.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="advanced-installation">
+<h1>Advanced Installation<a class="headerlink" href="#advanced-installation" title="Permalink to this headline"></a></h1>
+<p>This section goes further in explaining how to setup your bastion.
+You should have completed the <a class="reference internal" href="basic.html"><span class="doc">basic installation</span></a> first.</p>
+<section id="encryption-signature-gpg-keys">
+<span id="installadv-gpg"></span><h2>Encryption &amp; signature GPG keys<a class="headerlink" href="#encryption-signature-gpg-keys" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This section is a prequisite to both the <a class="reference internal" href="#installadv-encryptrsync"><span class="std std-ref">Rotation, encryption &amp; backup of ttyrec files</span></a> and the
+<a class="reference internal" href="#installadv-backup"><span class="std std-ref">Configuring keys, accounts &amp; groups remote backup</span></a> steps further down this documentation</p>
+</div>
+<p>There are 2 pairs of GPG keys being used by the bastion:</p>
+<ul class="simple">
+<li><p>The <em>bastion GPG key</em></p>
+<ul>
+<li><p>The <strong>private</strong> key is used by the <strong>bastion</strong> to <strong>sign</strong> the ttyrec files</p></li>
+<li><p>The <strong>public</strong> key is used by the <strong>admins</strong> to <strong>verify</strong> the signature and prove
+non-repudiation and non-tampering of the ttyrec files</p></li>
+</ul>
+</li>
+<li><p>The <em>admins GPG key</em></p>
+<ul>
+<li><p>The <strong>public</strong> key is used by the <strong>bastion</strong> to <strong>encrypt</strong> the backups and the ttyrec files</p></li>
+<li><p>The <strong>private</strong> key is used by the <strong>admins</strong> to <strong>decrypt</strong> the backups when
+a restore operation is needed, and the ttyrec files</p></li>
+</ul>
+</li>
+</ul>
+<section id="generating-the-bastion-gpg-key">
+<h3>Generating the bastion GPG key<a class="headerlink" href="#generating-the-bastion-gpg-key" title="Permalink to this headline"></a></h3>
+<p>Generate a GPG key that will be used by the bastion to sign files,
+this might take a while especially if the server is idle:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"> /opt/bastion/bin/admin/setup-gpg.sh --generate
+</span>
+ gpg: directory <span class="sb">`</span>/root/.gnupg<span class="s1">&#39; created</span>
+<span class="s1"> gpg: Generating GPG key, it&#39;</span>ll take some time.
+
+ Not enough random bytes available.  Please <span class="k">do</span> some other work to give
+ the OS a chance to collect more entropy! <span class="o">(</span>Need <span class="m">39</span> more bytes<span class="o">)</span>
+ ..........+++++
+ gpg: /root/.gnupg/trustdb.gpg: trustdb created
+ gpg: key A4480F26 marked as ultimately trusted
+ gpg: <span class="k">done</span>
+ gpg: checking the trustdb
+ gpg: <span class="m">3</span> marginal<span class="o">(</span>s<span class="o">)</span> needed, <span class="m">1</span> complete<span class="o">(</span>s<span class="o">)</span> needed, PGP trust model
+ gpg: depth: <span class="m">0</span>  valid:   <span class="m">1</span>  signed:   <span class="m">0</span>  trust: <span class="m">0</span>-, 0q, 0n, 0m, 0f, 1u
+
+ Configuration file /etc/bastion/osh-encrypt-rsync.conf.d/50-gpg-bastion-key.conf updated:
+ <span class="m">8</span>&lt;---8&lt;---8&lt;---8&lt;---8&lt;---8&lt;--
+ <span class="c1"># autogenerated with /opt/bastion/bin/admin/setup-gpg.sh at Wed Mar 21 10:03:08 CET 2018</span>
+ <span class="o">{</span>
+     <span class="s2">&quot;signing_key_passphrase&quot;</span>: <span class="s2">&quot;************&quot;</span>,
+     <span class="s2">&quot;signing_key&quot;</span>: <span class="s2">&quot;5D3CFDFFA4480F26&quot;</span>
+ <span class="o">}</span>
+ ---&gt;8---&gt;8---&gt;8---&gt;8---&gt;8---&gt;8
+
+ Done.
+</pre></div>
+</div>
+<p>While it's working, you can proceed to the section below.</p>
+</section>
+<section id="generating-and-importing-the-admins-gpg-key">
+<h3>Generating and importing the admins GPG key<a class="headerlink" href="#generating-and-importing-the-admins-gpg-key" title="Permalink to this headline"></a></h3>
+<p>You should import on the bastion one or more <strong>public</strong> GPG keys that'll be used for encryption.
+If you don't already have a GPG key for this, you can generate one. As this is the admin GPG key,
+don't generate it on the bastion itself, but on the desk of the administrator (you?) instead.</p>
+<p>If you're running a reasonably recent GnuPG version (and the bastion does, too),
+i.e. GnuPG &gt;= 2.1.x, then you can generate an Ed25519 key by running:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"> <span class="nv">myname</span><span class="o">=</span><span class="s1">&#39;John Doe&#39;</span>
+</span><span class="hll"> <span class="nv">email</span><span class="o">=</span><span class="s1">&#39;jd@example.org&#39;</span>
+</span><span class="hll"> <span class="nv">bastion</span><span class="o">=</span><span class="s1">&#39;mybastion4.example.org&#39;</span>
+</span><span class="hll"> <span class="nv">pass</span><span class="o">=</span><span class="k">$(</span>pwgen -sy <span class="m">12</span> <span class="m">1</span><span class="k">)</span>
+</span><span class="hll"> <span class="nb">echo</span> <span class="s2">&quot;The passphrase for the key will be: </span><span class="nv">$pass</span><span class="s2">&quot;</span>
+</span><span class="hll"> gpg --batch --pinentry-mode loopback --passphrase-fd <span class="m">0</span> --quick-generate-key <span class="s2">&quot;</span><span class="nv">$myname</span><span class="s2"> &lt;</span><span class="nv">$email</span><span class="s2">&gt;&quot;</span> ed25519 sign <span class="m">0</span> <span class="o">&lt;&lt;&lt;</span> <span class="s2">&quot;</span><span class="nv">$pass</span><span class="s2">&quot;</span>
+</span><span class="hll"> <span class="nv">fpr</span><span class="o">=</span><span class="k">$(</span>gpg --list-keys <span class="s2">&quot;</span><span class="nv">$myname</span><span class="s2"> &lt;</span><span class="nv">$email</span><span class="s2">&gt;&quot;</span> <span class="p">|</span> grep -Eo <span class="s1">&#39;[A-F0-9]{40}&#39;</span><span class="k">)</span>
+</span><span class="hll"> gpg --batch --pinentry-mode loopback --passphrase-fd <span class="m">0</span> --quick-add-key <span class="s2">&quot;</span><span class="nv">$fpr</span><span class="s2">&quot;</span> cv25519 encr <span class="m">0</span> <span class="o">&lt;&lt;&lt;</span> <span class="s2">&quot;</span><span class="nv">$pass</span><span class="s2">&quot;</span>
+</span>
+ gpg: key 3F379CA7ECDF0537 marked as ultimately trusted
+ gpg: directory <span class="s1">&#39;/home/user/.gnupg/openpgp-revocs.d&#39;</span> created
+ gpg: revocation certificate stored as <span class="s1">&#39;/home/user/.gnupg/openpgp-revocs.d/3DFB21E3857F562A603BD4F83F379CA7ECDF0537.rev&#39;</span>
+</pre></div>
+</div>
+<p>If you or the bastion is using an older version of GnuPG, or you are unsure and/or prefer compatibility
+over speed or security, you can fallback to an RSA 4096 key:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"> <span class="nv">myname</span><span class="o">=</span><span class="s1">&#39;John Doe&#39;</span>
+</span><span class="hll"> <span class="nv">email</span><span class="o">=</span><span class="s1">&#39;jd@example.org&#39;</span>
+</span><span class="hll"> <span class="nv">bastion</span><span class="o">=</span><span class="s1">&#39;mybastion4.example.org&#39;</span>
+</span><span class="hll"> <span class="nv">pass</span><span class="o">=</span><span class="sb">`</span>pwgen -sy <span class="m">12</span> <span class="m">1</span><span class="sb">`</span>
+</span><span class="hll"> <span class="nb">echo</span> <span class="s2">&quot;The passphrase for the key will be: </span><span class="nv">$pass</span><span class="s2">&quot;</span>
+</span><span class="hll"> <span class="nb">printf</span> <span class="s2">&quot;Key-Type: RSA\nKey-Length: 4096\nSubkey-Type: RSA\nSubkey-Length: 4096\n&quot;</span> <span class="se">\</span>
+</span><span class="hll">   <span class="s2">&quot;Name-Real: %s\nName-Comment: %s\nName-Email: %s\nExpire-Date: 0\n&quot;</span> <span class="se">\</span>
+</span><span class="hll">   <span class="s2">&quot;Passphrase: %s\n%%echo Generating GPG key\n%%commit\n%%echo done\n&quot;</span> <span class="se">\</span>
+</span><span class="hll">   <span class="s2">&quot;</span><span class="nv">$myname</span><span class="s2"> (</span><span class="nv">$bastion</span><span class="s2">)&quot;</span> <span class="k">$(</span>date +%Y<span class="k">)</span> <span class="s2">&quot;</span><span class="nv">$email</span><span class="s2">&quot;</span> <span class="s2">&quot;</span><span class="nv">$pass</span><span class="s2">&quot;</span> <span class="p">|</span> gpg --gen-key --batch
+</span>
+ The passphrase <span class="k">for</span> the key will be: ************
+ gpg: Generating GPG key
+
+ Not enough random bytes available.  Please <span class="k">do</span> some other work to give
+ the OS a chance to collect more entropy! <span class="o">(</span>Need <span class="m">119</span> more bytes<span class="o">)</span>
+ .....+++++
+
+ gpg: key D2BDF9B5 marked as ultimately trusted
+ gpg: <span class="k">done</span>
+</pre></div>
+</div>
+<p>Of course, in both snippets above, adjust the <code class="docutils literal notranslate"><span class="pre">myname</span></code>, <code class="docutils literal notranslate"><span class="pre">email</span></code> and <code class="docutils literal notranslate"><span class="pre">bastion</span></code> variables accordingly.
+Write down the passphrase in a secure vault. All bastions admins will need it if they are to decrypt ttyrec files
+later for inspection, and also decrypt the backup should a restore be needed.
+When the key is done being generated, get the public key with:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">gpg -a --export <span class="s2">&quot;</span><span class="nv">$myname</span><span class="s2"> &lt;</span><span class="nv">$email</span><span class="s2">&gt;&quot;</span>
+</span></pre></div>
+</div>
+<p>Copy it to your clipboard, then back to the bastion, paste it at the following prompt:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"> /opt/bastion/bin/admin/setup-gpg.sh --import
+</span></pre></div>
+</div>
+<p>Also export the private admins GPG key to a secure vault (if you want the same key to be shared by the admins):</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"> gpg --export-secret-keys --armor <span class="s2">&quot;</span><span class="nv">$myname</span><span class="s2"> &lt;</span><span class="nv">$email</span><span class="s2">&gt;&quot;</span>
+</span></pre></div>
+</div>
+</section>
+</section>
+<section id="rotation-encryption-backup-of-ttyrec-files">
+<span id="installadv-encryptrsync"></span><h2>Rotation, encryption &amp; backup of ttyrec files<a class="headerlink" href="#rotation-encryption-backup-of-ttyrec-files" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>The above section <a class="reference internal" href="#installadv-gpg"><span class="std std-ref">Encryption &amp; signature GPG keys</span></a> is a prerequisite to this one</p>
+</div>
+<p>The configuration file is located in <code class="docutils literal notranslate"><span class="pre">/etc/bastion/osh-encrypt-rsync.conf</span></code>.
+You can ignore the <code class="docutils literal notranslate"><span class="pre">signing_key</span></code>, <code class="docutils literal notranslate"><span class="pre">signing_key_passphrase</span></code> and <code class="docutils literal notranslate"><span class="pre">recipients</span></code> options,
+as these have been auto-filled when you generated the GPG keys, by dropping configuration files
+in the <code class="docutils literal notranslate"><span class="pre">/etc/bastion/osh-encrypt-rsync.conf.d</span></code> directory.
+Any file there takes precedence over the global configuration file.</p>
+<p>Once you are done with your configuration, you might want to test it by running:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+</pre></div>
+</div>
+<p>Or even go further by starting the script in dry-run mode:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/cron/osh-encrypt-rsync.pl --dry-run
+</pre></div>
+</div>
+</section>
+<section id="configuring-keys-accounts-groups-remote-backup">
+<span id="installadv-backup"></span><h2>Configuring keys, accounts &amp; groups remote backup<a class="headerlink" href="#configuring-keys-accounts-groups-remote-backup" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>The above section <a class="reference internal" href="#installadv-gpg"><span class="std std-ref">Encryption &amp; signature GPG keys</span></a> is a prerequisite to this one, otherwise your backups will NOT
+be automatically encrypted, which is something you probably want to avoid.</p>
+</div>
+<p>Everything that is needed to restore a bastion from backup (keys, accounts, groups, etc.) is backed up daily
+in <code class="docutils literal notranslate"><span class="pre">/root/backups</span></code> by default.</p>
+<p>If you want to push these backups to a remote location, which is warmly advised,
+you have to specify the remote location to <code class="docutils literal notranslate"><span class="pre">scp</span></code> the backup archives to.
+The configuration file is <code class="docutils literal notranslate"><span class="pre">/etc/bastion/osh-backup-acl-keys.conf</span></code>,
+and you should specify the <code class="docutils literal notranslate"><span class="pre">PUSH_REMOTE</span></code> and <code class="docutils literal notranslate"><span class="pre">PUSH_OPTIONS</span></code>.</p>
+<p>To verify that the script is correctly able to connect remotely (and also validate the remote hostkey),
+start the script manually:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"> /opt/bastion/bin/cron/osh-backup-acl-keys.sh
+</span>
+ Pushing backup file <span class="o">(</span>/root/backups/backup-2020-05-25.tar.gz.gpg<span class="o">)</span> remotely...
+ backup-2020-05-25.tar.gz.gpg
+ <span class="m">100</span>%   21MB  <span class="m">20</span>.8MB/s   <span class="m">00</span>:00
+</pre></div>
+</div>
+<p>Also verify that the extension is <code class="docutils literal notranslate"><span class="pre">.gpg</span></code>, as seen above,
+which indicates that the script successfully encrypted the backup.</p>
+</section>
+<section id="logs-syslog">
+<h2>Logs/Syslog<a class="headerlink" href="#logs-syslog" title="Permalink to this headline"></a></h2>
+<p>It is advised to use syslog for The Bastion application logs.
+This can be configured in <code class="docutils literal notranslate"><span class="pre">/etc/bastion/bastion.conf</span></code> with the parameter <code class="docutils literal notranslate"><span class="pre">enableSyslog</span></code>.</p>
+<p>There is a default <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code> configuration provided, if you happen to use it.
+The file can be found as <code class="docutils literal notranslate"><span class="pre">etc/syslog-ng/conf.d/20-bastion.conf.dist</span></code> in the repository.
+Please read the comments in the file to know how to integrate it properly in your system.</p>
+</section>
+<section id="clustering-high-availability">
+<span id="installadv-ha"></span><h2>Clustering (High Availability)<a class="headerlink" href="#clustering-high-availability" title="Permalink to this headline"></a></h2>
+<p>The bastions can work in a cluster, with N instances. In that case, there is one <em>master</em> instance,
+where any modification command can be used (creating accounts, deleting groups, granting accesses),
+and N-1 <em>slave</em> instances, where only <em>readonly</em> actions are permitted. Any of these instances may be
+promoted, should the need arise.</p>
+<p>Note that any instance can be used to connect to infrastructures, so in effect all instances can always be used
+at the same time. You may set up a DNS round-robin hostname, with all the instances IPs declared,
+so that clients automatically choose a random instance, without having to rely on another external component
+such as a load-balancer. Note that if you do this, you'll need all the instances to share the same SSH host keys.</p>
+<p>Before setting up the slave instance, you should have the two bastions up and running
+(follow the normal installation documentation). Then, to set up the synchronization between the
+instances, proceed as explained below.</p>
+<section id="allowing-the-master-to-connect-to-the-slave">
+<h3>Allowing the master to connect to the slave<a class="headerlink" href="#allowing-the-master-to-connect-to-the-slave" title="Permalink to this headline"></a></h3>
+<p>On the slave, set the <code class="docutils literal notranslate"><span class="pre">readOnlySlaveMode</span></code> option in the <code class="docutils literal notranslate"><span class="pre">/etc/bastion/bastion.conf</span></code> file to <code class="docutils literal notranslate"><span class="pre">true</span></code>:</p>
+<div class="literal-block-wrapper docutils container" id="id1">
+<div class="code-block-caption"><span class="caption-text">run this on the SLAVE:</span><a class="headerlink" href="#id1" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">vim /etc/bastion/bastion.conf
+</span></pre></div>
+</div>
+</div>
+<p>This will instruct this bastion instance to deny any modification plugin,
+so that changes can only be done through the master.</p>
+<p>Then, append the master bastion synchronization public SSH keyfile,
+found in <code class="file docutils literal notranslate"><span class="pre">~root/.ssh/id_master2slave.pub</span></code> on the master instance,
+to <code class="file docutils literal notranslate"><span class="pre">~bastionsync/.ssh/authorized_keys</span></code> on the slave,
+with the following prefix: <code class="docutils literal notranslate"><span class="pre">from=&quot;IP.OF.THE.MASTER&quot;,restrict</span></code></p>
+<p>Hence the file should look like this:</p>
+<div class="literal-block-wrapper docutils container" id="id2">
+<div class="code-block-caption"><span class="caption-text">run this on the SLAVE:</span><a class="headerlink" href="#id2" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">cat ~bastionsync/.ssh/authorized_keys
+</span><span class="nv">from</span><span class="o">=</span><span class="s2">&quot;198.51.100.42&quot;</span>,restrict ssh-ed25519 AAA<span class="o">[</span>...<span class="o">]</span>
+</pre></div>
+</div>
+</div>
+</section>
+<section id="pushing-the-accounts-and-groups-files-to-the-slave">
+<h3>Pushing the accounts and groups files to the slave<a class="headerlink" href="#pushing-the-accounts-and-groups-files-to-the-slave" title="Permalink to this headline"></a></h3>
+<p>Check that the key setup has been done correctly by launching the following command under the <code class="docutils literal notranslate"><span class="pre">root</span></code> account:</p>
+<div class="literal-block-wrapper docutils container" id="id3">
+<div class="code-block-caption"><span class="caption-text">run this on the MASTER:</span><a class="headerlink" href="#id3" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">rsync -v --rsh <span class="s2">&quot;ssh -i /root/.ssh/id_master2slave&quot;</span> /etc/passwd /etc/group bastionsync@IP.OF.THE.SLAVE:/root/
+</span>group
+passwd
+
+sent <span class="m">105</span>,512 bytes  received <span class="m">8</span>,046 bytes  <span class="m">75</span>,705.33 bytes/sec
+total size is <span class="m">1</span>,071,566  speedup is <span class="m">9</span>.44
+</pre></div>
+</div>
+</div>
+<p>If this works correctly, you'll have two new files in the <code class="file docutils literal notranslate"><span class="pre">/root</span></code> directory of the slave instance.
+We'll need those for the next step, which is verifying that the UIDs/GIDs of the slave instance are matching
+the master instance's ones. Indeed, the sync of the  <code class="docutils literal notranslate"><span class="pre">/etc/passwd</span></code> and <code class="docutils literal notranslate"><span class="pre">/etc/group</span></code> files can have adverse effects
+on a newly installed machine where the packages were not installed in the same order than on the master, hence having
+possibly mismatching UIDs/GIDs for the same users/groups.</p>
+<p>The next step ensures these are matching between the master and the slave before actually enabling the synchronization.</p>
+</section>
+<section id="ensuring-the-uids-gids-are-in-sync">
+<span id="installadv-ha-uidgidsync"></span><h3>Ensuring the UIDs/GIDs are in sync<a class="headerlink" href="#ensuring-the-uids-gids-are-in-sync" title="Permalink to this headline"></a></h3>
+<p>Now that we have the master's <code class="file docutils literal notranslate"><span class="pre">/etc/passwd</span></code> and <code class="file docutils literal notranslate"><span class="pre">/etc/group</span></code> files in the slave's <code class="file docutils literal notranslate"><span class="pre">/root</span></code> folder,
+we can use a helper script to check for the UIDs/GIDs matches between the master and the slave.
+This script's job is to check whether there is any discrepancy, and if this is the case, generate another script,
+tailored to your case, to fix them:</p>
+<div class="literal-block-wrapper docutils container" id="id4">
+<div class="code-block-caption"><span class="caption-text">run this on the SLAVE:</span><a class="headerlink" href="#id4" title="Permalink to this code"></a></div>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">/opt/bastion/bin/admin/check_uid_gid_collisions.pl --master-passwd /root/passwd --master-group /root/group --output /root/syncids.sh
+</span>WARN: local orphan group: local group 50 (with name &#39;staff&#39;) is only present locally, if you want to keep it, create it on the master first or it&#39;ll be erased
+
+There is at least one warning, see above.
+If you want to handle them, you may still abort now.
+Type &#39;YES&#39; to proceed regardless.
+</pre></div>
+</div>
+</div>
+<p>In the example above, the script warns us that some accounts or groups are only existing on the slave instance,
+and not at all on the master. In this case, it's up to you to know what you want to do. If you choose to ignore it,
+these accounts and groups will be erased on the first synchronization, as the master will push its own accounts and
+groups to the slave instance. Such a discrepancy shouldn't happen as long as you're using the same OS and distro
+on both sides. It may happen if you have installed more packages on the slave instance than on the master, as some
+packages also create system groups or accounts. A possible fix is to install the same packages on the master, and/or
+simply adding the account(s) and/or group(s) on the master, so that they're synchronized everywhere.</p>
+<p>If you type 'YES' or simply don't have any warnings, you should see something like this:</p>
+<div class="literal-block-wrapper docutils container" id="id5">
+<div class="code-block-caption"><span class="caption-text">(output continued)</span><a class="headerlink" href="#id5" title="Permalink to this code"></a></div>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Name collision on UID: master UID 38 exists on local but with a different name (master=gnats local=list)
+-&gt; okay, offsetting local UID 38 to 50000038
+Differing name attached to same UID: master UID 38 doesn&#39;t exist on local, but its corresponding name &#39;gnats&#39; does, with local UID 41
+Name collision on UID: master UID 39 exists on local but with a different name (master=list local=irc)
+-&gt; okay, offsetting local UID 39 to 50000039
+[...]
+You may now review the generated script (/root/syncids.sh) and launch it when you&#39;re ready.
+Note that you&#39;ll have to reboot once the script has completed.
+</pre></div>
+</div>
+</div>
+<p>The generated script is found at the location you've specified, which is <code class="file docutils literal notranslate"><span class="pre">/root/syncids.sh</span></code> if you used
+the command-line we suggested above. Reviewing this script is important, as this is the one that will be making
+UIDs/GIDs modification to your slave instance, as to sync them to the master's ones, including propagating these
+changes on your filesystem, using <code class="docutils literal notranslate"><span class="pre">chmod</span></code> and <code class="docutils literal notranslate"><span class="pre">chgrp</span></code> commands.</p>
+<p>Once you're ready (note that you'll have to reboot the slave right after), you may run the generated script:</p>
+<div class="literal-block-wrapper docutils container" id="id6">
+<div class="code-block-caption"><span class="caption-text">run this on the SLAVE:</span><a class="headerlink" href="#id6" title="Permalink to this code"></a></div>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bash /root/syncids.sh
+</span>
+We&#39;ll change the UIDs/GIDs of files, when needed, in the following mountpoints: / /home /run /run/lock /run/snapd/ns /run/user/1001 /run/user/1001/doc /run/user/1001/gvfs
+If you&#39;d like to change this list, please edit this script and change the &#39;fslist&#39; variable in the header.
+Otherwise, if this sounds reasonable (e.g. there is no remotely mounted filesystem that you don&#39;t want us to touch), say &#39;YES&#39; below:
+</pre></div>
+</div>
+</div>
+<p>Please review the listed mountpoints (obviously, they'll be different than the ones above). As stated you may
+edit the script to adjust them if needed. If any UID/GID needs to be changed to be in sync with the master,
+the script will ensure the changes are propagated to the specified filesystems. You might want to exclude
+network-mounted filesystems and such, if any. The script does its best to do this for you, but you should ensure
+that it has got it right.</p>
+<p>Then, the script may list the daemons and running processes that it'll need to kill before doing the changes,
+as Linux forbids changing UIDs/GIDs when they're used by a process. This is why a reboot is needed at the end.</p>
+<div class="literal-block-wrapper docutils container" id="id7">
+<div class="code-block-caption"><span class="caption-text">(output continued)</span><a class="headerlink" href="#id7" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>The following processes/daemons will need to be killed before swapping the UIDs/GIDs:
+USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
+kernoops    <span class="m">2484</span>  <span class="m">0</span>.0  <span class="m">0</span>.0  <span class="m">11264</span>   <span class="m">440</span> ?        Ss   Apr11   <span class="m">0</span>:04 /usr/sbin/kerneloops
+whoopsie    <span class="m">2467</span>  <span class="m">0</span>.0  <span class="m">0</span>.0 <span class="m">253440</span> <span class="m">11860</span> ?        Ssl  Apr11   <span class="m">0</span>:00 /usr/bin/whoopsie -f
+colord      <span class="m">2227</span>  <span class="m">0</span>.0  <span class="m">0</span>.0 <span class="m">249220</span> <span class="m">13180</span> ?        Ssl  Apr11   <span class="m">0</span>:00 /usr/libexec/colord
+geoclue     <span class="m">2091</span>  <span class="m">0</span>.0  <span class="m">0</span>.1 <span class="m">905392</span> <span class="m">20268</span> ?        Ssl  Apr11   <span class="m">1</span>:09 /usr/libexec/geoclue
+rtkit       <span class="m">1789</span>  <span class="m">0</span>.0  <span class="m">0</span>.0 <span class="m">153156</span>  <span class="m">2644</span> ?        SNsl Apr11   <span class="m">0</span>:00 /usr/libexec/rtkit-daemon
+syslog      <span class="m">1445</span>  <span class="m">0</span>.0  <span class="m">0</span>.0 <span class="m">224548</span>  <span class="m">4572</span> ?        Ssl  Apr11   <span class="m">0</span>:02 /usr/sbin/rsyslogd -n -iNONE
+systemd+    <span class="m">1305</span>  <span class="m">0</span>.0  <span class="m">0</span>.0  <span class="m">91016</span>  <span class="m">4088</span> ?        Ssl  Apr11   <span class="m">0</span>:00 /lib/systemd/systemd-timesyncd
+
+If you want to stop them manually, you may abort now <span class="o">(</span>CTRL+C<span class="o">)</span> and <span class="k">do</span> so.
+Press ENTER to <span class="k">continue</span>.
+</pre></div>
+</div>
+</div>
+<p>As stated, ensure that it's alright that these daemons are killed. You may want to terminate them manually
+if needed, otherwise the script will simply send a <code class="docutils literal notranslate"><span class="pre">SIGTERM</span></code> to these processes.</p>
+<div class="literal-block-wrapper docutils container" id="id8">
+<div class="code-block-caption"><span class="caption-text">(output continued)</span><a class="headerlink" href="#id8" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="o">[</span>...<span class="o">]</span>
+Restoring SUID/SGID flags where needed...
+<span class="o">[</span>...<span class="o">]</span>
+UID/GID swapping <span class="k">done</span>, please reboot now.
+</pre></div>
+</div>
+</div>
+<p>As instructed, you may now reboot.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>If you're currently restoring from a backup, you may stop here and resume
+the <a class="reference internal" href="restoring_from_backup.html"><span class="doc">Restoring from backup</span></a> procedure.</p>
+</div>
+</section>
+<section id="enabling-the-synchronization">
+<h3>Enabling the synchronization<a class="headerlink" href="#enabling-the-synchronization" title="Permalink to this headline"></a></h3>
+<p>Now that the master and the slave UIDs/GIDs are matching, we may enable the synchronization daemon:</p>
+<div class="literal-block-wrapper docutils container" id="id9">
+<div class="code-block-caption"><span class="caption-text">run this on the MASTER:</span><a class="headerlink" href="#id9" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">vim /etc/bastion/osh-sync-watcher.sh
+</span></pre></div>
+</div>
+</div>
+<p>You may review the configuration, but the two main items to review are:</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">enabled</span></code>, which should be set to <code class="docutils literal notranslate"><span class="pre">1</span></code></p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">remotehostlist</span></code>, which should contain the hosts/IPs list of the slave instances, separated by spaces</p></li>
+</ul>
+<p>If the synchronization daemon was not already enabled and started (i.e. this is the first slave instance
+you're setting up for this master), then you should configure it to start it on boot, and you may also
+start it manually right now:</p>
+<div class="literal-block-wrapper docutils container" id="id10">
+<div class="code-block-caption"><span class="caption-text">run this on the MASTER:</span><a class="headerlink" href="#id10" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">systemctl <span class="nb">enable</span> osh-sync-watcher
+</span><span class="hll">systemctl start osh-sync-watcher
+</span></pre></div>
+</div>
+</div>
+<p>Otherwise, if the daemon is already enabled and active, you can just restart it so it picks up the new configuration:</p>
+<div class="literal-block-wrapper docutils container" id="id11">
+<div class="code-block-caption"><span class="caption-text">run this on the MASTER:</span><a class="headerlink" href="#id11" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">systemctl restart osh-sync-watcher
+</span></pre></div>
+</div>
+</div>
+<p>Now, you can check the logs (if you configured <code class="docutils literal notranslate"><span class="pre">syslog</span></code> instead, which is encouraged,
+then the logfile depends on your syslog daemon configuration. If you're using our bundled <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code>
+configuration, the output is logged in <code class="file docutils literal notranslate"><span class="pre">/var/log/bastion/bastion-scripts.log</span></code>)</p>
+<div class="literal-block-wrapper docutils container" id="id12">
+<div class="code-block-caption"><span class="caption-text">run this on the MASTER:</span><a class="headerlink" href="#id12" title="Permalink to this code"></a></div>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">tail -F /var/log/bastion/osh-sync-watcher.log
+</span>Apr <span class="m">12</span> <span class="m">18</span>:11:25 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: Starting sync!
+Apr <span class="m">12</span> <span class="m">18</span>:11:25 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: <span class="m">192</span>.0.2.42: <span class="o">[</span>Server <span class="m">1</span>/1 - Step <span class="m">1</span>/3<span class="o">]</span> syncing needed data...
+Apr <span class="m">12</span> <span class="m">18</span>:11:27 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: <span class="m">192</span>.0.2.42: <span class="o">[</span>Server <span class="m">1</span>/1 - Step <span class="m">1</span>/3<span class="o">]</span> sync ended with <span class="k">return</span> value <span class="m">0</span>
+Apr <span class="m">12</span> <span class="m">18</span>:11:27 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: <span class="m">192</span>.0.2.42: <span class="o">[</span>Server <span class="m">1</span>/1 - Step <span class="m">2</span>/3<span class="o">]</span> syncing lastlog files from master to slave, only <span class="k">if</span> master version is newer...
+Apr <span class="m">12</span> <span class="m">18</span>:11:28 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: <span class="m">192</span>.0.2.42: <span class="o">[</span>Server <span class="m">1</span>/1 - Step <span class="m">2</span>/3<span class="o">]</span> sync ended with <span class="k">return</span> value <span class="m">0</span>
+Apr <span class="m">12</span> <span class="m">18</span>:11:28 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: <span class="m">192</span>.0.2.42: <span class="o">[</span>Server <span class="m">1</span>/1 - Step <span class="m">3</span>/3<span class="o">]</span> syncing lastlog files from slave to master, only <span class="k">if</span> slave version is newer...
+Apr <span class="m">12</span> <span class="m">18</span>:11:30 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: <span class="m">192</span>.0.2.42: <span class="o">[</span>Server <span class="m">1</span>/1 - Step <span class="m">3</span>/3<span class="o">]</span> sync ended with <span class="k">return</span> value <span class="m">0</span>
+Apr <span class="m">12</span> <span class="m">18</span>:11:39 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: All secondaries have been synchronized successfully
+Apr <span class="m">12</span> <span class="m">18</span>:11:39 bastion1.example.org osh-sync-watcher.sh<span class="o">[</span><span class="m">3346532</span><span class="o">]</span>: Watching <span class="k">for</span> changes <span class="o">(</span>timeout: <span class="m">120</span><span class="o">)</span>...
+</pre></div>
+</div>
+</div>
+<p>Your new slave instance is now ready!</p>
+</section>
+</section>
+<section id="creating-sshfp-dns-records">
+<h2>Creating SSHFP DNS records<a class="headerlink" href="#creating-sshfp-dns-records" title="Permalink to this headline"></a></h2>
+<p>If you want to use <code class="docutils literal notranslate"><span class="pre">SSHFP</span></code> to help authenticating your bastion public keys by publishing their checksum
+in your DNS, here is now to generate the correct records:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>awk <span class="s1">&#39;tolower($1)~/^hostkey$/ {system(&quot;ssh-keygen -r bastion.name -f &quot;$2)}&#39;</span> /etc/ssh/sshd_config
+</pre></div>
+</div>
+<p>You shall then publish them in your DNS. It is also a good idea to secure your DNS zone with DNSSEC,
+but this is out of the scope of this manual.</p>
+</section>
+<section id="hardening-the-ssh-configuration">
+<h2>Hardening the SSH configuration<a class="headerlink" href="#hardening-the-ssh-configuration" title="Permalink to this headline"></a></h2>
+<p>Using our SSH templates is a good start in any case. If you want to go further, there are a lot of online resources
+to help you harden your SSH configuration, and audit a running SSHd server.
+As the field evolves continuously, we don't want to recommend one particularly here,
+as it might get out of date rapidly, but looking for <a class="reference external" href="https://github.com/search?q=ssh+audit">ssh audit</a> on GitHub
+is probably a good start. Of course, this also depends on your environment, and you might not be able to harden
+your SSHd configuration as much as you would like.</p>
+<p>Note that for The Bastion, both sides can be independently hardened:
+the ingress part is handled in <code class="docutils literal notranslate"><span class="pre">sshd_config</span></code>, and the egress part is handled in <code class="docutils literal notranslate"><span class="pre">ssh_config</span></code>.</p>
+</section>
+<section id="fa-root-authentication">
+<h2>2FA root authentication<a class="headerlink" href="#fa-root-authentication" title="Permalink to this headline"></a></h2>
+<p>The bastion supports TOTP (Time-based One Time Password), to further secure high profile accesses.
+This section covers the configuration of 2FA root authentication on the bastion itself.
+TOTP can also be enabled for regular bastion users, but this is covered in another section.
+To enable 2FA root authentication, run on the bastion:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>script -c <span class="s2">&quot;google-authenticator -t -Q UTF8 -r 3 -R 15 -s /var/otp/root -w 2 -e 4 -D&quot;</span> /root/qrcode
+</pre></div>
+</div>
+<p>Of course, you can check the <code class="docutils literal notranslate"><span class="pre">--help</span></code> and adjust the options accordingly.
+The example given above has sane defaults, but you might want to adjust if needed.
+Now, flash this QR code with your phone, using a TOTP application.
+You might want to copy the QR code somewhere safe in case you need to flash it on some other phone,
+by exporting the <code class="docutils literal notranslate"><span class="pre">base64</span></code> version of it:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>gzip -c /root/qrcode <span class="p">|</span> base64 -w150
+</pre></div>
+</div>
+<p>Copy this in your password manager (for example). You can then delete the <code class="file docutils literal notranslate"><span class="pre">/root/qrcode</span></code> file.</p>
+<p>You have then two configuration adjustments to do.</p>
+<ul class="simple">
+<li><p>First, ensure you have installed the provided <code class="file docutils literal notranslate"><span class="pre">/etc/pam.d/sshd</span></code> file, or at least the corresponding line
+to enable the TOTP pam plugin in your configuration.</p></li>
+<li><p>Second, ensure that your <code class="file docutils literal notranslate"><span class="pre">/etc/ssh/sshd_config</span></code> file calls PAM for root authentication.
+In the provided templates, there is a commented snippet to do it. The uncommented snippet looks like this:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># 2FA has been configured for root, so we force pubkey+PAM for it</span>
+Match User root
+    AuthenticationMethods publickey,keyboard-interactive:pam
+</pre></div>
+</div>
+<p>Note that first, the usual publickey method will be used, then control will be passed to PAM.
+This is where the <code class="file docutils literal notranslate"><span class="pre">/etc/pam.d/sshd</span></code> configuration will apply.</p>
+<p>Now, you should be asked for the TOTP the next time you try to login through ssh as root.
+In case something goes wrong with the new configuration, be sure to keep your already opened existing
+connection to be able to fix the problem without falling back to console access.</p>
+<p>Once this has been tested, you can (and probably should) also protect the direct root console access
+to your machine with TOTP, including a snippet similar to this one:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="c1"># TOTP config</span>
+auth    <span class="o">[</span><span class="nv">success</span><span class="o">=</span><span class="m">1</span> <span class="nv">default</span><span class="o">=</span>ignore<span class="o">]</span>  pam_google_authenticator.so <span class="nv">secret</span><span class="o">=</span>/var/otp/<span class="si">${</span><span class="nv">USER</span><span class="si">}</span>
+auth    requisite                   pam_deny.so
+<span class="c1"># End of TOTP Config</span>
+</pre></div>
+</div>
+<p>inside your <code class="file docutils literal notranslate"><span class="pre">/etc/pam.d/login</span></code> file.</p>
+<p>Of course, when using TOTP, this is paramount to ensure your server is properly synchronized through NTP.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="basic.html" class="btn btn-neutral float-left" title="Basic Installation" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="upgrading.html" class="btn btn-neutral float-right" title="Upgrading" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/installation/basic.html b/installation/basic.html
new file mode 100644
index 000000000..d0593a487
--- /dev/null
+++ b/installation/basic.html
@@ -0,0 +1,382 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Basic Installation &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Advanced Installation" href="advanced.html" />
+    <link rel="prev" title="FAQ" href="../faq.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Basic Installation</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#got-puppet">0. Got Puppet?</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#operating-system">1. Operating system</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#connect-to-your-server-as-root">2. Connect to your server as root</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#get-the-code">3. Get the code</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#install-the-needed-packages">4. Install the needed packages</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#encrypt-home">5. Encrypt /home</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#setup-bastion-and-system-configuration">6. Setup bastion and system configuration</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#review-the-configuration">7. Review the configuration</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#check-that-the-code-works-on-your-machine">8. Check that the code works on your machine</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#manually-create-our-first-bastion-account">9. Manually create our first bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Basic Installation</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/installation/basic.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="basic-installation">
+<h1>Basic Installation<a class="headerlink" href="#basic-installation" title="Permalink to this headline"></a></h1>
+<p>If you are just upgrading from a previous version, please read <a class="reference internal" href="upgrading.html"><span class="doc">upgrading</span></a> instead.</p>
+<section id="got-puppet">
+<h2>0. Got Puppet?<a class="headerlink" href="#got-puppet" title="Permalink to this headline"></a></h2>
+<p>We published a Puppet module to handle The Bastion configuration and prerequisites.
+The GitHub repo is <a class="reference external" href="https://github.com/ovh/puppet-thebastion">here</a> and our module has been published to
+<a class="reference external" href="https://forge.puppet.com/modules/goldenkiwi/thebastion">the Puppet forge</a>.
+Of course, its usage is completely optional, but if you choose to use it,
+some of the below steps will be done by Puppet. Hence, you might want to only consider the following steps:</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#install-basic-operating-system"><span class="std std-ref">1. Operating system</span></a></p></li>
+<li><p><a class="reference internal" href="#install-basic-get-the-code"><span class="std std-ref">3. Get the code</span></a></p></li>
+<li><p><a class="reference internal" href="#install-basic-encrypt-home"><span class="std std-ref">5. Encrypt /home</span></a></p></li>
+<li><p>(Run Puppet)</p></li>
+<li><p><a class="reference internal" href="#install-basic-first-account"><span class="std std-ref">9. Manually create our first bastion account</span></a></p></li>
+</ul>
+</section>
+<section id="operating-system">
+<span id="install-basic-operating-system"></span><h2>1. Operating system<a class="headerlink" href="#operating-system" title="Permalink to this headline"></a></h2>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>The Bastion expects to be the only main service running on the server,
+please see <a class="reference internal" href="../faq.html#faq-existing-server"><span class="std std-ref">this FAQ entry</span></a> for more information.</p>
+</div>
+<p>The following Linux distros are tested with each release, but as this is a security product,
+you are <em>warmly</em> advised to run it on the latest up-to-date stable version of your favorite OS:</p>
+<ul class="simple">
+<li><p>Debian 12 (Bookworm), 11 (Bullseye), 10 (Buster)</p></li>
+<li><p>CentOS 7.x</p></li>
+<li><p>RockyLinux 8.x, 9.x</p></li>
+<li><p>Ubuntu LTS 22.04, 20.04, 18.04, 16.04</p></li>
+<li><p>OpenSUSE Leap 15.5*</p></li>
+</ul>
+<p>*: Note that these versions have no out-of-the-box MFA support, as they lack packaged versions of <code class="docutils literal notranslate"><span class="pre">pamtester</span></code>,
+<code class="docutils literal notranslate"><span class="pre">pam-google-authenticator</span></code>, or both. Of course, you may compile those yourself.
+Any other so-called <cite>modern</cite> Linux version are not tested with each release,
+but should work with no or minor adjustments.</p>
+<p>The following OS are also tested with each release:</p>
+<ul class="simple">
+<li><p>FreeBSD/HardenedBSD 13.0**</p></li>
+</ul>
+<p>**: Note that these have partial MFA support, due to their reduced set of available <code class="docutils literal notranslate"><span class="pre">pam</span></code> plugins.
+Support for either an additional password or TOTP factor can be configured, but not both at the same time.
+The code is actually known to work on FreeBSD/HardenedBSD 10+, but it's only regularly tested under 13.0.</p>
+<p>Other BSD variants, such as OpenBSD and NetBSD, are unsupported as they have a severe limitation over the maximum
+number of supplementary groups, causing problems for group membership and restricted commands checks,
+as well as no filesystem-level ACL support and missing PAM support (hence no MFA).</p>
+<p>In any case, you are expected to install this on a properly secured machine (including, but not limited to:
+<code class="docutils literal notranslate"><span class="pre">iptables</span></code>/<code class="docutils literal notranslate"><span class="pre">pf</span></code>, reduced-set of installed software and daemons, general system hardening, etc.).
+If you use Debian, following the <a class="reference external" href="https://www.cisecurity.org/benchmark/debian_linux/">CIS Hardening guidelines</a> is
+a good start. We have <a class="reference external" href="https://github.com/ovh/debian-cis">a tool</a> to check for compliance against these guidelines.
+If you use Debian and don't yet have your own hardened template, this script should help you getting up to speed,
+and ensuring your hardened host stays hardened over time, through a daily audit you might want to setup through cron.</p>
+<p>Great care has been taken to write secure, tested code, but of course this is worthless if your machine
+is a hacker highway. Ensuring that all the layers below the bastion code (the operating system
+and the hardware it's running on) is your job.</p>
+</section>
+<section id="connect-to-your-server-as-root">
+<h2>2. Connect to your server as root<a class="headerlink" href="#connect-to-your-server-as-root" title="Permalink to this headline"></a></h2>
+<p>You'll need to be connected to your server as root to perform the installation. If you're using root password
+authentication through SSH to do so, note that during the installation, as the SSH server configuration
+will be hardened, the SSH password authentication will be disabled server-wide.</p>
+<p>Hence, to access your server, please set up an SSH public key authentication instead of a password authentication,
+and do so before proceeding with the next steps. Otherwise you might lose access to your own server once the
+SSH hardening will be in effect, as password authentication will then be disabled.</p>
+</section>
+<section id="get-the-code">
+<span id="install-basic-get-the-code"></span><h2>3. Get the code<a class="headerlink" href="#get-the-code" title="Permalink to this headline"></a></h2>
+<p>The bastion code usually lives under <code class="docutils literal notranslate"><span class="pre">/opt/bastion</span></code>.
+You can either use <code class="docutils literal notranslate"><span class="pre">git</span> <span class="pre">clone</span></code> directly, or get the tarball of the latest release.</p>
+<ul class="simple">
+<li><p>Using <strong class="command">git</strong>:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>git clone https://github.com/ovh/the-bastion /opt/bastion
+git -C /opt/bastion checkout <span class="k">$(</span>git -C /opt/bastion tag <span class="p">|</span> tail -1<span class="k">)</span>
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>Using the tarball:</p></li>
+</ul>
+<p>Get the tarball of the latest release, which can be found
+<a class="reference external" href="https://github.com/ovh/the-bastion/releases/latest">there</a>, then untar it:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>mkdir -p /opt/bastion
+tar -C /opt/bastion -zxf v3.16.01.tar.gz
+</pre></div>
+</div>
+<p>The code supports being hosted somewhere else on the filesystem hierarchy, but this is discouraged as you might
+need to adjust a lot of configuration files (notably sudoers.d, cron.d, init.d) that needs an absolute path.
+You should end up with directories such as <code class="docutils literal notranslate"><span class="pre">bin</span></code>, <code class="docutils literal notranslate"><span class="pre">lib</span></code>, etc. directly under <code class="docutils literal notranslate"><span class="pre">/opt/bastion</span></code>.</p>
+</section>
+<section id="install-the-needed-packages">
+<span id="install-basic-install-packages"></span><h2>4. Install the needed packages<a class="headerlink" href="#install-the-needed-packages" title="Permalink to this headline"></a></h2>
+<p>For the supported Linux distros (see above), you can simply run:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/packages-check.sh -i
+</pre></div>
+</div>
+<p>You can add other parameters to install optional packages, depending on your environment:</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">-s</span></code> to install <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code> (advised, we have templates files for it)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">-d</span></code> to install packages needed for developing the software (useless in production)</p></li>
+</ul>
+<p>You'll also need our version of ttyrec, <a class="reference external" href="https://github.com/ovh/ovh-ttyrec">ovh-ttyrec</a>.
+To get and install the precompiled binary that will work for your OS and architecture, you can use this script:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install-ttyrec.sh -a
+</pre></div>
+</div>
+<p>This will detect your distro, then download and either install the <code class="docutils literal notranslate"><span class="pre">.deb</span></code> or <code class="docutils literal notranslate"><span class="pre">.rpm</span></code> package
+for <a class="reference external" href="https://github.com/ovh/ovh-ttyrec">ovh-ttyrec</a>. If your distro doesn't handle those package types,
+it'll fallback to installing precompiled static binaries.
+Of course you can package it yourself and make it available to your own internal repositories instead of installing it this way.</p>
+<p>If you plan to use the PIV functionalities of The Bastion,
+you'll also need to install the <code class="docutils literal notranslate"><span class="pre">yubico-piv-checker</span></code> <a class="reference external" href="https://github.com/ovh/yubico-piv-checker">helper tool</a>.</p>
+<p>You may also want to install <code class="docutils literal notranslate"><span class="pre">the-bastion-mkhash-helper</span></code> <a class="reference external" href="https://github.com/ovh/the-bastion-mkhash-helper">tool</a>
+if you want to be able to generate so-called type 8 and type 9 password hashes.</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install-yubico-piv-checker.sh -a
+/opt/bastion/bin/admin/install-mkhash-helper.sh -a
+</pre></div>
+</div>
+</section>
+<section id="encrypt-home">
+<span id="install-basic-encrypt-home"></span><h2>5. Encrypt /home<a class="headerlink" href="#encrypt-home" title="Permalink to this headline"></a></h2>
+<p>Strictly speaking, this step is optional, but if you skip it, know that all the SSH private keys and session
+recordings will be stored unencrypted on the <code class="docutils literal notranslate"><span class="pre">/home</span></code> partition.
+Of course, if partition encryption is already handled by the OS template you use,
+or if the storage layer of your OS is encrypted by some other mean, you may skip this section.</p>
+<p>First, generate a secure password on your desk (but not too complicated so it can be typed
+on a console over your hypervisor over a VDI over VPN over 4G in the dark at 3am on a Sunday)
+and save it to a secure location: <code class="docutils literal notranslate"><span class="pre">pwgen</span> <span class="pre">-s</span> <span class="pre">10</span></code>.</p>
+<p>Then you can use the helper script to do this, it'll guide you through the process.
+When prompted for a passphrase, enter the one chosen just before:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/setup-encryption.sh
+</pre></div>
+</div>
+<p>If you get a cryptsetup error, you might need to add <code class="docutils literal notranslate"><span class="pre">--type</span> <span class="pre">luks1</span></code> to the <code class="docutils literal notranslate"><span class="pre">cryptsetup</span> <span class="pre">luksFormat</span></code> command
+in the script. It can happen if your kernel doesn't have the necessary features enabled for LUKS2.</p>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>Once you have setup encryption, <strong>do not forget</strong> to ensure that the keys backup script has encryption enabled,
+otherwise the backups will be stored unencrypted in <code class="docutils literal notranslate"><span class="pre">/root/backups</span></code>,
+which would make your <code class="docutils literal notranslate"><span class="pre">/home</span></code> encryption moot.
+This is not covered here because you can do it later, just don't forget it:
+it's in the <a class="reference internal" href="advanced.html"><span class="doc">advanced installation</span></a> section.</p>
+</div>
+</section>
+<section id="setup-bastion-and-system-configuration">
+<span id="install-basic-setup"></span><h2>6. Setup bastion and system configuration<a class="headerlink" href="#setup-bastion-and-system-configuration" title="Permalink to this headline"></a></h2>
+<p>The following script will do that for you. There are several possibilities here.</p>
+<ul class="simple">
+<li><p>If you're installing a new machine (nobody is using it as a bastion yet), then you can regenerate brand new
+host keys and directly harden the ssh configuration without any side effect:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install --new-install
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>If you're upgrading an existing machine (from a previous version of this software),
+and there are already some people using it as a bastion, then if you change the host keys,
+they'll have to acknowledge the change when connecting, i.e. this is not transparent at all.
+To avoid doing that and not touching either the ssh config or the host keys, use this:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install --upgrade
+</pre></div>
+</div>
+<p>If you used <code class="docutils literal notranslate"><span class="pre">--upgrade</span></code>, then you are <strong>warmly</strong> advised to harden the configuration yourself,
+using our templates as a basis. For example, if you're under Debian 11:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>vimdiff /opt/bastion/etc/ssh/ssh_config.debian11 /etc/ssh/ssh_config
+vimdiff /opt/bastion/etc/ssh/sshd_config.debian11 /etc/ssh/sshd_config
+</pre></div>
+</div>
+<p>There are other templates available in the same directory, for the other supported distros.</p>
+<ul class="simple">
+<li><p>If you want to have a fine-grained control of what is managed by the installation script,
+and what is managed by yourself (or any configuration automation system you may have), you can review all the fine-grained options:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install --help
+</pre></div>
+</div>
+</section>
+<section id="review-the-configuration">
+<span id="install-basic-review-config"></span><h2>7. Review the configuration<a class="headerlink" href="#review-the-configuration" title="Permalink to this headline"></a></h2>
+<p>Base configuration files have been copied, you should review the main configuration and modify it to your needs:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>vim /etc/bastion/bastion.conf
+</pre></div>
+</div>
+</section>
+<section id="check-that-the-code-works-on-your-machine">
+<span id="install-basic-perl-check"></span><h2>8. Check that the code works on your machine<a class="headerlink" href="#check-that-the-code-works-on-your-machine" title="Permalink to this headline"></a></h2>
+<p>This script will verify that all required modules are installed:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/dev/perl-check.sh
+</pre></div>
+</div>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>If you're installing this instance to restore a backup, you may stop here and resume the
+standard <a class="reference internal" href="restoring_from_backup.html"><span class="doc">Restoring from backup</span></a> procedure.</p>
+</div>
+</section>
+<section id="manually-create-our-first-bastion-account">
+<span id="install-basic-first-account"></span><h2>9. Manually create our first bastion account<a class="headerlink" href="#manually-create-our-first-bastion-account" title="Permalink to this headline"></a></h2>
+<p>Just launch this script, replacing <em>USERNAME</em> by the username you want to use:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/setup-first-admin-account.sh USERNAME auto
+</pre></div>
+</div>
+<p>You'll just need to specify the public SSH key to add to this new account.
+It'll be created as a bastion admin, and all the restricted commands will be granted.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This command will also give you a so-called <em>bastion alias</em>, this is the command you'll routinely use to
+connect to the bastion, and to your infrastructures through it, replacing in effect your previous usage
+of the <cite>ssh</cite> command. The alias name advertised on account creation is configurable in <code class="docutils literal notranslate"><span class="pre">bastion.conf</span></code>,
+and of course the users can rename it as they see fit, but it's advised to keep this command short,
+as people will use it a lot.</p>
+</div>
+<p>If you want to create other admin accounts, you can repeat the operation.
+All the other accounts should be created by a bastion admin (or more precisely,
+by somebody granted to the <em>accountCreate</em> command), using the bastion own commands.
+But more about this in the section <em>Using the bastion</em>.</p>
+<p>You may head over to the <strong>USAGE</strong> section on the left menu, but please read the warning below first.</p>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>Note that even if your bastion should now be functional, proper setup for a production-level environment
+is not done yet: for example, you don't have any backup system in place! Please ensure you follow the
+<a class="reference internal" href="advanced.html"><span class="doc">advanced installation</span></a> documentation and carely consider each step (by either completing it
+or deciding that it's not mandatory for your use case), before considering your installation complete.</p>
+</div>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../faq.html" class="btn btn-neutral float-left" title="FAQ" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="advanced.html" class="btn btn-neutral float-right" title="Advanced Installation" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/installation/docker.html b/installation/docker.html
new file mode 100644
index 000000000..ea7dc38b7
--- /dev/null
+++ b/installation/docker.html
@@ -0,0 +1,216 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Sandbox using Docker &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Restoring from backup" href="restoring_from_backup.html" />
+    <link rel="prev" title="Upgrading" href="upgrading.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="upgrading.html">Upgrading</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Sandbox using Docker</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/installation/docker.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="sandbox-using-docker">
+<h1>Sandbox using Docker<a class="headerlink" href="#sandbox-using-docker" title="Permalink to this headline"></a></h1>
+<p>This is a good way to test The Bastion within seconds, but <a class="reference internal" href="../faq.html#faq-docker"><span class="std std-ref">read the FAQ</span></a>
+if you're serious about using containerization in production.</p>
+<p>The sandbox image is available for the following architectures: <code class="docutils literal notranslate"><span class="pre">linux/386</span></code>, <code class="docutils literal notranslate"><span class="pre">linux/amd64</span></code>, <code class="docutils literal notranslate"><span class="pre">linux/arm/v6</span></code>,
+<code class="docutils literal notranslate"><span class="pre">linux/arm/v7</span></code>, <code class="docutils literal notranslate"><span class="pre">linux/arm64</span></code>, <code class="docutils literal notranslate"><span class="pre">linux/ppc64le</span></code>, <code class="docutils literal notranslate"><span class="pre">linux/s390x</span></code>.</p>
+<ul class="simple">
+<li><p>Let's run the docker image:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>docker run -d -p <span class="m">22</span> --name bastiontest ovhcom/the-bastion:sandbox
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>Or, if you prefer building the docker image yourself, you can: use the two commands below.
+Of course, if you already typed the <code class="docutils literal notranslate"><span class="pre">docker</span> <span class="pre">run</span></code> command above, you can skip the following commands:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>docker build -f docker/Dockerfile.debian10 -t bastion:debian10 .
+docker run -d -p <span class="m">22</span> --name bastiontest bastion:debian10
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>Configure the first administrator account (get your public SSH key ready)</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>docker <span class="nb">exec</span> -it bastiontest /opt/bastion/bin/admin/setup-first-admin-account.sh poweruser auto
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>We're now up and running with the default configuration!
+Let's setup a handy bastion alias, and test the <code class="docutils literal notranslate"><span class="pre">info</span></code> command:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="nv">PORT</span><span class="o">=</span><span class="k">$(</span>docker port bastiontest <span class="p">|</span> cut -d: -f2<span class="k">)</span>
+<span class="nb">alias</span> <span class="nv">bastion</span><span class="o">=</span><span class="s2">&quot;ssh poweruser@127.0.0.1 -tp </span><span class="nv">$PORT</span><span class="s2"> -- &quot;</span>
+bastion --osh info
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>It should greet you as being a bastion admin, which means you have access to all commands.
+Let's enter interactive mode:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>bastion -i
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>This is useful to call several <code class="docutils literal notranslate"><span class="pre">--osh</span></code> plugins in a row. Now we can ask for help to see all plugins:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>$&gt; <span class="nb">help</span>
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>If you have a remote machine you want to try to connect to through the bastion, fetch your egress key:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>$&gt; selfListEgressKeys
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>Copy this public key to the remote machine's <code class="docutils literal notranslate"><span class="pre">authorized_keys</span></code> under the <code class="docutils literal notranslate"><span class="pre">.ssh/</span></code> folder
+of the account you want to connect to, then:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>$&gt; selfAddPersonalAccess --host &lt;remote_host&gt; --user &lt;remote_account_name&gt; --port-any
+$&gt; ssh &lt;remote_account_name&gt;@&lt;remote_host&gt;
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>Note that you can connect directly without using interactive mode, with:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>bastion &lt;remote_account_name&gt;@&lt;remote_machine_host_or_ip&gt;
+</pre></div>
+</div>
+<p>That's it! You can head over to the <strong>USAGE</strong> section on the left menu for more information.
+Be sure to check the help of the bastion with <code class="docutils literal notranslate"><span class="pre">bastion</span> <span class="pre">--help</span></code>,
+along with the help of each osh plugin with <code class="docutils literal notranslate"><span class="pre">bastion</span> <span class="pre">--osh</span> <span class="pre">command</span> <span class="pre">--help</span></code>.</p>
+<p>Also don't forget to customize your <code class="docutils literal notranslate"><span class="pre">bastion.conf</span></code> file,
+which can be found in <code class="docutils literal notranslate"><span class="pre">/etc/bastion/bastion.conf</span></code> (for Linux).</p>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="upgrading.html" class="btn btn-neutral float-left" title="Upgrading" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="restoring_from_backup.html" class="btn btn-neutral float-right" title="Restoring from backup" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/installation/restoring_from_backup.html b/installation/restoring_from_backup.html
new file mode 100644
index 000000000..e4cb0c525
--- /dev/null
+++ b/installation/restoring_from_backup.html
@@ -0,0 +1,266 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Restoring from backup &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="The basics" href="../using/basics/index.html" />
+    <link rel="prev" title="Sandbox using Docker" href="docker.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Restoring from backup</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#prerequisites">Prerequisites</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#steps">Steps</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#installation">Installation</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#gpg-key-and-backup-archive-import">GPG key and backup archive import</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#decrypt-and-extract-accounts-and-groups">Decrypt and extract accounts and groups</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#ensuring-the-uids-gids-are-in-sync">Ensuring the UIDs/GIDs are in sync</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#restoring">Restoring</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#back-to-production">Back to production</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Restoring from backup</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/installation/restoring_from_backup.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="restoring-from-backup">
+<h1>Restoring from backup<a class="headerlink" href="#restoring-from-backup" title="Permalink to this headline"></a></h1>
+<p>In this section, we'll detail how to restore a bastion's main data from a backup.</p>
+<p>This can be useful in two main cases:</p>
+<ul class="simple">
+<li><p>When an account with high privileges has deleted or altered by mistake a great amount of accounts or groups, up
+to a point where it's operationally easier to just restore the settings, accounts, groups and keys from the latest
+available backup</p></li>
+<li><p>When you are not in an <a class="reference internal" href="advanced.html#installadv-ha"><span class="std std-ref">HA setup</span></a> and your only
+instance is down and can't be brought back up in a timely manner.</p></li>
+</ul>
+<p>Note that if you are in a HA setup and you need to add a new node (regardless of the fact that you're replacing
+a failed node or not), you don't need to restore from backup: you can simply follow the HA setup procedure so
+that your new node is synced with your main node.</p>
+<section id="prerequisites">
+<h2>Prerequisites<a class="headerlink" href="#prerequisites" title="Permalink to this headline"></a></h2>
+<p>First, you obviously must have a backup at hand, which should be the case if you followed the
+<a class="reference internal" href="advanced.html#installadv-backup"><span class="std std-ref">Configuring keys, accounts &amp; groups remote backup</span></a> section when you first installed the instance you want to restore.</p>
+<p>If the backup is encrypted with GPG (it should be), you must have access to the corresponding GPG private key and
+its passphrase.</p>
+<p>You must ensure that the new server you're setting up has the same OS release than the one the backup file
+comes from, as we'll overwrite the new server's accounts and groups files with the backed up versions.
+This could cause adverse effects if the distro or release differ, although the restore script won't stop
+you from doing so (it'll even help you adjust the discrepancies if needed, but again, this is strongly discouraged).</p>
+</section>
+<section id="steps">
+<h2>Steps<a class="headerlink" href="#steps" title="Permalink to this headline"></a></h2>
+<section id="installation">
+<h3>Installation<a class="headerlink" href="#installation" title="Permalink to this headline"></a></h3>
+<p>On the new server you want to deploy the backup to, you must first follow the standard <a class="reference internal" href="basic.html"><span class="doc">Basic Installation</span></a>
+procedure, up to and including the <em>Check that the code works on your machine</em> step.</p>
+<p>Once done, you may proceed to the next steps below.</p>
+</section>
+<section id="gpg-key-and-backup-archive-import">
+<h3>GPG key and backup archive import<a class="headerlink" href="#gpg-key-and-backup-archive-import" title="Permalink to this headline"></a></h3>
+<p>On the server you've just installed, you'll need to import the private GPG key that was used to encrypt the backup, and
+you'll also need to fetch the backup archive itself. It's a good practice to NOT decrypt the backup archive prior to
+transferring it to the new server. This way, you're sure that the credentials and keys contained in the backup have
+not been compromised.</p>
+<p>To import the GPG key, just run:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">gpg --import
+</span></pre></div>
+</div>
+<p>And paste the private GPG key corresponding to the backup so that it gets imported into root's keyring.</p>
+<p>Alternatively, you can put the private GPG key in a temporary file, and import it this way:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">gpg --import &lt; /tmp/backupkey.asc
+</span></pre></div>
+</div>
+<p>You may now import the backup archive, which usually has a name matching the <code class="file docutils literal notranslate"><span class="pre">backup-YYYY-MM-DD.tar.gz.gpg</span></code> format.
+You can use <code class="docutils literal notranslate"><span class="pre">scp</span></code>, <code class="docutils literal notranslate"><span class="pre">sftp</span></code> or any other method to get this file onto the server, at any location you see fit. We'll use
+<code class="file docutils literal notranslate"><span class="pre">/root</span></code> as location for the rest of this documentation, as this is guaranteed to only be readable by root,
+hence not compromising the keys and credentials.</p>
+</section>
+<section id="decrypt-and-extract-accounts-and-groups">
+<h3>Decrypt and extract accounts and groups<a class="headerlink" href="#decrypt-and-extract-accounts-and-groups" title="Permalink to this headline"></a></h3>
+<p>Now, you can decrypt the backup archive:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">gpg -d /root/backup-YYYY-MM-DD.tar.gz.gpg &gt; /root/backup-decrypted.tar.gz
+</span>gpg: encrypted with <span class="m">4096</span>-bit RSA key, ID F50BFFC49143C821, created <span class="m">2021</span>-03-27
+   <span class="s2">&quot;Bastion Administrators &lt;bastions.admins@example.org&gt;&quot;</span>
+</pre></div>
+</div>
+<p>You'll have to input the GPG private key passphrase when asked to.</p>
+<p>Then, check whether the archive seems okay:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">tar tvzf /root/backup-decrypted.tar.gz
+</span></pre></div>
+</div>
+<p>You should see a long list of files, most under the <code class="file docutils literal notranslate"><span class="pre">/home</span></code> hierarchy.</p>
+<p>We now need to extract the backed up <code class="file docutils literal notranslate"><span class="pre">/etc/passwd</span></code> and <code class="file docutils literal notranslate"><span class="pre">/etc/group</span></code> files, to ensure the new
+instance we're setting up has its UIDs/GIDs synced with the system we're restoring:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">tar xvzf /root/backup-decrypted.tar.gz -C /root --strip-components<span class="o">=</span><span class="m">1</span> etc/passwd etc/group
+</span>etc/group
+etc/passwd
+</pre></div>
+</div>
+<p>We now have the two original accounts and groups lists in <code class="file docutils literal notranslate"><span class="pre">/root</span></code>, and we can proceed to check
+whether the UIDs and GIDs are in sync.</p>
+</section>
+<section id="ensuring-the-uids-gids-are-in-sync">
+<h3>Ensuring the UIDs/GIDs are in sync<a class="headerlink" href="#ensuring-the-uids-gids-are-in-sync" title="Permalink to this headline"></a></h3>
+<p>This procedure is the same than when setting up a slave instance bastion,
+please follow the corresponding <a class="reference internal" href="advanced.html#installadv-ha-uidgidsync"><span class="std std-ref">step there</span></a> and come
+back to this documentation when it's done.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>The referenced step above asks you to reboot at the end, please ensure you've done it before
+continuing with the rest of the procedure below.</p>
+</div>
+</section>
+<section id="restoring">
+<h3>Restoring<a class="headerlink" href="#restoring" title="Permalink to this headline"></a></h3>
+<p>Now that we know the UIDs/GIDs are synced, we can proceed with the full restore:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">tar -C / --preserve-permissions --preserve-order --overwrite --acls --numeric-owner -xzvf /root/backup-decrypted.tar.gz
+</span></pre></div>
+</div>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>If you're getting errors such as 'Warning: Cannot acl_from_text: Invalid argument', please ensure that your
+filesystem supports ACLs and is mounted with ACL support, otherwise <code class="docutils literal notranslate"><span class="pre">tar</span></code> can't restore ACLs from the backup.</p>
+</div>
+</section>
+<section id="back-to-production">
+<h3>Back to production<a class="headerlink" href="#back-to-production" title="Permalink to this headline"></a></h3>
+<p>As the configuration of the SSH daemon has also been restored, you might want to restart it so that it
+picks up the new configuration:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">service ssh restart
+</span></pre></div>
+</div>
+<p>Once this is done, all the accounts that were present in the backup should be working. After ensuring this is the case,
+you may put the server put back in production.</p>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="docker.html" class="btn btn-neutral float-left" title="Sandbox using Docker" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../using/basics/index.html" class="btn btn-neutral float-right" title="The basics" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/installation/upgrading.html b/installation/upgrading.html
new file mode 100644
index 000000000..bead1d7c2
--- /dev/null
+++ b/installation/upgrading.html
@@ -0,0 +1,620 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Upgrading &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Sandbox using Docker" href="docker.html" />
+    <link rel="prev" title="Advanced Installation" href="advanced.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Upgrading</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#general-upgrade-instructions">General upgrade instructions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#version-specific-upgrade-instructions">Version-specific upgrade instructions</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#v3-16-01-2024-04-17">v3.16.01 - 2024/04/17</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-16-00-2024-04-10">v3.16.00 - 2024/04/10</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-15-00-2024-03-22">v3.15.00 - 2024/03/22</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-14-16-2024-02-20">v3.14.16 - 2024/02/20</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-14-15-2023-11-08">v3.14.15 - 2023/11/08</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-14-00-2023-09-19">v3.14.00 - 2023/09/19</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-13-01-2023-08-22">v3.13.01 - 2023/08/22</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-13-00-2023-07-28">v3.13.00 - 2023/07/28</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-12-00-2023-06-27">v3.12.00 - 2023/06/27</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-11-02-2023-04-18">v3.11.02 - 2023/04/18</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-11-01-2023-03-27">v3.11.01 - 2023/03/27</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-11-00-2023-03-23">v3.11.00 - 2023/03/23</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-10-00-2023-02-17">v3.10.00 - 2023/02/17</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-09-02-2022-11-15">v3.09.02 - 2022/11/15</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-09-01-2022-10-10">v3.09.01 - 2022/10/10</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-09-00-2022-09-21">v3.09.00 - 2022/09/21</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-08-01-2022-01-19">v3.08.01 - 2022/01/19</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-08-00-2022-01-04">v3.08.00 - 2022/01/04</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#ed25519">Ed25519</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-07-00-2021-12-13">v3.07.00 - 2021/12/13</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-06-00-2021-10-15">v3.06.00 - 2021/10/15</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-05-01-2021-09-22">v3.05.01 - 2021/09/22</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-05-00-2021-09-14">v3.05.00 - 2021/09/14</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-04-00-2021-07-02">v3.04.00 - 2021/07/02</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-03-01-2021-03-25">v3.03.01 - 2021/03/25</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-03-00-2021-02-22">v3.03.00 - 2021/02/22</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-02-00-2021-02-01">v3.02.00 - 2021/02/01</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#the-main-configuration-file-now-supports-proper-booleans">The main configuration file now supports proper booleans</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#logs-have-been-enhanced">Logs have been enhanced</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-01-03-2020-12-15">v3.01.03 - 2020/12/15</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-01-02-2020-12-08">v3.01.02 - 2020/12/08</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-01-01-2020-12-04">v3.01.01 - 2020/12/04</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-01-00-2020-11-20">v3.01.00 - 2020/11/20</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-00-02-2020-11-16">v3.00.02 - 2020/11/16</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-00-01-2020-11-06">v3.00.01 - 2020/11/06</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#v3-00-00-2020-10-30">v3.00.00 - 2020/10/30</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Upgrading</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/installation/upgrading.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="upgrading">
+<h1>Upgrading<a class="headerlink" href="#upgrading" title="Permalink to this headline"></a></h1>
+<section id="general-upgrade-instructions">
+<h2>General upgrade instructions<a class="headerlink" href="#general-upgrade-instructions" title="Permalink to this headline"></a></h2>
+<ul class="simple">
+<li><p>First, check below if there are specific upgrade instructions for your version.</p></li>
+<li><p>When you're ready, update the code, if you're using <code class="docutils literal notranslate"><span class="pre">git</span></code>, you can checkout the latest tag:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="o">(</span> <span class="nb">umask</span> <span class="m">0022</span> <span class="o">&amp;&amp;</span> <span class="nb">cd</span> /opt/bastion <span class="o">&amp;&amp;</span> git fetch <span class="o">&amp;&amp;</span> git checkout <span class="k">$(</span>git tag <span class="p">|</span> tail -1<span class="k">)</span> <span class="o">)</span>
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>Run the install script in upgrade mode, so it can make adjustments to the system needed for the new version:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install --upgrade
+</pre></div>
+</div>
+<p>Note that if you're using an infrastructure automation tool such as Puppet, Ansible, Chef,
+and don't want the update script to touch some files that you manage yourself,
+you can use <code class="docutils literal notranslate"><span class="pre">--managed-upgrade</span></code> instead of <code class="docutils literal notranslate"><span class="pre">--upgrade</span></code>.
+See the <code class="docutils literal notranslate"><span class="pre">--help</span></code> for a more fine-grained upgrade path if needed.</p>
+</section>
+<section id="version-specific-upgrade-instructions">
+<h2>Version-specific upgrade instructions<a class="headerlink" href="#version-specific-upgrade-instructions" title="Permalink to this headline"></a></h2>
+<section id="v3-16-01-2024-04-17">
+<h3>v3.16.01 - 2024/04/17<a class="headerlink" href="#v3-16-01-2024-04-17" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-16-00-2024-04-10">
+<h3>v3.16.00 - 2024/04/10<a class="headerlink" href="#v3-16-00-2024-04-10" title="Permalink to this headline"></a></h3>
+<p>This version adds support for Secure Keys (FIDO2) for ingress authentication. It requires at least OpenSSH 8.2
+installed on the server hosting The Bastion, as support for FIDO2 was added in this version.
+Of the currently supported OS versions, the following are known to have a recent-enough version:</p>
+<ul class="simple">
+<li><p>Debian 11</p></li>
+<li><p>Debian 12</p></li>
+<li><p>Ubuntu 20.04</p></li>
+<li><p>Ubuntu 22.04</p></li>
+<li><p>OpenSUSE Leap 15.5</p></li>
+<li><p>Rocky Linux 9</p></li>
+</ul>
+<p>Note that if you are upgrading, you'll need to enable the new ingress algorithms in the <code class="docutils literal notranslate"><span class="pre">/etc/bastion/bastion.conf</span></code>
+file, under the <code class="docutils literal notranslate"><span class="pre">allowedIngressSshAlgorithms</span></code> option. You may want to add <code class="docutils literal notranslate"><span class="pre">ecdsa-sk</span></code> and <code class="docutils literal notranslate"><span class="pre">ed25519-sk</span></code> to the list
+if you want to support the FIDO2-backed versions of these two algorithms.
+You may also refer to the distributed default configuration file in <code class="docutils literal notranslate"><span class="pre">etc/bastion/bastion.conf.dist</span></code>,
+which enables them by default.</p>
+</section>
+<section id="v3-15-00-2024-03-22">
+<h3>v3.15.00 - 2024/03/22<a class="headerlink" href="#v3-15-00-2024-03-22" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-14-16-2024-02-20">
+<h3>v3.14.16 - 2024/02/20<a class="headerlink" href="#v3-14-16-2024-02-20" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-14-15-2023-11-08">
+<h3>v3.14.15 - 2023/11/08<a class="headerlink" href="#v3-14-15-2023-11-08" title="Permalink to this headline"></a></h3>
+<p>This release fixes the <a class="reference internal" href="../administration/security_advisories/cve_2023_45140.html"><span class="doc">CVE-2023-45140</span></a> with severity 4.8 (CVSS V3).
+Please refer to its page for impact and mitigation details.</p>
+<p>The changes introduced to fix this vulnerability imply that if you're using the <code class="docutils literal notranslate"><span class="pre">scp</span></code> or <code class="docutils literal notranslate"><span class="pre">sftp</span></code> plugins,
+you'll need to update your wrappers using the new versions provided by this release. The old helpers will still
+work, but only for remote hosts that don't require MFA.</p>
+<p>To get the new wrappers for your account on a given bastion, just call <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">scp</span></code> or <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">sftp</span></code> without
+specifying any host, which will give you your script, and examples of use.
+As you'll notice, the new scripts are no longer helpers (that were to be used through <code class="docutils literal notranslate"><span class="pre">scp</span> <span class="pre">-S</span></code> and
+<code class="docutils literal notranslate"><span class="pre">sftp</span> <span class="pre">-S</span></code>), but wrappers, that will call  <code class="docutils literal notranslate"><span class="pre">scp</span></code> and <code class="docutils literal notranslate"><span class="pre">sftp</span></code> themselves.</p>
+<p>As outlined above, the old helpers will still work for the foreseeable future, but as they're not able to
+request MFA when this is configured for a remote host, they'll simply fail for such hosts on an updated
+version of the bastion.</p>
+<p>If you have some accounts that use automated accesses through the bastion and use <code class="docutils literal notranslate"><span class="pre">scp</span></code> or <code class="docutils literal notranslate"><span class="pre">sftp</span></code> on
+hosts that have JIT MFA configured through their group, you'll need to set these accounts as immune to JIT MFA,
+which can be done through <a class="reference internal" href="../plugins/restricted/accountModify.html"><span class="doc">accountModify</span></a>'s <code class="docutils literal notranslate"><span class="pre">--mfa-password-required</span> <span class="pre">bypass</span></code>
+and/or <code class="docutils literal notranslate"><span class="pre">accountModify</span> <span class="pre">--mfa-totp-required</span> <span class="pre">bypass</span></code>, as has always been the case for classic SSH access.</p>
+<p>An HMAC shared secret is automatically generated when this release is deployed, this secret must be shared
+by all the instances of the same cluster. Hence, you should start by deploying this release on the primary
+node, which will generate the secret automatically during the standard upgrading procedure, so that this
+node can push the shared-secret to the other nodes. The other nodes don't have to be upgraded beforehand,
+they'll just not use the secret until they're upgraded to this version, and JIT MFA for <code class="docutils literal notranslate"><span class="pre">scp</span></code> and <code class="docutils literal notranslate"><span class="pre">sftp</span></code>
+will not work through them until this is the case.</p>
+<p>Once the primary node is upgraded, you should ensure the new file containing the HMAC shared secret is part
+of the synchronization list. If you did not customize your synchronization list, you can apply the new one
+over the old one directly:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">cat /opt/bastion/etc/bastion/osh-sync-watcher.rsyncfilter.dist &gt; /etc/bastion/osh-sync-watcher.rsyncfilter
+</span></pre></div>
+</div>
+<p>Then, you need to restart the synchronization daemon, so that it takes into consideration the new file
+(containing the shared secret) to push to the other nodes. This is usually done this way:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">systemctl restart osh-sync-watcher
+</span></pre></div>
+</div>
+<p>You can verify on the other nodes that the <code class="docutils literal notranslate"><span class="pre">/etc/bastion/mfa-token.conf</span></code> file is now present.</p>
+</section>
+<section id="v3-14-00-2023-09-19">
+<h3>v3.14.00 - 2023/09/19<a class="headerlink" href="#v3-14-00-2023-09-19" title="Permalink to this headline"></a></h3>
+<p>A new helper is required to support the so-called &quot;type 8&quot; and &quot;type 9&quot; password hash types, used on some
+network devices. This helper is optional, and these hashes types will simply not be generated if the helper is
+missing. The plugins concerned by this change are <code class="docutils literal notranslate"><span class="pre">selfGeneratePassword</span></code>, <code class="docutils literal notranslate"><span class="pre">selfListPasswords</span></code>,
+<code class="docutils literal notranslate"><span class="pre">accountGeneratePassword</span></code>, <code class="docutils literal notranslate"><span class="pre">accountListPasswords</span></code>, <code class="docutils literal notranslate"><span class="pre">groupGeneratePassword</span></code>, <code class="docutils literal notranslate"><span class="pre">groupListPasswords</span></code>.</p>
+<p>New installations will get this helper installed automatically. When upgrading, if you'd like to install
+this helper, you'll need to install it by running the following command as <code class="docutils literal notranslate"><span class="pre">root</span></code>:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/install-mkhash-helper.sh -a
+</pre></div>
+</div>
+<p>This will detect your OS and either install a <code class="docutils literal notranslate"><span class="pre">.deb</span></code> file, an <code class="docutils literal notranslate"><span class="pre">.rpm</span></code> file, or a static binary.</p>
+<p>If you want to ensure that the helper has installed correctly, you can call it manually for testing purposes:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="nb">echo</span> <span class="nb">test</span> <span class="p">|</span> the-bastion-mkhash-helper
+</span><span class="o">{</span><span class="s2">&quot;Type8&quot;</span>:<span class="s2">&quot;</span><span class="nv">$8$EpvF1cVVzoEQFE$L3ZBWzfH9MTPo4WLX29Jd8LTM5sKlfEjtRZ</span><span class="s2">//XMys2U&quot;</span>,<span class="s2">&quot;Type9&quot;</span>:<span class="s2">&quot;</span><span class="nv">$9$yRlXzt0T7WBs3E$YdKk8WMvLvAVcbglx</span><span class="s2">.bMZoRlwBa6l5EhwLhBh1o0u4g&quot;</span>,<span class="s2">&quot;PasswordLen&quot;</span>:4<span class="o">}</span>
+</pre></div>
+</div>
+<p>If you're not generating passwords for use with network devices using type 8 or type 9 hash types, installation of this
+helper is not required.</p>
+</section>
+<section id="v3-13-01-2023-08-22">
+<h3>v3.13.01 - 2023/08/22<a class="headerlink" href="#v3-13-01-2023-08-22" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-13-00-2023-07-28">
+<h3>v3.13.00 - 2023/07/28<a class="headerlink" href="#v3-13-00-2023-07-28" title="Permalink to this headline"></a></h3>
+<p>Plugins output is now recorded using ttyrec, as the connections are, instead of being stored in sqlite format
+within the home folder of the account. This helps avoiding the sqlite databases growing too much in size when
+accounts are using osh commands very intensively.</p>
+</section>
+<section id="v3-12-00-2023-06-27">
+<h3>v3.12.00 - 2023/06/27<a class="headerlink" href="#v3-12-00-2023-06-27" title="Permalink to this headline"></a></h3>
+<p>Support for Debian 9 has been dropped. This doesn't mean that the code will suddenly stop working under this version,
+but that tests no longer include this OS. Please consider upgrading to a more recent OS, as ensuring the underlying
+OS is up to date and still supported is paramount to the security of The Bastion (or any other software).</p>
+<p>Support of Debian &quot;Bookworm&quot; 12 is now official, as this is now Debian stable.</p>
+</section>
+<section id="v3-11-02-2023-04-18">
+<h3>v3.11.02 - 2023/04/18<a class="headerlink" href="#v3-11-02-2023-04-18" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-11-01-2023-03-27">
+<h3>v3.11.01 - 2023/03/27<a class="headerlink" href="#v3-11-01-2023-03-27" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-11-00-2023-03-23">
+<h3>v3.11.00 - 2023/03/23<a class="headerlink" href="#v3-11-00-2023-03-23" title="Permalink to this headline"></a></h3>
+<p>The upgrade path from the preceding version is straightforward, however there is a change
+that you might want to be aware of before hitting the upgrade button:</p>
+<p>The previously implicitly assumed <code class="docutils literal notranslate"><span class="pre">--port-any</span></code> and <code class="docutils literal notranslate"><span class="pre">--user-any</span></code> options
+to the <code class="docutils literal notranslate"><span class="pre">(self|account)(Add|Del)PersonalAccess</span></code> commands, when either <code class="docutils literal notranslate"><span class="pre">--user</span></code> or <code class="docutils literal notranslate"><span class="pre">--port</span></code> were omitted,
+now require to be stated explicitly, to be consistent with the behaviour of <code class="docutils literal notranslate"><span class="pre">group(Add|Del)Server</span></code>,
+which always required it. Note that using this mechanism always emitted a deprecation warning,
+since the first publicly released version, encouraging the explicit use of <code class="docutils literal notranslate"><span class="pre">--user-any</span></code> and/or <code class="docutils literal notranslate"><span class="pre">--port-any</span></code>
+when this was desired. Now, omitting these options will simply return an error,
+as this has always been the case with <code class="docutils literal notranslate"><span class="pre">group(Add|Del)Server</span></code>.</p>
+<p>Example of previous behaviour:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>$ bssh --osh selfAddPersonalAccess --host <span class="m">127</span>.0.0.5 --force
+╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.10.00───
+│ ▶ adding personal access to a server on your account
+├───────────────────────────────────────────────────────────────────────────────
+│ ❗ You didn<span class="s1">&#39;t specify --user or --user-any, defaulting to --user-any, this will no longer be implicit in future versions</span>
+<span class="s1">│ ❗ You didn&#39;</span>t specify --port or --port-any, defaulting to --port-any, this will no longer be implicit <span class="k">in</span> future versions
+│ Forcing add as asked, we didn<span class="s1">&#39;t test the SSH connection, maybe it won&#39;</span>t work!
+│ Access to <span class="m">127</span>.0.0.5 was added to account jdoe
+╰────────────────────────────────────────────────────&lt;/selfAddPersonalAccess&gt;───
+</pre></div>
+</div>
+<p>Example of new behaviour:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>$ bssh --osh selfAddPersonalAccess --host 127.0.0.5 --force
+╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.11.00───
+│ ▶ adding personal access to a server on your account
+├───────────────────────────────────────────────────────────────────────────────
+│ Add a personal server access on your account
+│
+│ Usage: --osh selfAddPersonalAccess --host HOST [OPTIONS]
+│
+│   --host IP|HOST|IP/MASK   Server to add access to
+│   --user USER              Remote login to use, if you want to allow any login, use --user-any
+│   --user-any               Allow access with any remote login
+│   --port PORT              Remote SSH port to use, if you want to allow any port, use --port-any
+│   --port-any               Allow access to all remote ports
+│   --scpup                  Allow SCP upload, you--bastion--&gt;server (omit --user in this case)
+│   --scpdown                Allow SCP download, you&lt;--bastion--server (omit --user in this case)
+│   --sftp                   Allow usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)
+│   --force                  Add the access without checking that the public SSH key is properly installed remotely
+│   --force-key FINGERPRINT  Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)
+│   --force-password HASH    Only use the password with the specified hash to connect to the server (cf selfListPasswords)
+│   --ttl SECONDS|DURATION   Specify a number of seconds (or a duration string, such as &quot;1d7h8m&quot;) after which the access will automatically expire
+│   --comment &quot;&#39;ANY TEXT&#39;&quot;   Add a comment alongside this server. Quote it twice as shown if you&#39;re under a shell.
+│
+│ ⛔ No user specified, if you want to add this server with any user, use --user-any
+╰────────────────────────────────────────────────────&lt;/selfAddPersonalAccess&gt;───
+</pre></div>
+</div>
+</section>
+<section id="v3-10-00-2023-02-17">
+<h3>v3.10.00 - 2023/02/17<a class="headerlink" href="#v3-10-00-2023-02-17" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-09-02-2022-11-15">
+<h3>v3.09.02 - 2022/11/15<a class="headerlink" href="#v3-09-02-2022-11-15" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-09-01-2022-10-10">
+<h3>v3.09.01 - 2022/10/10<a class="headerlink" href="#v3-09-01-2022-10-10" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-09-00-2022-09-21">
+<h3>v3.09.00 - 2022/09/21<a class="headerlink" href="#v3-09-00-2022-09-21" title="Permalink to this headline"></a></h3>
+<p>This version has changes around the satellite system scripts that should be reviewed:</p>
+<ul class="simple">
+<li><p>The <code class="docutils literal notranslate"><span class="pre">osh-encrypt-rsync.pl</span></code> script now also handles the account's access log and sql logs,
+in addition to the ttyrec files.
+A number of new options have been added to this script's config file, these options have sane defaults but you
+might still want to review those, namely <a class="reference external" href="https://ovh.github.io/the-bastion/administration/configuration/osh-encrypt-rsync_conf.html#encrypt-and-move-user-logs-delay-days">encrypt_and_move_user_logs_delay_days</a>
+and <a class="reference external" href="https://ovh.github.io/the-bastion/administration/configuration/osh-encrypt-rsync_conf.html#encrypt-and-move-user-sqlites-delay-days">encrypt_and_move_user_sqlites_delay_days</a>.</p></li>
+<li><p>As a result of the previous feature, the <code class="docutils literal notranslate"><span class="pre">compress-old-logs.sh</span></code> script has been retired.</p></li>
+<li><p>A new script, <code class="docutils literal notranslate"><span class="pre">osh-cleanup-guest-key-access.pl</span></code>, has been added. It is enabled by default, though it can
+be disabled if you have a good reason to do so. Please refer to its <a class="reference external" href="https://ovh.github.io/thge-bastion/administration/configuration/osh-cleanup-guest-key-access_conf.html">documentation</a> for more
+information.</p></li>
+<li><p>All scripts that are automatically run by cron and reside under the <code class="docutils literal notranslate"><span class="pre">bin/cron</span></code> subfolder now have their own
+configuration file in <code class="docutils literal notranslate"><span class="pre">/etc/bastion</span></code>, even for simple scripts that only have two configuration knobs: their
+logging facility and whether they should be enabled or not. It is now recommended to use these configuration knobs
+to disable the scripts you don't want to see running, instead of removing their corresponding file in the
+<code class="docutils literal notranslate"><span class="pre">/etc/cron.d</span></code> folder, as any future update of the bastion would install them back.</p></li>
+<li><p>The logging format has been standardized across these scripts, to ensure the newly included NRPE probes can detect
+errors in the scripts more easily. By default the logs are going through syslog, using the <code class="docutils literal notranslate"><span class="pre">local6</span></code> facility,
+which ends up in the <code class="docutils literal notranslate"><span class="pre">/var/log/bastion/bastion-scripts.log</span></code> folder if you're using our stock <code class="docutils literal notranslate"><span class="pre">syslog-ng</span></code>
+configuration. The NRPE probes are available in the <code class="docutils literal notranslate"><span class="pre">contrib/nrpe</span></code> directory.</p></li>
+</ul>
+<p>Additionally, NRPE probes have been added, and should be used to monitor your bastion instances / clusters.
+More information is available in the <a class="reference external" href="https://github.com/ovh/the-bastion/blob/master/contrib/nrpe/README.md">NRPE probes readme file</a>.</p>
+<p>Last but not least, CentOS 8 support has been dropped (whereas RockyLinux 8 will remain supported),
+and Ubuntu 22.04 LTS support has been added.</p>
+</section>
+<section id="v3-08-01-2022-01-19">
+<h3>v3.08.01 - 2022/01/19<a class="headerlink" href="#v3-08-01-2022-01-19" title="Permalink to this headline"></a></h3>
+<p>The upgrade path from the preceding version is straightforward, however you might want to know that there is
+a new satellite script: <code class="docutils literal notranslate"><span class="pre">osh-remove-empty-folders.sh</span></code>, run by cron and enabled by default,
+whose job is to garbage-collect empty folders that may be piling up in busy users' homes,
+under their <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> folder.</p>
+<p>You can find more information in <a class="reference external" href="https://ovh.github.io/the-bastion/administration/configuration/osh-remove-empty-folders_conf.html">the documentation</a>, the script
+is enabled by default because it can do no harm.</p>
+</section>
+<section id="v3-08-00-2022-01-04">
+<h3>v3.08.00 - 2022/01/04<a class="headerlink" href="#v3-08-00-2022-01-04" title="Permalink to this headline"></a></h3>
+<p>This version replaces usage of GnuPG 1.x by GnuPG 2.x for the backup/encrypt/rsync satellite scripts, namely:</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">bin/cron/osh-backup-acl-keys.sh</span></code></p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">bin/cron/osh-encrypt-rsync.pl</span></code></p></li>
+</ul>
+<p>These are optionally used to help you backup your system, and encrypt/move out ttyrec files.
+If you don't use these scripts and never configured them as seen in the <a class="reference internal" href="advanced.html"><span class="doc">Advanced Installation</span></a> section,
+then you have nothing to do.</p>
+<p>The script <code class="docutils literal notranslate"><span class="pre">setup-gpg.sh</span></code> will now create an Ed25519 key by default, instead of a 4K RSA key.
+This type of key is usually seen as more secure (elliptic curve cryptography), and faster than RSA keys.
+If you have already configured your system, then the above scripts will continue using the previously generated
+RSA key, unless you generate a new key and reference it in the scripts configuration files.</p>
+<p>If you want to generate new Ed25519 keys instead of using your preexisting RSA keys, you may proceed
+to the <a class="reference internal" href="#upgrading-ed25519"><span class="std std-ref">Ed25519 section below</span></a>.</p>
+<p>Otherwise, on the first run, GnuPG 2.x should transparently import the 1.x keyring.
+To verify that it worked correctly, you may want to try:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+</pre></div>
+</div>
+<p>If you see <em>Config test passed</em>, and you're okay using your preexisting 4K RSA key, then you may stop here.</p>
+<p>If the test fails, and you know that before upgrading, this script worked correctly, then you might need to
+manually import the GnuPG 1.x public keys:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>gpg1 --armor --export <span class="p">|</span> gpg --import
+</pre></div>
+</div>
+<p>Then, try again:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+</pre></div>
+</div>
+<p>If you don't see any errors here, you're done.</p>
+<p>If you still see errors, then you might need to manually import the private key:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>gpg1 --armor --export-secret-keys <span class="p">|</span> gpg --import
+</pre></div>
+</div>
+<p>You may get asked for a password for the bastion secret key, which should be found in
+<code class="docutils literal notranslate"><span class="pre">/etc/bastion/osh-encrypt-rsync.conf.d/50-gpg-bastion-key.conf</span></code> if you previously used the script to generate it.</p>
+<p>A last config test should now work:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+</pre></div>
+</div>
+<p>If you prefer to generate Ed25519 keys instead, then you can proceed to the next section.</p>
+<section id="ed25519">
+<span id="upgrading-ed25519"></span><h4>Ed25519<a class="headerlink" href="#ed25519" title="Permalink to this headline"></a></h4>
+<p>If you want to replace your RSA key by an Ed25519 one (which is optional), then you don't need to import the
+GnuPG 1.x keys as outlined above but you may run instead:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/setup-gpg.sh generate --overwrite
+</pre></div>
+</div>
+<p>Once the key has been generated, you may also want to generate a new admin key, by following this
+<a class="reference internal" href="advanced.html#generating-and-importing-the-admins-gpg-key"><span class="std std-ref">section</span></a> of the Advanced Installation documentation.
+Note that you'll need to use the <code class="docutils literal notranslate"><span class="pre">--overwrite</span></code> parameter when importing:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/admin/setup-gpg.sh import --overwrite
+</pre></div>
+</div>
+<p>Once done, a config test should work:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>/opt/bastion/bin/cron/osh-encrypt-rsync.pl --config-test
+</pre></div>
+</div>
+</section>
+</section>
+<section id="v3-07-00-2021-12-13">
+<h3>v3.07.00 - 2021/12/13<a class="headerlink" href="#v3-07-00-2021-12-13" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-06-00-2021-10-15">
+<h3>v3.06.00 - 2021/10/15<a class="headerlink" href="#v3-06-00-2021-10-15" title="Permalink to this headline"></a></h3>
+<p>The <code class="docutils literal notranslate"><span class="pre">sshd_config</span></code> templates have been modified to reflect the changes needed to use
+the new <code class="docutils literal notranslate"><span class="pre">--pubkey-auth-optional</span></code> parameter of <a class="reference internal" href="../plugins/restricted/accountModify.html"><span class="doc">accountModify</span></a>
+(<a class="reference external" href="https://github.com/ovh/the-bastion/pull/237">#237</a>).
+If you want to use it, don't forget to review your <code class="docutils literal notranslate"><span class="pre">sshd_config</span></code> and modify it accordingly:
+the templates can be found in <code class="docutils literal notranslate"><span class="pre">etc/ssh/</span></code>.</p>
+<p>Note that misconfiguring <cite>sshd</cite> and <cite>pam</cite> together could at worst entirely disable sshd authentication.
+If you have a custom configuration, different from the templates we provide, please double-check
+that such corner case is not possible by design.
+A good way to ensure this is to review the <cite>pam</cite> configuration and ensure that there is no execution
+flow that pushes a <cite>pam_success</cite> value to the pam stack without requiring any form of authentication.</p>
+</section>
+<section id="v3-05-01-2021-09-22">
+<h3>v3.05.01 - 2021/09/22<a class="headerlink" href="#v3-05-01-2021-09-22" title="Permalink to this headline"></a></h3>
+<p>In the configuration of the <code class="docutils literal notranslate"><span class="pre">osh-backup-acl-keys</span></code> script, a signing key can now be specified so that the backups
+are signed by the bastion key in addition to being encrypted to the admin(s) key(s).
+By default, the behaviour is the same as before: encrypt but don't sign.</p>
+</section>
+<section id="v3-05-00-2021-09-14">
+<h3>v3.05.00 - 2021/09/14<a class="headerlink" href="#v3-05-00-2021-09-14" title="Permalink to this headline"></a></h3>
+<p>The maximum length of accounts is now 28 characters up from 18 characters previously.
+If you have setup a HA cluster with several bastion instances synchronized together, note that accounts longer
+than 18 characters will not be deemed as valid on not-yet upgraded instances of a cluster.</p>
+</section>
+<section id="v3-04-00-2021-07-02">
+<h3>v3.04.00 - 2021/07/02<a class="headerlink" href="#v3-04-00-2021-07-02" title="Permalink to this headline"></a></h3>
+<p>The upgrade path from the preceding version is straightforward, however there are a few changes
+that you might want to be aware of before hitting the upgrade button:</p>
+<ul class="simple">
+<li><p>Some EOL OSes have been dropped: Debian 8, Ubuntu 14.04, OpenSUSE 15.0 and 15.1.
+This means that while the software might still work, theses OSes are no longer part of the tests
+and might break in any future upgrade.</p></li>
+<li><p>The default logging level of the <a class="reference internal" href="../using/http_proxy.html"><span class="doc">HTTPS Proxy</span></a> has been decreased. If you want to keep full requests
+and responses logging, check the <a class="reference internal" href="../administration/configuration/osh-http-proxy_conf.html"><span class="doc">log_request_response and log_request_response_max_size</span></a> configuration options.</p></li>
+</ul>
+</section>
+<section id="v3-03-01-2021-03-25">
+<h3>v3.03.01 - 2021/03/25<a class="headerlink" href="#v3-03-01-2021-03-25" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-03-00-2021-02-22">
+<h3>v3.03.00 - 2021/02/22<a class="headerlink" href="#v3-03-00-2021-02-22" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-02-00-2021-02-01">
+<h3>v3.02.00 - 2021/02/01<a class="headerlink" href="#v3-02-00-2021-02-01" title="Permalink to this headline"></a></h3>
+<p>The upgrade path from the preceding version is straightforward, however there are a few changes
+that you might want to be aware of before hitting the upgrade button:</p>
+<section id="the-main-configuration-file-now-supports-proper-booleans">
+<h4>The main configuration file now supports proper booleans<a class="headerlink" href="#the-main-configuration-file-now-supports-proper-booleans" title="Permalink to this headline"></a></h4>
+<p>For a lot of configuration options, previously you would specify &quot;1&quot; to enable a feature, and &quot;0&quot; to disable it.
+This has been changed to use proper <em>true</em> and <em>false</em> json values in <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/bastion.conf</span></code>.
+Of course, backward compatibility with &quot;0&quot; and &quot;1&quot; will always be kept, so no breakage is to be expected
+for this version or future ones even if you keep your configuration untouched.</p>
+</section>
+<section id="logs-have-been-enhanced">
+<h4>Logs have been enhanced<a class="headerlink" href="#logs-have-been-enhanced" title="Permalink to this headline"></a></h4>
+<p>All connections and plugin executions emit two logs, an <em>open</em> and a <em>close</em> log.
+We now add all the details of the connection to the <em>close</em> logs, those that were previously only available
+in the corresponding <em>open</em> log. This way, it is no longer required to correlate both logs with their uniqid
+to have all the data: the <em>close</em> log should suffice.
+The <em>open</em> log is still there if for some reason the <em>close</em> log can't be emitted (kill -9, system crash, etc.),
+or if the <em>open</em> and the <em>close</em> log are several hours, days or months appart.</p>
+<p>An additional field <strong>duration</strong> has been added to the <em>close</em> logs,
+this represents the number of seconds (with millisecond precision) the connection lasted.</p>
+<p>Two new fields <strong>globalsql</strong> and <strong>accountsql</strong> have been added to the <em>open</em>-type logs.
+These will contain either <cite>ok</cite> if we successfully logged to the corresponding log database,
+<cite>no</cite> if it is disabled, or <cite>error $aDetailedMessage</cite> if we got an error trying to insert the row.
+The <em>close</em>-type log also has the new <strong>accountsql_close</strong> field, but misses the <strong>globalsql_close</strong> field as
+we never update the global database on this event.
+On the <em>close</em> log, we can also have the value <strong>missing</strong>, indicating that we couldn't update the access log row
+in the database, as the corresponding <em>open</em> log couldn't insert it.</p>
+<p>The <strong>ttyrecsize</strong> log field for the <em>close</em>-type logs has been removed, as it was never completely implemented,
+and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases.</p>
+<p>The <em>open</em> and <em>close</em> events are now pushed to our own log files, in addition to syslog, if logging to those files
+is enabled (see <a class="reference internal" href="../administration/configuration/bastion_conf.html#enableglobalaccesslog"><span class="std std-ref">enableGlobalAccessLog</span></a> and <a class="reference internal" href="../administration/configuration/bastion_conf.html#enableaccountaccesslog"><span class="std std-ref">enableAccountAccessLog</span></a>),
+previously the <em>close</em> events were only pushed to syslog.</p>
+<p>The <code class="file docutils literal notranslate"><span class="pre">/home/osh.log</span></code> file is no longer used for <a class="reference internal" href="../administration/configuration/bastion_conf.html#enableglobalaccesslog"><span class="std std-ref">enableGlobalAccessLog</span></a>, the global log
+is instead written to <code class="file docutils literal notranslate"><span class="pre">/home/logkeeper/global-log-YYYYMM.log</span></code>.</p>
+<p>The global sql file, enabled with <a class="reference internal" href="../administration/configuration/bastion_conf.html#enableglobalsqllog"><span class="std std-ref">enableGlobalSqlLog</span></a>, is now split by year-month instead of by year,
+to <code class="file docutils literal notranslate"><span class="pre">/home/logkeeper/global-log-YYYYMM.sqlite</span></code>.</p>
+</section>
+</section>
+<section id="v3-01-03-2020-12-15">
+<h3>v3.01.03 - 2020/12/15<a class="headerlink" href="#v3-01-03-2020-12-15" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-01-02-2020-12-08">
+<h3>v3.01.02 - 2020/12/08<a class="headerlink" href="#v3-01-02-2020-12-08" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-01-01-2020-12-04">
+<h3>v3.01.01 - 2020/12/04<a class="headerlink" href="#v3-01-01-2020-12-04" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-01-00-2020-11-20">
+<h3>v3.01.00 - 2020/11/20<a class="headerlink" href="#v3-01-00-2020-11-20" title="Permalink to this headline"></a></h3>
+<p>A new bastion.conf option was introduced: <em>interactiveModeByDefault</em>. If not present in your config file,
+its value defaults to 1 (true), which changes the behavior of The Bastion when a user connects
+without specifying any command.
+When this happens, it'll now display the help then drop the user into interactive mode (if this mode is enabled),
+instead of displaying the help and aborting with an error message.
+Set it to 0 (false) if you want to keep the previous behavior.</p>
+<p>An SELinux module has been added in this version, to ensure TOTP MFA works correctly under systems where SELinux
+is on enforcing mode. This module will be installed automatically whenever SELinux is detected on the system.
+If you don't want to use this module, specify <cite>--no-install-selinux-module</cite> on your <cite>/opt/bastion/bin/admin/install</cite>
+upgrade call (please refer to the generic upgrade instructions for more details).</p>
+</section>
+<section id="v3-00-02-2020-11-16">
+<h3>v3.00.02 - 2020/11/16<a class="headerlink" href="#v3-00-02-2020-11-16" title="Permalink to this headline"></a></h3>
+<p>No specific upgrade instructions.</p>
+</section>
+<section id="v3-00-01-2020-11-06">
+<h3>v3.00.01 - 2020/11/06<a class="headerlink" href="#v3-00-01-2020-11-06" title="Permalink to this headline"></a></h3>
+<p>If you previously installed <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> using the now deprecated <code class="docutils literal notranslate"><span class="pre">build-and-install-ttyrec.sh</span></code> script,
+you might want to know that since this version, the script has been replaced by <code class="docutils literal notranslate"><span class="pre">install-ttyrec.sh</span></code>,
+which no longer builds in-place, but prefers downloading and installing prebuild <code class="docutils literal notranslate"><span class="pre">rpm</span></code> or <code class="docutils literal notranslate"><span class="pre">deb</span></code> packages.</p>
+<p>If you previously built and installed <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> manually, and want to use the new packages instead,
+you might want to manually uninstall your previously built ttyrec program (remove the binaries that were installed
+in <code class="docutils literal notranslate"><span class="pre">/usr/local/bin</span></code>), and call <code class="docutils literal notranslate"><span class="pre">install-ttyrec.sh</span> <span class="pre">-a</span></code> to download and install the proper package instead.</p>
+<p>This is not mandatory and doesn't change anything from the software point of view.</p>
+</section>
+<section id="v3-00-00-2020-10-30">
+<h3>v3.00.00 - 2020/10/30<a class="headerlink" href="#v3-00-00-2020-10-30" title="Permalink to this headline"></a></h3>
+<p>Initial public version, no specific upgrade instructions.</p>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="advanced.html" class="btn btn-neutral float-left" title="Advanced Installation" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="docker.html" class="btn btn-neutral float-right" title="Sandbox using Docker" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/objects.inv b/objects.inv
new file mode 100644
index 000000000..98e021ab1
Binary files /dev/null and b/objects.inv differ
diff --git a/plugins/admin/adminMaintenance.html b/plugins/admin/adminMaintenance.html
new file mode 100644
index 000000000..8344b0d24
--- /dev/null
+++ b/plugins/admin/adminMaintenance.html
@@ -0,0 +1,178 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>adminMaintenance &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="adminSudo" href="adminSudo.html" />
+    <link rel="prev" title="admin plugins" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">admin plugins</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">adminMaintenance</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#manage-the-bastion-maintenance-mode">Manage the bastion maintenance mode</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="adminSudo.html">adminSudo</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">admin plugins</a> &raquo;</li>
+      <li>adminMaintenance</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/admin/adminMaintenance.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="adminmaintenance">
+<h1>adminMaintenance<a class="headerlink" href="#adminmaintenance" title="Permalink to this headline"></a></h1>
+<section id="manage-the-bastion-maintenance-mode">
+<h2>Manage the bastion maintenance mode<a class="headerlink" href="#manage-the-bastion-maintenance-mode" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh adminMaintenance &lt;--lock [--message &quot;'reason for maintenance'&quot;]|--unlock&gt;</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-adminMaintenance-lock">
+<span id="cmdoption-adminmaintenance-lock"></span><span class="sig-name descname"><span class="pre">--lock</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-adminMaintenance-lock" title="Permalink to this definition"></a></dt>
+<dd><p>Set maintenance mode: new logins will be disallowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-adminMaintenance-unlock">
+<span id="cmdoption-adminmaintenance-unlock"></span><span class="sig-name descname"><span class="pre">--unlock</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-adminMaintenance-unlock" title="Permalink to this definition"></a></dt>
+<dd><p>Unset maintenance mode: new logins are allowed and the bastion functions normally</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-adminMaintenance-message">
+<span id="cmdoption-adminmaintenance-message"></span><span class="sig-name descname"><span class="pre">--message</span></span><span class="sig-prename descclassname"> <span class="pre">MESSAGE</span></span><a class="headerlink" href="#cmdoption-adminMaintenance-message" title="Permalink to this definition"></a></dt>
+<dd><p>Optionally set a maintenance reason, if you're in a shell, quote it twice.</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="admin plugins" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="adminSudo.html" class="btn btn-neutral float-right" title="adminSudo" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/admin/adminSudo.html b/plugins/admin/adminSudo.html
new file mode 100644
index 000000000..42b8eb386
--- /dev/null
+++ b/plugins/admin/adminSudo.html
@@ -0,0 +1,178 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>adminSudo &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="group-aclkeeper plugins" href="../group-aclkeeper/index.html" />
+    <link rel="prev" title="adminMaintenance" href="adminMaintenance.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">admin plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="adminMaintenance.html">adminMaintenance</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">adminSudo</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#impersonate-another-user">Impersonate another user</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">admin plugins</a> &raquo;</li>
+      <li>adminSudo</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/admin/adminSudo.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="adminsudo">
+<h1>adminSudo<a class="headerlink" href="#adminsudo" title="Permalink to this headline"></a></h1>
+<section id="impersonate-another-user">
+<h2>Impersonate another user<a class="headerlink" href="#impersonate-another-user" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh adminSudo -- --sudo-as ACCOUNT &lt;--sudo-cmd PLUGIN -- [PLUGIN specific options...]&gt;</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-adminSudo-sudo-as">
+<span id="cmdoption-adminsudo-sudo-as"></span><span class="sig-name descname"><span class="pre">--sudo-as</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-adminSudo-sudo-as" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which bastion account we want to impersonate</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-adminSudo-sudo-cmd">
+<span id="cmdoption-adminsudo-sudo-cmd"></span><span class="sig-name descname"><span class="pre">--sudo-cmd</span></span><span class="sig-prename descclassname"> <span class="pre">PLUGIN</span></span><a class="headerlink" href="#cmdoption-adminSudo-sudo-cmd" title="Permalink to this definition"></a></dt>
+<dd><p>--osh command we want to launch as the user (see --osh help)</p>
+</dd></dl>
+
+<p>Example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh adminSudo -- --sudo-as user12 --sudo-cmd info -- --name somebodyelse
+</pre></div>
+</div>
+<p>Don't forget the double-double-dash as seen in the example above: one after the plugin name,
+and another one to separate adminSudo options from the options of the plugin to be called.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="adminMaintenance.html" class="btn btn-neutral float-left" title="adminMaintenance" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../group-aclkeeper/index.html" class="btn btn-neutral float-right" title="group-aclkeeper plugins" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/admin/index.html b/plugins/admin/index.html
new file mode 100644
index 000000000..22996f733
--- /dev/null
+++ b/plugins/admin/index.html
@@ -0,0 +1,161 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>admin plugins &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="adminMaintenance" href="adminMaintenance.html" />
+    <link rel="prev" title="Writing tests" href="../../development/tests.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">admin plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="adminMaintenance.html">adminMaintenance</a></li>
+<li class="toctree-l2"><a class="reference internal" href="adminSudo.html">adminSudo</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>admin plugins</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/admin/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="admin-plugins">
+<h1>admin plugins<a class="headerlink" href="#admin-plugins" title="Permalink to this headline"></a></h1>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="adminMaintenance.html">adminMaintenance</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="adminMaintenance.html#manage-the-bastion-maintenance-mode">Manage the bastion maintenance mode</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="adminSudo.html">adminSudo</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="adminSudo.html#impersonate-another-user">Impersonate another user</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../../development/tests.html" class="btn btn-neutral float-left" title="Writing tests" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="adminMaintenance.html" class="btn btn-neutral float-right" title="adminMaintenance" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-aclkeeper/groupAddServer.html b/plugins/group-aclkeeper/groupAddServer.html
new file mode 100644
index 000000000..1634b7e68
--- /dev/null
+++ b/plugins/group-aclkeeper/groupAddServer.html
@@ -0,0 +1,252 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupAddServer &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelServer" href="groupDelServer.html" />
+    <link rel="prev" title="group-aclkeeper plugins" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-aclkeeper plugins</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupAddServer</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-an-ip-or-ip-block-to-a-group-s-servers-list">Add an IP or IP block to a group's servers list</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelServer.html">groupDelServer</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-aclkeeper plugins</a> &raquo;</li>
+      <li>groupAddServer</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-aclkeeper/groupAddServer.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupaddserver">
+<h1>groupAddServer<a class="headerlink" href="#groupaddserver" title="Permalink to this headline"></a></h1>
+<section id="add-an-ip-or-ip-block-to-a-group-s-servers-list">
+<h2>Add an IP or IP block to a group's servers list<a class="headerlink" href="#add-an-ip-or-ip-block-to-a-group-s-servers-list" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupAddServer --group GROUP [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-group">
+<span id="cmdoption-groupaddserver-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupAddServer-group" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which group this machine should be added to (it should have the public group key of course)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-host">
+<span id="cmdoption-groupaddserver-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST|IP|NET/CIDR</span></span><a class="headerlink" href="#cmdoption-groupAddServer-host" title="Permalink to this definition"></a></dt>
+<dd><p>Host(s) to add access to, either a HOST which will be resolved to an IP immediately, or an IP,</p>
+<blockquote>
+<div><p>or a whole network using the NET/CIDR notation</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-user">
+<span id="cmdoption-groupaddserver-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-groupAddServer-user" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which remote user should be allowed (root, run, etc...)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-user-any">
+<span id="cmdoption-groupaddserver-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddServer-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>Allow any remote user (the remote user should still have the public group key in all cases)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-port">
+<span id="cmdoption-groupaddserver-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-groupAddServer-port" title="Permalink to this definition"></a></dt>
+<dd><p>Only allow access to this port (e.g. 22)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-port-any">
+<span id="cmdoption-groupaddserver-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddServer-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>Allow access to any port</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-scpup">
+<span id="cmdoption-groupaddserver-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddServer-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>Allow SCP upload, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-scpdown">
+<span id="cmdoption-groupaddserver-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddServer-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>Allow SCP download, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-sftp">
+<span id="cmdoption-groupaddserver-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddServer-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>Allow usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-force">
+<span id="cmdoption-groupaddserver-force"></span><span class="sig-name descname"><span class="pre">--force</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddServer-force" title="Permalink to this definition"></a></dt>
+<dd><p>Don't try the ssh connection, just add the host to the group blindly</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-force-key">
+<span id="cmdoption-groupaddserver-force-key"></span><span class="sig-name descname"><span class="pre">--force-key</span></span><span class="sig-prename descclassname"> <span class="pre">FINGERPRINT</span></span><a class="headerlink" href="#cmdoption-groupAddServer-force-key" title="Permalink to this definition"></a></dt>
+<dd><p>Only use the key with the specified fingerprint to connect to the server (cf groupInfo)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-force-password">
+<span id="cmdoption-groupaddserver-force-password"></span><span class="sig-name descname"><span class="pre">--force-password</span></span><span class="sig-prename descclassname"> <span class="pre">HASH</span></span><a class="headerlink" href="#cmdoption-groupAddServer-force-password" title="Permalink to this definition"></a></dt>
+<dd><p>Only use the password with the specified hash to connect to the server (cf groupListPasswords)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-ttl">
+<span id="cmdoption-groupaddserver-ttl"></span><span class="sig-name descname"><span class="pre">--ttl</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS|DURATION</span></span><a class="headerlink" href="#cmdoption-groupAddServer-ttl" title="Permalink to this definition"></a></dt>
+<dd><p>Specify a number of seconds (or a duration string, such as &quot;1d7h8m&quot;) after which the access will automatically expire</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddServer-comment">
+<span id="cmdoption-groupaddserver-comment"></span><span class="sig-name descname"><span class="pre">--comment</span></span><span class="sig-prename descclassname"> <span class="pre">'&quot;ANY</span> <span class="pre">TEXT'&quot;</span></span><a class="headerlink" href="#cmdoption-groupAddServer-comment" title="Permalink to this definition"></a></dt>
+<dd><p>Add a comment alongside this server</p>
+</dd></dl>
+
+<p>Examples:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh groupAddServer --group grp1 --host <span class="m">203</span>.0.113.0/24 --user-any --port-any --force --comment <span class="s1">&#39;&quot;a whole network&quot;&#39;</span>
+--osh groupAddServer --group grp2 --host srv1.example.org --user root --port <span class="m">22</span>
+</pre></div>
+</div>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="group-aclkeeper plugins" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelServer.html" class="btn btn-neutral float-right" title="groupDelServer" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-aclkeeper/groupDelServer.html b/plugins/group-aclkeeper/groupDelServer.html
new file mode 100644
index 000000000..65cd525fd
--- /dev/null
+++ b/plugins/group-aclkeeper/groupDelServer.html
@@ -0,0 +1,214 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelServer &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="group-gatekeeper plugins" href="../group-gatekeeper/index.html" />
+    <link rel="prev" title="groupAddServer" href="groupAddServer.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-aclkeeper plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddServer.html">groupAddServer</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelServer</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-an-ip-or-ip-block-from-a-group-s-server-list">Remove an IP or IP block from a group's server list</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-aclkeeper plugins</a> &raquo;</li>
+      <li>groupDelServer</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-aclkeeper/groupDelServer.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelserver">
+<h1>groupDelServer<a class="headerlink" href="#groupdelserver" title="Permalink to this headline"></a></h1>
+<section id="remove-an-ip-or-ip-block-from-a-group-s-server-list">
+<h2>Remove an IP or IP block from a group's server list<a class="headerlink" href="#remove-an-ip-or-ip-block-from-a-group-s-server-list" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelServer --group GROUP [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-group">
+<span id="cmdoption-groupdelserver-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelServer-group" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which group this machine should be removed from</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-host">
+<span id="cmdoption-groupdelserver-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST|IP|NET/CIDR</span></span><a class="headerlink" href="#cmdoption-groupDelServer-host" title="Permalink to this definition"></a></dt>
+<dd><p>Host(s) we want to remove access to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-user">
+<span id="cmdoption-groupdelserver-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-groupDelServer-user" title="Permalink to this definition"></a></dt>
+<dd><p>Remote user that was allowed, if any user was allowed, use --user-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-user-any">
+<span id="cmdoption-groupdelserver-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelServer-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>Use if any remote login was allowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-port">
+<span id="cmdoption-groupdelserver-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-groupDelServer-port" title="Permalink to this definition"></a></dt>
+<dd><p>Remote SSH port that was allowed, if any port was allowed, use --port-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-port-any">
+<span id="cmdoption-groupdelserver-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelServer-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>Use if any remote port was allowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-scpup">
+<span id="cmdoption-groupdelserver-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelServer-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>Remove SCP upload right, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-scpdown">
+<span id="cmdoption-groupdelserver-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelServer-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>Remove SCP download right, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelServer-sftp">
+<span id="cmdoption-groupdelserver-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelServer-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>Remove usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupAddServer.html" class="btn btn-neutral float-left" title="groupAddServer" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../group-gatekeeper/index.html" class="btn btn-neutral float-right" title="group-gatekeeper plugins" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-aclkeeper/index.html b/plugins/group-aclkeeper/index.html
new file mode 100644
index 000000000..2aa85230a
--- /dev/null
+++ b/plugins/group-aclkeeper/index.html
@@ -0,0 +1,161 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>group-aclkeeper plugins &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupAddServer" href="groupAddServer.html" />
+    <link rel="prev" title="adminSudo" href="../admin/adminSudo.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">group-aclkeeper plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddServer.html">groupAddServer</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelServer.html">groupDelServer</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>group-aclkeeper plugins</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-aclkeeper/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="group-aclkeeper-plugins">
+<h1>group-aclkeeper plugins<a class="headerlink" href="#group-aclkeeper-plugins" title="Permalink to this headline"></a></h1>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="groupAddServer.html">groupAddServer</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddServer.html#add-an-ip-or-ip-block-to-a-group-s-servers-list">Add an IP or IP block to a group's servers list</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelServer.html">groupDelServer</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelServer.html#remove-an-ip-or-ip-block-from-a-group-s-server-list">Remove an IP or IP block from a group's server list</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../admin/adminSudo.html" class="btn btn-neutral float-left" title="adminSudo" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupAddServer.html" class="btn btn-neutral float-right" title="groupAddServer" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-gatekeeper/groupAddGuestAccess.html b/plugins/group-gatekeeper/groupAddGuestAccess.html
new file mode 100644
index 000000000..2657e7929
--- /dev/null
+++ b/plugins/group-gatekeeper/groupAddGuestAccess.html
@@ -0,0 +1,246 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupAddGuestAccess &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupAddMember" href="groupAddMember.html" />
+    <link rel="prev" title="group-gatekeeper plugins" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-gatekeeper plugins</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupAddGuestAccess</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-a-specific-group-server-access-to-an-account">Add a specific group server access to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddMember.html">groupAddMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGuestAccess.html">groupDelGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelMember.html">groupDelMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListGuestAccesses.html">groupListGuestAccesses</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-gatekeeper plugins</a> &raquo;</li>
+      <li>groupAddGuestAccess</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-gatekeeper/groupAddGuestAccess.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupaddguestaccess">
+<h1>groupAddGuestAccess<a class="headerlink" href="#groupaddguestaccess" title="Permalink to this headline"></a></h1>
+<section id="add-a-specific-group-server-access-to-an-account">
+<h2>Add a specific group server access to an account<a class="headerlink" href="#add-a-specific-group-server-access-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupAddGuestAccess --group GROUP --account ACCOUNT [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-group">
+<span id="cmdoption-groupaddguestaccess-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-group" title="Permalink to this definition"></a></dt>
+<dd><p>group to add guest access to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-account">
+<span id="cmdoption-groupaddguestaccess-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-account" title="Permalink to this definition"></a></dt>
+<dd><p>name of the other bastion account to add access to, they'll be given access to the GROUP key</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-host">
+<span id="cmdoption-groupaddguestaccess-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST|IP</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-host" title="Permalink to this definition"></a></dt>
+<dd><p>add access to this HOST (which must belong to the GROUP)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-user">
+<span id="cmdoption-groupaddguestaccess-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-user" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST only with remote login USER</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-user-any">
+<span id="cmdoption-groupaddguestaccess-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST with any remote login</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-port">
+<span id="cmdoption-groupaddguestaccess-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-port" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST only to remote port PORT</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-port-any">
+<span id="cmdoption-groupaddguestaccess-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST with any remote port</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-scpup">
+<span id="cmdoption-groupaddguestaccess-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>allow SCP upload, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-scpdown">
+<span id="cmdoption-groupaddguestaccess-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>allow SCP download, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-sftp">
+<span id="cmdoption-groupaddguestaccess-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>allow usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-ttl">
+<span id="cmdoption-groupaddguestaccess-ttl"></span><span class="sig-name descname"><span class="pre">--ttl</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS|DURATION</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-ttl" title="Permalink to this definition"></a></dt>
+<dd><p>specify a number of seconds after which the access will automatically expire</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGuestAccess-comment">
+<span id="cmdoption-groupaddguestaccess-comment"></span><span class="sig-name descname"><span class="pre">--comment</span></span><span class="sig-prename descclassname"> <span class="pre">'&quot;ANY</span> <span class="pre">TEXT&quot;'</span></span><a class="headerlink" href="#cmdoption-groupAddGuestAccess-comment" title="Permalink to this definition"></a></dt>
+<dd><p>add a comment alongside this access.</p>
+<blockquote>
+<div><p>If omitted, we'll use the closest preexisting group access' comment as seen in groupListServers</p>
+</div></blockquote>
+</dd></dl>
+
+<p>This command adds, to an existing bastion account, access to the egress keys of a group,
+but only to accessing one or several given servers, instead of all the servers of this group.</p>
+<p>If you want to add complete access to an account to all the present and future servers
+of the group, using the group key, please use <code class="docutils literal notranslate"><span class="pre">groupAddMember</span></code> instead.</p>
+<p>If you want to add access to an account to a group server but using his personal bastion
+key instead of the group key, please use <code class="docutils literal notranslate"><span class="pre">accountAddPersonalAccess</span></code> instead (his public key
+must be on the remote server).</p>
+<p>This command is the opposite of <code class="docutils literal notranslate"><span class="pre">groupDelGuestAccess</span></code>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="group-gatekeeper plugins" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupAddMember.html" class="btn btn-neutral float-right" title="groupAddMember" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-gatekeeper/groupAddMember.html b/plugins/group-gatekeeper/groupAddMember.html
new file mode 100644
index 000000000..da371b6af
--- /dev/null
+++ b/plugins/group-gatekeeper/groupAddMember.html
@@ -0,0 +1,179 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupAddMember &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelGuestAccess" href="groupDelGuestAccess.html" />
+    <link rel="prev" title="groupAddGuestAccess" href="groupAddGuestAccess.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-gatekeeper plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddGuestAccess.html">groupAddGuestAccess</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupAddMember</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-an-account-to-the-member-list">Add an account to the member list</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGuestAccess.html">groupDelGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelMember.html">groupDelMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListGuestAccesses.html">groupListGuestAccesses</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-gatekeeper plugins</a> &raquo;</li>
+      <li>groupAddMember</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-gatekeeper/groupAddMember.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupaddmember">
+<h1>groupAddMember<a class="headerlink" href="#groupaddmember" title="Permalink to this headline"></a></h1>
+<section id="add-an-account-to-the-member-list">
+<h2>Add an account to the member list<a class="headerlink" href="#add-an-account-to-the-member-list" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupAddMember --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddMember-group">
+<span id="cmdoption-groupaddmember-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupAddMember-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to set ACCOUNT as a member of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddMember-account">
+<span id="cmdoption-groupaddmember-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupAddMember-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to set as a member of GROUP</p>
+</dd></dl>
+
+<p>The specified account will be able to access all present and future servers
+pertaining to this group.
+If you need to give a specific and/or temporary access instead,
+see <code class="docutils literal notranslate"><span class="pre">groupAddGuestAccess</span></code></p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupAddGuestAccess.html" class="btn btn-neutral float-left" title="groupAddGuestAccess" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelGuestAccess.html" class="btn btn-neutral float-right" title="groupDelGuestAccess" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-gatekeeper/groupDelGuestAccess.html b/plugins/group-gatekeeper/groupDelGuestAccess.html
new file mode 100644
index 000000000..724b9c2c6
--- /dev/null
+++ b/plugins/group-gatekeeper/groupDelGuestAccess.html
@@ -0,0 +1,227 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelGuestAccess &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelMember" href="groupDelMember.html" />
+    <link rel="prev" title="groupAddMember" href="groupAddMember.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-gatekeeper plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddGuestAccess.html">groupAddGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddMember.html">groupAddMember</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelGuestAccess</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-a-specific-group-server-access-from-an-account">Remove a specific group server access from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelMember.html">groupDelMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListGuestAccesses.html">groupListGuestAccesses</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-gatekeeper plugins</a> &raquo;</li>
+      <li>groupDelGuestAccess</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-gatekeeper/groupDelGuestAccess.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelguestaccess">
+<h1>groupDelGuestAccess<a class="headerlink" href="#groupdelguestaccess" title="Permalink to this headline"></a></h1>
+<section id="remove-a-specific-group-server-access-from-an-account">
+<h2>Remove a specific group server access from an account<a class="headerlink" href="#remove-a-specific-group-server-access-from-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelGuestAccess --group GROUP --account ACCOUNT [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-group">
+<span id="cmdoption-groupdelguestaccess-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-group" title="Permalink to this definition"></a></dt>
+<dd><blockquote>
+<div><p>group to remove guest access from</p>
+</div></blockquote>
+<p>--account ACCOUNT name of the other bastion account to remove access from</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-host">
+<span id="cmdoption-groupdelguestaccess-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST|IP</span></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-host" title="Permalink to this definition"></a></dt>
+<dd><p>remove access from this HOST (which must belong to the GROUP)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-user">
+<span id="cmdoption-groupdelguestaccess-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-user" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST only with remote login USER</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-user-any">
+<span id="cmdoption-groupdelguestaccess-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST with any remote login</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-port">
+<span id="cmdoption-groupdelguestaccess-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-port" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST only to remote port PORT</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-port-any">
+<span id="cmdoption-groupdelguestaccess-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>allow connecting to HOST with any remote port</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-scpup">
+<span id="cmdoption-groupdelguestaccess-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>allow SCP upload, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-scpdown">
+<span id="cmdoption-groupdelguestaccess-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>allow SCP download, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGuestAccess-sftp">
+<span id="cmdoption-groupdelguestaccess-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelGuestAccess-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>allow usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<p>This command removes, from an existing bastion account, access to a given server, using the
+egress keys of the group. The list of such servers is given by <code class="docutils literal notranslate"><span class="pre">groupListGuestAccesses</span></code></p>
+<p>If you want to remove member access from an account to all the present and future servers
+of the group, using the group key, please use <code class="docutils literal notranslate"><span class="pre">groupDelMember</span></code> instead.</p>
+<p>If you want to remove access from an account from a group server but using his personal bastion
+key instead of the group key, please use <code class="docutils literal notranslate"><span class="pre">accountDelPersonalAccess</span></code> instead.</p>
+<p>This command is the opposite of <code class="docutils literal notranslate"><span class="pre">groupAddGuestAccess</span></code>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupAddMember.html" class="btn btn-neutral float-left" title="groupAddMember" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelMember.html" class="btn btn-neutral float-right" title="groupDelMember" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-gatekeeper/groupDelMember.html b/plugins/group-gatekeeper/groupDelMember.html
new file mode 100644
index 000000000..7721fee63
--- /dev/null
+++ b/plugins/group-gatekeeper/groupDelMember.html
@@ -0,0 +1,179 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelMember &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupListGuestAccesses" href="groupListGuestAccesses.html" />
+    <link rel="prev" title="groupDelGuestAccess" href="groupDelGuestAccess.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-gatekeeper plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddGuestAccess.html">groupAddGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddMember.html">groupAddMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGuestAccess.html">groupDelGuestAccess</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelMember</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-an-account-from-the-members-list">Remove an account from the members list</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupListGuestAccesses.html">groupListGuestAccesses</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-gatekeeper plugins</a> &raquo;</li>
+      <li>groupDelMember</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-gatekeeper/groupDelMember.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelmember">
+<h1>groupDelMember<a class="headerlink" href="#groupdelmember" title="Permalink to this headline"></a></h1>
+<section id="remove-an-account-from-the-members-list">
+<h2>Remove an account from the members list<a class="headerlink" href="#remove-an-account-from-the-members-list" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelMember --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelMember-group">
+<span id="cmdoption-groupdelmember-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelMember-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to remove ACCOUNT as a member of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelMember-account">
+<span id="cmdoption-groupdelmember-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupDelMember-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to remove as a member of GROUP</p>
+</dd></dl>
+
+<p>The specified account will no longer be able to access all present and future servers
+pertaining to this group.
+Note that if this account also had specific guest accesses to this group, they may
+still apply, see <code class="docutils literal notranslate"><span class="pre">groupListGuestAccesses</span></code></p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelGuestAccess.html" class="btn btn-neutral float-left" title="groupDelGuestAccess" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupListGuestAccesses.html" class="btn btn-neutral float-right" title="groupListGuestAccesses" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-gatekeeper/groupListGuestAccesses.html b/plugins/group-gatekeeper/groupListGuestAccesses.html
new file mode 100644
index 000000000..b4131112c
--- /dev/null
+++ b/plugins/group-gatekeeper/groupListGuestAccesses.html
@@ -0,0 +1,203 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupListGuestAccesses &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="group-owner plugins" href="../group-owner/index.html" />
+    <link rel="prev" title="groupDelMember" href="groupDelMember.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-gatekeeper plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddGuestAccess.html">groupAddGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddMember.html">groupAddMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGuestAccess.html">groupDelGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelMember.html">groupDelMember</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupListGuestAccesses</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-guest-accesses-to-servers-of-a-group-specifically-granted-to-an-account">List the guest accesses to servers of a group specifically granted to an account</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-gatekeeper plugins</a> &raquo;</li>
+      <li>groupListGuestAccesses</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-gatekeeper/groupListGuestAccesses.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="grouplistguestaccesses">
+<h1>groupListGuestAccesses<a class="headerlink" href="#grouplistguestaccesses" title="Permalink to this headline"></a></h1>
+<section id="list-the-guest-accesses-to-servers-of-a-group-specifically-granted-to-an-account">
+<h2>List the guest accesses to servers of a group specifically granted to an account<a class="headerlink" href="#list-the-guest-accesses-to-servers-of-a-group-specifically-granted-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupListGuestAccesses --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListGuestAccesses-group">
+<span id="cmdoption-grouplistguestaccesses-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupListGuestAccesses-group" title="Permalink to this definition"></a></dt>
+<dd><p>Look for accesses to servers of this GROUP</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListGuestAccesses-account">
+<span id="cmdoption-grouplistguestaccesses-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupListGuestAccesses-account" title="Permalink to this definition"></a></dt>
+<dd><p>Which account to check</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListGuestAccesses-reverse-dns">
+<span id="cmdoption-grouplistguestaccesses-reverse-dns"></span><span class="sig-name descname"><span class="pre">--reverse-dns</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupListGuestAccesses-reverse-dns" title="Permalink to this definition"></a></dt>
+<dd><p>Attempt to resolve the reverse hostnames (SLOW!)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListGuestAccesses-include">
+<span id="cmdoption-grouplistguestaccesses-include"></span><span class="sig-name descname"><span class="pre">--include</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-groupListGuestAccesses-include" title="Permalink to this definition"></a></dt>
+<dd><p>Only include servers matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times to refine results</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListGuestAccesses-exclude">
+<span id="cmdoption-grouplistguestaccesses-exclude"></span><span class="sig-name descname"><span class="pre">--exclude</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-groupListGuestAccesses-exclude" title="Permalink to this definition"></a></dt>
+<dd><p>Omit servers matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times.
+Note that --exclude takes precedence over --include</p>
+</div></blockquote>
+</dd></dl>
+
+<p><strong>Note:</strong> PATTERN supports the <code class="docutils literal notranslate"><span class="pre">*</span></code> and <code class="docutils literal notranslate"><span class="pre">?</span></code> wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelMember.html" class="btn btn-neutral float-left" title="groupDelMember" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../group-owner/index.html" class="btn btn-neutral float-right" title="group-owner plugins" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-gatekeeper/index.html b/plugins/group-gatekeeper/index.html
new file mode 100644
index 000000000..121c60e4c
--- /dev/null
+++ b/plugins/group-gatekeeper/index.html
@@ -0,0 +1,176 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>group-gatekeeper plugins &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupAddGuestAccess" href="groupAddGuestAccess.html" />
+    <link rel="prev" title="groupDelServer" href="../group-aclkeeper/groupDelServer.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">group-gatekeeper plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGuestAccess.html">groupAddGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddMember.html">groupAddMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGuestAccess.html">groupDelGuestAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelMember.html">groupDelMember</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListGuestAccesses.html">groupListGuestAccesses</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>group-gatekeeper plugins</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-gatekeeper/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="group-gatekeeper-plugins">
+<h1>group-gatekeeper plugins<a class="headerlink" href="#group-gatekeeper-plugins" title="Permalink to this headline"></a></h1>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="groupAddGuestAccess.html">groupAddGuestAccess</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGuestAccess.html#add-a-specific-group-server-access-to-an-account">Add a specific group server access to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupAddMember.html">groupAddMember</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddMember.html#add-an-account-to-the-member-list">Add an account to the member list</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelGuestAccess.html">groupDelGuestAccess</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGuestAccess.html#remove-a-specific-group-server-access-from-an-account">Remove a specific group server access from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelMember.html">groupDelMember</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelMember.html#remove-an-account-from-the-members-list">Remove an account from the members list</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupListGuestAccesses.html">groupListGuestAccesses</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupListGuestAccesses.html#list-the-guest-accesses-to-servers-of-a-group-specifically-granted-to-an-account">List the guest accesses to servers of a group specifically granted to an account</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../group-aclkeeper/groupDelServer.html" class="btn btn-neutral float-left" title="groupDelServer" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupAddGuestAccess.html" class="btn btn-neutral float-right" title="groupAddGuestAccess" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupAddAclkeeper.html b/plugins/group-owner/groupAddAclkeeper.html
new file mode 100644
index 000000000..e8b9b979d
--- /dev/null
+++ b/plugins/group-owner/groupAddAclkeeper.html
@@ -0,0 +1,183 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupAddAclkeeper &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupAddGatekeeper" href="groupAddGatekeeper.html" />
+    <link rel="prev" title="group-owner plugins" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupAddAclkeeper</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-the-group-aclkeeper-role-to-an-account">Add the group aclkeeper role to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupAddAclkeeper</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupAddAclkeeper.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupaddaclkeeper">
+<h1>groupAddAclkeeper<a class="headerlink" href="#groupaddaclkeeper" title="Permalink to this headline"></a></h1>
+<section id="add-the-group-aclkeeper-role-to-an-account">
+<h2>Add the group aclkeeper role to an account<a class="headerlink" href="#add-the-group-aclkeeper-role-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupAddAclkeeper --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddAclkeeper-group">
+<span id="cmdoption-groupaddaclkeeper-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupAddAclkeeper-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to set ACCOUNT as an aclkeeper of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddAclkeeper-account">
+<span id="cmdoption-groupaddaclkeeper-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupAddAclkeeper-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to set as an aclkeeper of GROUP</p>
+</dd></dl>
+
+<p>The specified account will be able to manage the server list of this group</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="group-owner plugins" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupAddGatekeeper.html" class="btn btn-neutral float-right" title="groupAddGatekeeper" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupAddGatekeeper.html b/plugins/group-owner/groupAddGatekeeper.html
new file mode 100644
index 000000000..09c5ff542
--- /dev/null
+++ b/plugins/group-owner/groupAddGatekeeper.html
@@ -0,0 +1,184 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupAddGatekeeper &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupAddOwner" href="groupAddOwner.html" />
+    <link rel="prev" title="groupAddAclkeeper" href="groupAddAclkeeper.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupAddGatekeeper</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-the-group-gatekeeper-role-to-an-account">Add the group gatekeeper role to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupAddGatekeeper</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupAddGatekeeper.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupaddgatekeeper">
+<h1>groupAddGatekeeper<a class="headerlink" href="#groupaddgatekeeper" title="Permalink to this headline"></a></h1>
+<section id="add-the-group-gatekeeper-role-to-an-account">
+<h2>Add the group gatekeeper role to an account<a class="headerlink" href="#add-the-group-gatekeeper-role-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupAddGatekeeper --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGatekeeper-group">
+<span id="cmdoption-groupaddgatekeeper-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupAddGatekeeper-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to set ACCOUNT as a gatekeeper of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddGatekeeper-account">
+<span id="cmdoption-groupaddgatekeeper-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupAddGatekeeper-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to set as a gatekeeper of GROUP</p>
+</dd></dl>
+
+<p>The specified account will be able to manage the members list of this group,
+along with the guests list</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupAddAclkeeper.html" class="btn btn-neutral float-left" title="groupAddAclkeeper" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupAddOwner.html" class="btn btn-neutral float-right" title="groupAddOwner" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupAddOwner.html b/plugins/group-owner/groupAddOwner.html
new file mode 100644
index 000000000..9a1808b61
--- /dev/null
+++ b/plugins/group-owner/groupAddOwner.html
@@ -0,0 +1,186 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupAddOwner &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelAclkeeper" href="groupDelAclkeeper.html" />
+    <link rel="prev" title="groupAddGatekeeper" href="groupAddGatekeeper.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupAddOwner</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-the-group-owner-role-to-an-account">Add the group owner role to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupAddOwner</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupAddOwner.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupaddowner">
+<h1>groupAddOwner<a class="headerlink" href="#groupaddowner" title="Permalink to this headline"></a></h1>
+<section id="add-the-group-owner-role-to-an-account">
+<h2>Add the group owner role to an account<a class="headerlink" href="#add-the-group-owner-role-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupAddOwner --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddOwner-group">
+<span id="cmdoption-groupaddowner-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupAddOwner-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to set ACCOUNT as an owner of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupAddOwner-account">
+<span id="cmdoption-groupaddowner-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupAddOwner-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to set as an owner of GROUP</p>
+</dd></dl>
+
+<p>The specified account will be able to manage the owner, gatekeeper
+and aclkeeper list of this group. In other words, this account will
+have all possible rights to manage the group and delegate some or all
+of the rights to other accounts</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupAddGatekeeper.html" class="btn btn-neutral float-left" title="groupAddGatekeeper" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelAclkeeper.html" class="btn btn-neutral float-right" title="groupDelAclkeeper" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupDelAclkeeper.html b/plugins/group-owner/groupDelAclkeeper.html
new file mode 100644
index 000000000..a490cd0b2
--- /dev/null
+++ b/plugins/group-owner/groupDelAclkeeper.html
@@ -0,0 +1,183 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelAclkeeper &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelEgressKey" href="groupDelEgressKey.html" />
+    <link rel="prev" title="groupAddOwner" href="groupAddOwner.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelAclkeeper</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-group-aclkeeper-role-from-an-account">Remove the group aclkeeper role from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupDelAclkeeper</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupDelAclkeeper.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelaclkeeper">
+<h1>groupDelAclkeeper<a class="headerlink" href="#groupdelaclkeeper" title="Permalink to this headline"></a></h1>
+<section id="remove-the-group-aclkeeper-role-from-an-account">
+<h2>Remove the group aclkeeper role from an account<a class="headerlink" href="#remove-the-group-aclkeeper-role-from-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelAclkeeper --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelAclkeeper-group">
+<span id="cmdoption-groupdelaclkeeper-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelAclkeeper-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to remove ACCOUNT as an aclkeeper of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelAclkeeper-account">
+<span id="cmdoption-groupdelaclkeeper-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupDelAclkeeper-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to remove as an aclkeeper of GROUP</p>
+</dd></dl>
+
+<p>The specified account will no longer be able to manage the server list of this group</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupAddOwner.html" class="btn btn-neutral float-left" title="groupAddOwner" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelEgressKey.html" class="btn btn-neutral float-right" title="groupDelEgressKey" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupDelEgressKey.html b/plugins/group-owner/groupDelEgressKey.html
new file mode 100644
index 000000000..ea8cf8c84
--- /dev/null
+++ b/plugins/group-owner/groupDelEgressKey.html
@@ -0,0 +1,182 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelEgressKey &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelGatekeeper" href="groupDelGatekeeper.html" />
+    <link rel="prev" title="groupDelAclkeeper" href="groupDelAclkeeper.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelEgressKey</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-a-bastion-group-egress-key">Remove a bastion group egress key</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupDelEgressKey</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupDelEgressKey.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelegresskey">
+<h1>groupDelEgressKey<a class="headerlink" href="#groupdelegresskey" title="Permalink to this headline"></a></h1>
+<section id="remove-a-bastion-group-egress-key">
+<h2>Remove a bastion group egress key<a class="headerlink" href="#remove-a-bastion-group-egress-key" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelEgressKey &lt;--group GROUP&gt; &lt;--id ID&gt;</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelEgressKey-group">
+<span id="cmdoption-groupdelegresskey-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelEgressKey-group" title="Permalink to this definition"></a></dt>
+<dd><p>Name of the group to delete the egress key from</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelEgressKey-id">
+<span id="cmdoption-groupdelegresskey-id"></span><span class="sig-name descname"><span class="pre">--id</span></span><span class="sig-prename descclassname"> <span class="pre">ID</span></span><a class="headerlink" href="#cmdoption-groupDelEgressKey-id" title="Permalink to this definition"></a></dt>
+<dd><p>Specify the key ID to delete, you can get it with groupInfo</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelAclkeeper.html" class="btn btn-neutral float-left" title="groupDelAclkeeper" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelGatekeeper.html" class="btn btn-neutral float-right" title="groupDelGatekeeper" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupDelGatekeeper.html b/plugins/group-owner/groupDelGatekeeper.html
new file mode 100644
index 000000000..e4f2efb70
--- /dev/null
+++ b/plugins/group-owner/groupDelGatekeeper.html
@@ -0,0 +1,184 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelGatekeeper &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelOwner" href="groupDelOwner.html" />
+    <link rel="prev" title="groupDelEgressKey" href="groupDelEgressKey.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelGatekeeper</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-group-gatekeeper-role-from-an-account">Remove the group gatekeeper role from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupDelGatekeeper</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupDelGatekeeper.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelgatekeeper">
+<h1>groupDelGatekeeper<a class="headerlink" href="#groupdelgatekeeper" title="Permalink to this headline"></a></h1>
+<section id="remove-the-group-gatekeeper-role-from-an-account">
+<h2>Remove the group gatekeeper role from an account<a class="headerlink" href="#remove-the-group-gatekeeper-role-from-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelGatekeeper --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGatekeeper-group">
+<span id="cmdoption-groupdelgatekeeper-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelGatekeeper-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to remove ACCOUNT as a gatekeeper of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelGatekeeper-account">
+<span id="cmdoption-groupdelgatekeeper-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupDelGatekeeper-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to remove as a gatekeeper of GROUP</p>
+</dd></dl>
+
+<p>The specified account will no longer be able to manager the members nor
+the guest list of this group</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelEgressKey.html" class="btn btn-neutral float-left" title="groupDelEgressKey" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelOwner.html" class="btn btn-neutral float-right" title="groupDelOwner" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupDelOwner.html b/plugins/group-owner/groupDelOwner.html
new file mode 100644
index 000000000..267cb5f1c
--- /dev/null
+++ b/plugins/group-owner/groupDelOwner.html
@@ -0,0 +1,184 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelOwner &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDestroy" href="groupDestroy.html" />
+    <link rel="prev" title="groupDelGatekeeper" href="groupDelGatekeeper.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelOwner</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-group-owner-role-from-an-account">Remove the group owner role from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupDelOwner</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupDelOwner.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelowner">
+<h1>groupDelOwner<a class="headerlink" href="#groupdelowner" title="Permalink to this headline"></a></h1>
+<section id="remove-the-group-owner-role-from-an-account">
+<h2>Remove the group owner role from an account<a class="headerlink" href="#remove-the-group-owner-role-from-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelOwner --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelOwner-group">
+<span id="cmdoption-groupdelowner-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelOwner-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to set ACCOUNT as an owner of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelOwner-account">
+<span id="cmdoption-groupdelowner-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupDelOwner-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to set as an owner of GROUP</p>
+</dd></dl>
+
+<p>The specified account will no longer be able to manage the owner,
+gatekeeper and aclkeeper lists of this group</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelGatekeeper.html" class="btn btn-neutral float-left" title="groupDelGatekeeper" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDestroy.html" class="btn btn-neutral float-right" title="groupDestroy" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupDestroy.html b/plugins/group-owner/groupDestroy.html
new file mode 100644
index 000000000..00835b6e5
--- /dev/null
+++ b/plugins/group-owner/groupDestroy.html
@@ -0,0 +1,184 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDestroy &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupGenerateEgressKey" href="groupGenerateEgressKey.html" />
+    <link rel="prev" title="groupDelOwner" href="groupDelOwner.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDestroy</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#delete-a-group">Delete a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupDestroy</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupDestroy.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdestroy">
+<h1>groupDestroy<a class="headerlink" href="#groupdestroy" title="Permalink to this headline"></a></h1>
+<section id="delete-a-group">
+<h2>Delete a group<a class="headerlink" href="#delete-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDestroy --group GROUP</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDestroy-group">
+<span id="cmdoption-groupdestroy-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDestroy-group" title="Permalink to this definition"></a></dt>
+<dd><p>Group name to delete</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDestroy-no-confirm">
+<span id="cmdoption-groupdestroy-no-confirm"></span><span class="sig-name descname"><span class="pre">--no-confirm</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDestroy-no-confirm" title="Permalink to this definition"></a></dt>
+<dd><p>Skip group name confirmation, but blame yourself if you deleted the wrong group!</p>
+</dd></dl>
+
+<p>This command is able to delete any group you're an owner of.
+Granted users to the sibling restricted command <cite>groupDelete</cite> can delete any group.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelOwner.html" class="btn btn-neutral float-left" title="groupDelOwner" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupGenerateEgressKey.html" class="btn btn-neutral float-right" title="groupGenerateEgressKey" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupGenerateEgressKey.html b/plugins/group-owner/groupGenerateEgressKey.html
new file mode 100644
index 000000000..d32fb1e6f
--- /dev/null
+++ b/plugins/group-owner/groupGenerateEgressKey.html
@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupGenerateEgressKey &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupGeneratePassword" href="groupGeneratePassword.html" />
+    <link rel="prev" title="groupDestroy" href="groupDestroy.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupGenerateEgressKey</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#create-a-new-public-private-key-pair-for-a-group">Create a new public + private key pair for a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupGenerateEgressKey</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupGenerateEgressKey.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupgenerateegresskey">
+<h1>groupGenerateEgressKey<a class="headerlink" href="#groupgenerateegresskey" title="Permalink to this headline"></a></h1>
+<section id="create-a-new-public-private-key-pair-for-a-group">
+<h2>Create a new public + private key pair for a group<a class="headerlink" href="#create-a-new-public-private-key-pair-for-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupGenerateEgressKey --group GROUP --algo ALGO --size SIZE [--encrypted]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGenerateEgressKey-group">
+<span id="cmdoption-groupgenerateegresskey-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupGenerateEgressKey-group" title="Permalink to this definition"></a></dt>
+<dd><p>Group name to generate a new egress key for.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGenerateEgressKey-algo">
+<span id="cmdoption-groupgenerateegresskey-algo"></span><span class="sig-name descname"><span class="pre">--algo</span></span><span class="sig-prename descclassname"> <span class="pre">ALGO</span></span><a class="headerlink" href="#cmdoption-groupGenerateEgressKey-algo" title="Permalink to this definition"></a></dt>
+<dd><p>Specifies the algo of the key, either rsa, ecdsa or ed25519.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGenerateEgressKey-size">
+<span id="cmdoption-groupgenerateegresskey-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname"> <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-groupGenerateEgressKey-size" title="Permalink to this definition"></a></dt>
+<dd><p>Specifies the size of the key to be generated.</p>
+<blockquote>
+<div><p>For RSA, choose between 2048 and 8192 (4096 is good).
+For ECDSA, choose either 256, 384 or 521.
+For Ed25519, size is always 256.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGenerateEgressKey-encrypted">
+<span id="cmdoption-groupgenerateegresskey-encrypted"></span><span class="sig-name descname"><span class="pre">--encrypted</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupGenerateEgressKey-encrypted" title="Permalink to this definition"></a></dt>
+<dd><p>If specified, a passphrase will be prompted for the new key</p>
+</dd></dl>
+
+<p>A quick overview of the different algorithms:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Ed25519      : robustness[###] speed[###]
+ECDSA        : robustness[##.] speed[###]
+RSA          : robustness[#..] speed[#..]
+</pre></div>
+</div>
+<p>This table is meant as a quick cheat-sheet, you're warmly advised to do
+your own research, as other constraints may apply to your environment.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDestroy.html" class="btn btn-neutral float-left" title="groupDestroy" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupGeneratePassword.html" class="btn btn-neutral float-right" title="groupGeneratePassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupGeneratePassword.html b/plugins/group-owner/groupGeneratePassword.html
new file mode 100644
index 000000000..816a435a9
--- /dev/null
+++ b/plugins/group-owner/groupGeneratePassword.html
@@ -0,0 +1,197 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupGeneratePassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupModify" href="groupModify.html" />
+    <link rel="prev" title="groupGenerateEgressKey" href="groupGenerateEgressKey.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupGeneratePassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#generate-a-new-egress-password-for-the-group">Generate a new egress password for the group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupGeneratePassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupGeneratePassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupgeneratepassword">
+<h1>groupGeneratePassword<a class="headerlink" href="#groupgeneratepassword" title="Permalink to this headline"></a></h1>
+<section id="generate-a-new-egress-password-for-the-group">
+<h2>Generate a new egress password for the group<a class="headerlink" href="#generate-a-new-egress-password-for-the-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupGeneratePassword --group GROUP [--size SIZE] --do-it</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGeneratePassword-group">
+<span id="cmdoption-groupgeneratepassword-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupGeneratePassword-group" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which group you want to generate a password for</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGeneratePassword-size">
+<span id="cmdoption-groupgeneratepassword-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname">&#160; <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-groupGeneratePassword-size" title="Permalink to this definition"></a></dt>
+<dd><p>Specify the number of characters of the password to generate</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupGeneratePassword-do-it">
+<span id="cmdoption-groupgeneratepassword-do-it"></span><span class="sig-name descname"><span class="pre">--do-it</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupGeneratePassword-do-it" title="Permalink to this definition"></a></dt>
+<dd><p>Required for the password to actually be generated, BEWARE: please read the note below</p>
+</dd></dl>
+
+<p>Generate a new egress password to be used for ssh or telnet</p>
+<p>NOTE: this is only needed for devices that don't support key-based SSH,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access only support telnet or password-based SSH.</p>
+<p>BEWARE: once a new password is generated this way, it'll be set as the new
+egress password to use right away for the group, for any access that requires it.
+A fallback mechanism exists that will auto-try the previous password if this one
+doesn't work, but please ensure that this new password is deployed on the remote
+devices as soon as possible.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupGenerateEgressKey.html" class="btn btn-neutral float-left" title="groupGenerateEgressKey" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupModify.html" class="btn btn-neutral float-right" title="groupModify" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupModify.html b/plugins/group-owner/groupModify.html
new file mode 100644
index 000000000..9413b6a49
--- /dev/null
+++ b/plugins/group-owner/groupModify.html
@@ -0,0 +1,204 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupModify &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupTransmitOwnership" href="groupTransmitOwnership.html" />
+    <link rel="prev" title="groupGeneratePassword" href="groupGeneratePassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupModify</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#modify-the-configuration-of-a-group">Modify the configuration of a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupModify</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupModify.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupmodify">
+<h1>groupModify<a class="headerlink" href="#groupmodify" title="Permalink to this headline"></a></h1>
+<section id="modify-the-configuration-of-a-group">
+<h2>Modify the configuration of a group<a class="headerlink" href="#modify-the-configuration-of-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupModify --group GROUP [--mfa-required password|totp|any|none] [--guest-ttl-limit DURATION]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupModify-group">
+<span id="cmdoption-groupmodify-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname">&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupModify-group" title="Permalink to this definition"></a></dt>
+<dd><p>Name of the group to modify</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupModify-mfa-required">
+<span id="cmdoption-groupmodify-mfa-required"></span><span class="sig-name descname"><span class="pre">--mfa-required</span></span><span class="sig-prename descclassname">&#160;&#160;&#160;&#160;&#160; <span class="pre">password|totp|any|none</span></span><a class="headerlink" href="#cmdoption-groupModify-mfa-required" title="Permalink to this definition"></a></dt>
+<dd><blockquote>
+<div><p>Enforce UNIX password requirement, or TOTP requirement, or any MFA requirement, when connecting to a server of the group</p>
+</div></blockquote>
+<dl class="simple">
+<dt>--idle-lock-timeout DURATION|0|-1            Overrides the global setting (<cite>idleLockTimeout</cite>), to the specified duration. If set to 0, disables <cite>idleLockTimeout</cite> for</dt><dd><p>this group. If set to -1, remove this group override and use the global setting instead.</p>
+</dd>
+<dt>--idle-kill-timeout DURATION|0|-1            Overrides the global setting (<cite>idleKillTimeout</cite>), to the specified duration. If set to 0, disables <cite>idleKillTimeout</cite> for</dt><dd><p>this group. If set to -1, remove this group override and use the global setting instead.</p>
+</dd>
+</dl>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupModify-guest-ttl-limit">
+<span id="cmdoption-groupmodify-guest-ttl-limit"></span><span class="sig-name descname"><span class="pre">--guest-ttl-limit</span></span><span class="sig-prename descclassname">&#160;&#160; <span class="pre">DURATION</span></span><a class="headerlink" href="#cmdoption-groupModify-guest-ttl-limit" title="Permalink to this definition"></a></dt>
+<dd><p>This group will enforce TTL setting, on guest access creation, to be set, and not to a higher value than DURATION,</p>
+<blockquote>
+<div><p>set to zero to allow guest accesses creation without any TTL set (default)</p>
+</div></blockquote>
+</dd></dl>
+
+<p>Note that <cite>--idle-lock-timeout</cite> and <cite>--idle-kill-timeout</cite> will NOT be applied for catch-all groups (having 0.0.0.0/0 in their server list).</p>
+<p>If a server is in exactly one group an account is a member of, then its values of <cite>--idle-lock-timeout</cite> and <cite>--idle-kill-timeout</cite>, if set,
+will prevail over the global setting. The global setting can be seen with <cite>--osh info</cite>.</p>
+<p>Otherwise, the most restrictive setting (i.e. the one with the lower strictly positive duration) between
+all the considered groups and the global setting, will be used.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupGeneratePassword.html" class="btn btn-neutral float-left" title="groupGeneratePassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupTransmitOwnership.html" class="btn btn-neutral float-right" title="groupTransmitOwnership" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/groupTransmitOwnership.html b/plugins/group-owner/groupTransmitOwnership.html
new file mode 100644
index 000000000..f77ae36f7
--- /dev/null
+++ b/plugins/group-owner/groupTransmitOwnership.html
@@ -0,0 +1,184 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupTransmitOwnership &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="open plugins" href="../open/index.html" />
+    <link rel="prev" title="groupModify" href="groupModify.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">group-owner plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupTransmitOwnership</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#transmit-your-group-ownership-to-somebody-else">Transmit your group ownership to somebody else</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">group-owner plugins</a> &raquo;</li>
+      <li>groupTransmitOwnership</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/groupTransmitOwnership.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="grouptransmitownership">
+<h1>groupTransmitOwnership<a class="headerlink" href="#grouptransmitownership" title="Permalink to this headline"></a></h1>
+<section id="transmit-your-group-ownership-to-somebody-else">
+<h2>Transmit your group ownership to somebody else<a class="headerlink" href="#transmit-your-group-ownership-to-somebody-else" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupTransmitOwnership --group GROUP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupTransmitOwnership-group">
+<span id="cmdoption-grouptransmitownership-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupTransmitOwnership-group" title="Permalink to this definition"></a></dt>
+<dd><p>which group to set ACCOUNT as an owner of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupTransmitOwnership-account">
+<span id="cmdoption-grouptransmitownership-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-groupTransmitOwnership-account" title="Permalink to this definition"></a></dt>
+<dd><p>which account to set as an owner of GROUP</p>
+</dd></dl>
+
+<p>Note that this command has the same net effect than using <code class="docutils literal notranslate"><span class="pre">groupAddOwner</span></code>
+to add ACCOUNT as an owner, then removing yourself with <code class="docutils literal notranslate"><span class="pre">groupDelOwner</span></code></p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupModify.html" class="btn btn-neutral float-left" title="groupModify" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../open/index.html" class="btn btn-neutral float-right" title="open plugins" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/group-owner/index.html b/plugins/group-owner/index.html
new file mode 100644
index 000000000..7f568c1eb
--- /dev/null
+++ b/plugins/group-owner/index.html
@@ -0,0 +1,211 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>group-owner plugins &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupAddAclkeeper" href="groupAddAclkeeper.html" />
+    <link rel="prev" title="groupListGuestAccesses" href="../group-gatekeeper/groupListGuestAccesses.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">group-owner plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html">groupDestroy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html">groupModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>group-owner plugins</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/group-owner/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="group-owner-plugins">
+<h1>group-owner plugins<a class="headerlink" href="#group-owner-plugins" title="Permalink to this headline"></a></h1>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="groupAddAclkeeper.html">groupAddAclkeeper</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddAclkeeper.html#add-the-group-aclkeeper-role-to-an-account">Add the group aclkeeper role to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupAddGatekeeper.html">groupAddGatekeeper</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddGatekeeper.html#add-the-group-gatekeeper-role-to-an-account">Add the group gatekeeper role to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupAddOwner.html">groupAddOwner</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupAddOwner.html#add-the-group-owner-role-to-an-account">Add the group owner role to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelAclkeeper.html">groupDelAclkeeper</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelAclkeeper.html#remove-the-group-aclkeeper-role-from-an-account">Remove the group aclkeeper role from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelEgressKey.html">groupDelEgressKey</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelEgressKey.html#remove-a-bastion-group-egress-key">Remove a bastion group egress key</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelGatekeeper.html">groupDelGatekeeper</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelGatekeeper.html#remove-the-group-gatekeeper-role-from-an-account">Remove the group gatekeeper role from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelOwner.html">groupDelOwner</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelOwner.html#remove-the-group-owner-role-from-an-account">Remove the group owner role from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDestroy.html">groupDestroy</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDestroy.html#delete-a-group">Delete a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupGenerateEgressKey.html">groupGenerateEgressKey</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupGenerateEgressKey.html#create-a-new-public-private-key-pair-for-a-group">Create a new public + private key pair for a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupGeneratePassword.html">groupGeneratePassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupGeneratePassword.html#generate-a-new-egress-password-for-the-group">Generate a new egress password for the group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupModify.html">groupModify</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupModify.html#modify-the-configuration-of-a-group">Modify the configuration of a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupTransmitOwnership.html">groupTransmitOwnership</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupTransmitOwnership.html#transmit-your-group-ownership-to-somebody-else">Transmit your group ownership to somebody else</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../group-gatekeeper/groupListGuestAccesses.html" class="btn btn-neutral float-left" title="groupListGuestAccesses" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupAddAclkeeper.html" class="btn btn-neutral float-right" title="groupAddAclkeeper" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/alive.html b/plugins/open/alive.html
new file mode 100644
index 000000000..b5a66d287
--- /dev/null
+++ b/plugins/open/alive.html
@@ -0,0 +1,198 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>alive &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="batch" href="batch.html" />
+    <link rel="prev" title="open plugins" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">alive</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#ping-a-host-and-exit-as-soon-as-it-answers">Ping a host and exit as soon as it answers</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>alive</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/alive.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="alive">
+<h1>alive<a class="headerlink" href="#alive" title="Permalink to this headline"></a></h1>
+<section id="ping-a-host-and-exit-as-soon-as-it-answers">
+<h2>Ping a host and exit as soon as it answers<a class="headerlink" href="#ping-a-host-and-exit-as-soon-as-it-answers" title="Permalink to this headline"></a></h2>
+<p>This command can be used to monitor a host that is expected to go back online soon.
+Note that if you want to ssh to it afterwards, you can simply use the <code class="docutils literal notranslate"><span class="pre">--wait</span></code> main option.</p>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh alive [--host] HOSTNAME</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-alive-host">
+<span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOSTNAME</span></span><a class="headerlink" href="#cmdoption-alive-host" title="Permalink to this definition"></a></dt>
+<dd><p>hostname or IP to ping</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="open plugins" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="batch.html" class="btn btn-neutral float-right" title="batch" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/batch.html b/plugins/open/batch.html
new file mode 100644
index 000000000..915903d32
--- /dev/null
+++ b/plugins/open/batch.html
@@ -0,0 +1,210 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>batch &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="clush" href="clush.html" />
+    <link rel="prev" title="alive" href="alive.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">batch</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#run-a-batch-of-osh-commands-fed-through-stdin">Run a batch of osh commands fed through STDIN</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>batch</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/batch.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="batch">
+<h1>batch<a class="headerlink" href="#batch" title="Permalink to this headline"></a></h1>
+<section id="run-a-batch-of-osh-commands-fed-through-stdin">
+<h2>Run a batch of osh commands fed through STDIN<a class="headerlink" href="#run-a-batch-of-osh-commands-fed-through-stdin" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh batch</p>
+</div>
+<p><strong>Examples:</strong></p>
+<p>(replace <code class="docutils literal notranslate"><span class="pre">bssh</span></code> by your bastion alias)</p>
+<ul class="simple">
+<li><p>run 3 simple commands in a oneliner:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="nb">printf</span> <span class="s2">&quot;%b\n%b\n%b&quot;</span> info selfListIngressKeys selfListEgressKeys <span class="p">|</span> bssh --osh batch
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>run a lot of commands written out line by line in a file:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>bssh --osh batch &lt; cmdlist.txt
+</pre></div>
+</div>
+<ul class="simple">
+<li><p>add 3 users to a group:</p></li>
+</ul>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="k">for</span> i <span class="k">in</span> user1 user2 user3<span class="p">;</span> <span class="k">do</span> <span class="nb">echo</span> <span class="s2">&quot;groupAddMember --account </span><span class="nv">$i</span><span class="s2"> --group grp4&quot;</span><span class="p">;</span> <span class="k">done</span> <span class="p">|</span> bssh --osh batch
+</pre></div>
+</div>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="alive.html" class="btn btn-neutral float-left" title="alive" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="clush.html" class="btn btn-neutral float-right" title="clush" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/clush.html b/plugins/open/clush.html
new file mode 100644
index 000000000..b7c5cff7e
--- /dev/null
+++ b/plugins/open/clush.html
@@ -0,0 +1,232 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>clush &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupInfo" href="groupInfo.html" />
+    <link rel="prev" title="batch" href="batch.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">clush</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#launch-a-remote-command-on-several-machines-sequentially-clush-like">Launch a remote command on several machines sequentially (clush-like)</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>clush</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/clush.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="clush">
+<h1>clush<a class="headerlink" href="#clush" title="Permalink to this headline"></a></h1>
+<section id="launch-a-remote-command-on-several-machines-sequentially-clush-like">
+<h2>Launch a remote command on several machines sequentially (clush-like)<a class="headerlink" href="#launch-a-remote-command-on-several-machines-sequentially-clush-like" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh clush [OPTIONS] --command '&quot;remote command&quot;'</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-list">
+<span class="sig-name descname"><span class="pre">--list</span></span><span class="sig-prename descclassname"> <span class="pre">HOSTLIST</span></span><a class="headerlink" href="#cmdoption-clush-list" title="Permalink to this definition"></a></dt>
+<dd><p>Comma-separated list of the hosts (hostname or IP) to run the command on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-user">
+<span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-clush-user" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which remote user should we use to connect (default: BASTION_ACCOUNT)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-port">
+<span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-clush-port" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which port to connect to (default: 22)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-step-by-step">
+<span class="sig-name descname"><span class="pre">--step-by-step</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-clush-step-by-step" title="Permalink to this definition"></a></dt>
+<dd><p>Pause before running the command on each host</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-no-pause-on-failure">
+<span class="sig-name descname"><span class="pre">--no-pause-on-failure</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-clush-no-pause-on-failure" title="Permalink to this definition"></a></dt>
+<dd><p>Don't pause if the remote command failed (returned exit code != 0)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-no-confirm">
+<span class="sig-name descname"><span class="pre">--no-confirm</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-clush-no-confirm" title="Permalink to this definition"></a></dt>
+<dd><p>Skip confirmation of the host list and command</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-clush-command">
+<span class="sig-name descname"><span class="pre">--command</span></span><span class="sig-prename descclassname"> <span class="pre">'&quot;remote</span> <span class="pre">cmd&quot;'</span></span><a class="headerlink" href="#cmdoption-clush-command" title="Permalink to this definition"></a></dt>
+<dd><p>Command to be run on the remote hosts. If you're in a shell, quote it twice as shown.</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="batch.html" class="btn btn-neutral float-left" title="batch" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupInfo.html" class="btn btn-neutral float-right" title="groupInfo" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/groupInfo.html b/plugins/open/groupInfo.html
new file mode 100644
index 000000000..2002e1980
--- /dev/null
+++ b/plugins/open/groupInfo.html
@@ -0,0 +1,237 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupInfo &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupList" href="groupList.html" />
+    <link rel="prev" title="clush" href="clush.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupInfo</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#print-some-basic-information-about-a-group">Print some basic information about a group</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#usage-examples">Usage examples</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#output-example">Output example</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>groupInfo</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/groupInfo.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupinfo">
+<h1>groupInfo<a class="headerlink" href="#groupinfo" title="Permalink to this headline"></a></h1>
+<section id="print-some-basic-information-about-a-group">
+<h2>Print some basic information about a group<a class="headerlink" href="#print-some-basic-information-about-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupInfo &lt;--group GROUP|--all&gt; [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupInfo-group">
+<span id="cmdoption-groupinfo-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupInfo-group" title="Permalink to this definition"></a></dt>
+<dd><p>Specify the group to display the info of</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupInfo-all">
+<span id="cmdoption-groupinfo-all"></span><span class="sig-name descname"><span class="pre">--all</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupInfo-all" title="Permalink to this definition"></a></dt>
+<dd><p>Dump info for all groups (auditors only), use with <code class="docutils literal notranslate"><span class="pre">--json</span></code></p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupInfo-with-out-everything">
+<span id="cmdoption-groupinfo-with-out-everything"></span><span class="sig-name descname"><span class="pre">--with[out]-everything</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupInfo-with-out-everything" title="Permalink to this definition"></a></dt>
+<dd><p>Include or exclude all below options, including future ones</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupInfo-with-out-keys">
+<span id="cmdoption-groupinfo-with-out-keys"></span><span class="sig-name descname"><span class="pre">--with[out]-keys</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupInfo-with-out-keys" title="Permalink to this definition"></a></dt>
+<dd><p>Whether to include the group keys list (slow-ish, default: yes)</p>
+</dd></dl>
+
+</section>
+<section id="usage-examples">
+<h2>Usage examples<a class="headerlink" href="#usage-examples" title="Permalink to this headline"></a></h2>
+<p>Show info about a specific group:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh groupInfo --group mygroup2
+</pre></div>
+</div>
+<p>Gather info about all groups, with no extra data except their keys:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh groupInfo --all --without-everything --with-keys --json
+</pre></div>
+</div>
+<p>Gather info about all groups, including all extra data (and possibly future options):</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh groupInfo --all --with-everything --json
+</pre></div>
+</div>
+</section>
+<section id="output-example">
+<h2>Output example<a class="headerlink" href="#output-example" title="Permalink to this headline"></a></h2>
+<p>The first paragraph of the output lists the different roles along with the people having these roles.</p>
+<p>You can also see the public egress key of this group, i.e. the key that needs to be added to the remote servers' <code class="docutils literal notranslate"><span class="pre">authorized_keys</span></code> files, so that <code class="docutils literal notranslate"><span class="pre">members</span></code> of this group can access these servers.</p>
+<p>Note that if you want to see the list of servers pertaining to this group, you can use the command <code class="docutils literal notranslate"><span class="pre">groupListServers</span></code>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="clush.html" class="btn btn-neutral float-left" title="clush" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupList.html" class="btn btn-neutral float-right" title="groupList" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/groupList.html b/plugins/open/groupList.html
new file mode 100644
index 000000000..c4a7d68d8
--- /dev/null
+++ b/plugins/open/groupList.html
@@ -0,0 +1,217 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupList &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupListPasswords" href="groupListPasswords.html" />
+    <link rel="prev" title="groupInfo" href="groupInfo.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupList</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-groups-available-on-this-bastion">List the groups available on this bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>groupList</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/groupList.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="grouplist">
+<h1>groupList<a class="headerlink" href="#grouplist" title="Permalink to this headline"></a></h1>
+<section id="list-the-groups-available-on-this-bastion">
+<h2>List the groups available on this bastion<a class="headerlink" href="#list-the-groups-available-on-this-bastion" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupList [--all] [--exclude|--include PATTERN [--exclude|--include PATTERN ..]]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupList-all">
+<span id="cmdoption-grouplist-all"></span><span class="sig-name descname"><span class="pre">--all</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupList-all" title="Permalink to this definition"></a></dt>
+<dd><p>List all groups, even those to which you don't have access</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupList-include">
+<span id="cmdoption-grouplist-include"></span><span class="sig-name descname"><span class="pre">--include</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-groupList-include" title="Permalink to this definition"></a></dt>
+<dd><p>Only list groups that match the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times to refine results</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupList-exclude">
+<span id="cmdoption-grouplist-exclude"></span><span class="sig-name descname"><span class="pre">--exclude</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-groupList-exclude" title="Permalink to this definition"></a></dt>
+<dd><p>Omit groups that match the given PATTERN string (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times.
+Note that --exclude takes precedence over --include</p>
+</div></blockquote>
+</dd></dl>
+
+<p><strong>Note:</strong> PATTERN supports the <code class="docutils literal notranslate"><span class="pre">*</span></code> and <code class="docutils literal notranslate"><span class="pre">?</span></code> wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupInfo.html" class="btn btn-neutral float-left" title="groupInfo" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupListPasswords.html" class="btn btn-neutral float-right" title="groupListPasswords" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/groupListPasswords.html b/plugins/open/groupListPasswords.html
new file mode 100644
index 000000000..294c5e43e
--- /dev/null
+++ b/plugins/open/groupListPasswords.html
@@ -0,0 +1,197 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupListPasswords &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupListServers" href="groupListServers.html" />
+    <link rel="prev" title="groupList" href="groupList.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupListPasswords</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-hashes-and-metadata-of-egress-passwords-of-a-group">List the hashes and metadata of egress passwords of a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>groupListPasswords</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/groupListPasswords.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="grouplistpasswords">
+<h1>groupListPasswords<a class="headerlink" href="#grouplistpasswords" title="Permalink to this headline"></a></h1>
+<section id="list-the-hashes-and-metadata-of-egress-passwords-of-a-group">
+<h2>List the hashes and metadata of egress passwords of a group<a class="headerlink" href="#list-the-hashes-and-metadata-of-egress-passwords-of-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupListPasswords --group GROUP</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListPasswords-group">
+<span id="cmdoption-grouplistpasswords-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupListPasswords-group" title="Permalink to this definition"></a></dt>
+<dd><p>Show the data for this group</p>
+</dd></dl>
+
+<p>The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupList.html" class="btn btn-neutral float-left" title="groupList" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupListServers.html" class="btn btn-neutral float-right" title="groupListServers" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/groupListServers.html b/plugins/open/groupListServers.html
new file mode 100644
index 000000000..b9d69f34d
--- /dev/null
+++ b/plugins/open/groupListServers.html
@@ -0,0 +1,224 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupListServers &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="help" href="help.html" />
+    <link rel="prev" title="groupListPasswords" href="groupListPasswords.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupListServers</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-servers-ips-and-ip-blocks-pertaining-to-a-group">List the servers (IPs and IP blocks) pertaining to a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>groupListServers</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/groupListServers.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="grouplistservers">
+<h1>groupListServers<a class="headerlink" href="#grouplistservers" title="Permalink to this headline"></a></h1>
+<section id="list-the-servers-ips-and-ip-blocks-pertaining-to-a-group">
+<h2>List the servers (IPs and IP blocks) pertaining to a group<a class="headerlink" href="#list-the-servers-ips-and-ip-blocks-pertaining-to-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupListServers --group GROUP [--reverse-dns]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListServers-group">
+<span id="cmdoption-grouplistservers-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupListServers-group" title="Permalink to this definition"></a></dt>
+<dd><p>List the servers of this group</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListServers-reverse-dns">
+<span id="cmdoption-grouplistservers-reverse-dns"></span><span class="sig-name descname"><span class="pre">--reverse-dns</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupListServers-reverse-dns" title="Permalink to this definition"></a></dt>
+<dd><p>Attempt to resolve the reverse hostnames (SLOW!)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListServers-include">
+<span id="cmdoption-grouplistservers-include"></span><span class="sig-name descname"><span class="pre">--include</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-groupListServers-include" title="Permalink to this definition"></a></dt>
+<dd><p>Only include servers matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times to refine results</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupListServers-exclude">
+<span id="cmdoption-grouplistservers-exclude"></span><span class="sig-name descname"><span class="pre">--exclude</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-groupListServers-exclude" title="Permalink to this definition"></a></dt>
+<dd><p>Omit servers matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times.
+Note that --exclude takes precedence over --include</p>
+</div></blockquote>
+</dd></dl>
+
+<p><strong>Note:</strong> PATTERN supports the <code class="docutils literal notranslate"><span class="pre">*</span></code> and <code class="docutils literal notranslate"><span class="pre">?</span></code> wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupListPasswords.html" class="btn btn-neutral float-left" title="groupListPasswords" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="help.html" class="btn btn-neutral float-right" title="help" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/help.html b/plugins/open/help.html
new file mode 100644
index 000000000..5a2b42827
--- /dev/null
+++ b/plugins/open/help.html
@@ -0,0 +1,205 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>help &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="info" href="info.html" />
+    <link rel="prev" title="groupListServers" href="groupListServers.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">help</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#i-m-so-meta-even-this-acronym">I'm So Meta, Even This Acronym</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#colors">Colors</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>help</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/help.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="help">
+<h1>help<a class="headerlink" href="#help" title="Permalink to this headline"></a></h1>
+<section id="i-m-so-meta-even-this-acronym">
+<h2>I'm So Meta, Even This Acronym<a class="headerlink" href="#i-m-so-meta-even-this-acronym" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh help</p>
+</div>
+<p>Displays help about the available plugins callable with <code class="docutils literal notranslate"><span class="pre">--osh</span></code>.</p>
+<p>If you need help on a specific plugin, you can use <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">PLUGIN</span> <span class="pre">--help</span></code>, replacing <code class="docutils literal notranslate"><span class="pre">PLUGIN</span></code> with the actual plugin name.</p>
+<p>Note that if you want some help about the bastion (and not specifically about the plugins), you should use <code class="docutils literal notranslate"><span class="pre">--help</span></code> (without <code class="docutils literal notranslate"><span class="pre">--osh</span></code>).</p>
+</section>
+<section id="colors">
+<h2>Colors<a class="headerlink" href="#colors" title="Permalink to this headline"></a></h2>
+<p>You'll notice that plugins are highlighted in different colors, these indicate the access level needed to run the plugin. Note that plugins you don't have access to are simply omitted.</p>
+<ul class="simple">
+<li><p>green (<code class="docutils literal notranslate"><span class="pre">open</span></code>): these plugins can be called by anybody</p></li>
+<li><p>blue (<code class="docutils literal notranslate"><span class="pre">restricted</span></code>): these plugins can only be called by users having the specific right to call them. This right is granted per plugin by the <code class="docutils literal notranslate"><span class="pre">accountGrantCommand</span></code> plugin</p></li>
+<li><p>orange (<code class="docutils literal notranslate"><span class="pre">group-gatekeeper</span></code> and <code class="docutils literal notranslate"><span class="pre">group-aclkeeper</span></code>): these plugins can either be called by group gatekeepers or group aclkeepers. For clarity, the same color has been used for both cases</p></li>
+<li><p>purple (<code class="docutils literal notranslate"><span class="pre">group-owner</span></code>): these plugins can only be called by group owners</p></li>
+<li><p>red (<code class="docutils literal notranslate"><span class="pre">admin</span></code>): these plugins can only be called by bastion admins</p></li>
+</ul>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupListServers.html" class="btn btn-neutral float-left" title="groupListServers" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="info.html" class="btn btn-neutral float-right" title="info" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/index.html b/plugins/open/index.html
new file mode 100644
index 000000000..0c2eb0f95
--- /dev/null
+++ b/plugins/open/index.html
@@ -0,0 +1,320 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>open plugins &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="alive" href="alive.html" />
+    <link rel="prev" title="groupTransmitOwnership" href="../group-owner/groupTransmitOwnership.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">open plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>open plugins</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="open-plugins">
+<h1>open plugins<a class="headerlink" href="#open-plugins" title="Permalink to this headline"></a></h1>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="alive.html">alive</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="alive.html#ping-a-host-and-exit-as-soon-as-it-answers">Ping a host and exit as soon as it answers</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="batch.html">batch</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="batch.html#run-a-batch-of-osh-commands-fed-through-stdin">Run a batch of osh commands fed through STDIN</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="clush.html">clush</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="clush.html#launch-a-remote-command-on-several-machines-sequentially-clush-like">Launch a remote command on several machines sequentially (clush-like)</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupInfo.html">groupInfo</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html#print-some-basic-information-about-a-group">Print some basic information about a group</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html#usage-examples">Usage examples</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html#output-example">Output example</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupList.html">groupList</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html#list-the-groups-available-on-this-bastion">List the groups available on this bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html#list-the-hashes-and-metadata-of-egress-passwords-of-a-group">List the hashes and metadata of egress passwords of a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupListServers.html">groupListServers</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html#list-the-servers-ips-and-ip-blocks-pertaining-to-a-group">List the servers (IPs and IP blocks) pertaining to a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="help.html">help</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="help.html#i-m-so-meta-even-this-acronym">I'm So Meta, Even This Acronym</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html#colors">Colors</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="info.html">info</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="info.html#displays-some-information-about-this-bastion-instance">Displays some information about this bastion instance</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html#output-example">Output example</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html#plugin-configuration">Plugin configuration</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="info.html#options">Options</a></li>
+<li class="toctree-l3"><a class="reference internal" href="info.html#example">Example</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="lock.html">lock</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="lock.html#manually-lock-all-your-current-sessions">Manually lock all your current sessions</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="mtr.html">mtr</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html#runs-the-mtr-tool-to-traceroute-a-host">Runs the mtr tool to traceroute a host</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="nc.html">nc</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="nc.html#check-whether-a-remote-tcp-port-is-open">Check whether a remote TCP port is open</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="ping.html">ping</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="ping.html#ping-a-remote-host-from-the-bastion">Ping a remote host from the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="scp.html">scp</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="scp.html#transfer-files-from-to-remote-servers-using-scp-through-the-bastion">Transfer files from/to remote servers using scp through the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html#add-a-new-ingress-public-key-to-your-account">Add a new ingress public key to your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html#remove-an-ingress-public-key-from-your-account">Remove an ingress public key from your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html#forget-a-known-host-key-from-your-bastion-account">Forget a known host key from your bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html#create-a-new-public-private-key-pair-on-your-bastion-account">Create a new public + private key pair on your bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html#generate-a-new-egress-password-for-your-account">Generate a new egress password for your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html#generate-a-new-ingress-password-to-use-the-bastion-https-proxy">Generate a new ingress password to use the bastion HTTPS proxy</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html#show-the-list-of-servers-you-have-access-to">Show the list of servers you have access to</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html#list-the-public-egress-keys-of-your-account">List the public egress keys of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html#list-the-public-ingress-keys-of-your-account">List the public ingress keys of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html#list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-your-account">List the hashes and metadata of the egress passwords associated to your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfListSessions.html">selfListSessions</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html#list-the-few-past-sessions-of-your-account">List the few past sessions of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html#remove-the-unix-password-of-your-account">Remove the UNIX password of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html#remove-the-totp-configuration-of-your-account">Remove the TOTP configuration of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html#setup-an-additional-credential-unix-password-to-access-your-account">Setup an additional credential (UNIX password) to access your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html#setup-an-additional-credential-totp-to-access-your-account">Setup an additional credential (TOTP) to access your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html#replay-the-ttyrec-of-a-past-session">Replay the ttyrec of a past session</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="sftp.html">sftp</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html#transfer-files-from-to-remote-servers-using-sftp-through-the-bastion">Transfer files from/to remote servers using sftp through the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="unlock.html">unlock</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html#unlock-all-your-current-sessions">Unlock all your current sessions</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../group-owner/groupTransmitOwnership.html" class="btn btn-neutral float-left" title="groupTransmitOwnership" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="alive.html" class="btn btn-neutral float-right" title="alive" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/info.html b/plugins/open/info.html
new file mode 100644
index 000000000..888a9039f
--- /dev/null
+++ b/plugins/open/info.html
@@ -0,0 +1,267 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>info &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="lock" href="lock.html" />
+    <link rel="prev" title="help" href="help.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">info</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#displays-some-information-about-this-bastion-instance">Displays some information about this bastion instance</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#output-example">Output example</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#plugin-configuration">Plugin configuration</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#options">Options</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#example">Example</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>info</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/info.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="info">
+<h1>info<a class="headerlink" href="#info" title="Permalink to this headline"></a></h1>
+<section id="displays-some-information-about-this-bastion-instance">
+<h2>Displays some information about this bastion instance<a class="headerlink" href="#displays-some-information-about-this-bastion-instance" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh info</p>
+</div>
+</section>
+<section id="output-example">
+<h2>Output example<a class="headerlink" href="#output-example" title="Permalink to this headline"></a></h2>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>~ You are user1
+~
+~ Your <span class="nb">alias</span> to connect to this bastion is:
+~ <span class="nb">alias</span> <span class="nv">bastion</span><span class="o">=</span><span class="s1">&#39;ssh user1@testbastion.example.org -p 22 -t -- &#39;</span>
+~ Your <span class="nb">alias</span> to connect to this bastion with MOSH is:
+~ <span class="nb">alias</span> <span class="nv">bastionm</span><span class="o">=</span><span class="s1">&#39;mosh --ssh=&quot;ssh -p 22 -t&quot; user1@testbastion.example.org -- &#39;</span>
+~
+~ Multi-Factor Authentication <span class="o">(</span>MFA<span class="o">)</span> on your account:
+~ - Additional password authentication is not required
+~ - Additional password authentication bypass is disabled
+~ - Additional password authentication is enabled and active
+~ - Additional TOTP authentication is not required
+~ - Additional TOTP authentication bypass is disabled
+~ - Additional TOTP authentication is disabled
+~
+~ I am testbastion-a.example.org, aka bastion
+~ I have <span class="m">42</span> registered accounts and <span class="m">46</span> groups
+~ I am a MASTER, which means I accept modifications
+~ The networks I<span class="s1">&#39;m able to connect you to on the egress side are: all</span>
+<span class="s1">~ The networks that are explicitly forbidden on the egress side are: none</span>
+<span class="s1">~ My egress connection IP to remote servers is 192.0.2.45/32</span>
+<span class="s1">~ ...don&#39;</span>t forget to whitelist me <span class="k">in</span> your firewalls!
+~
+~ The following policy applies on this bastion:
+~ - The interactive mode <span class="o">(</span>-i<span class="o">)</span> is ENABLED
+~ - The support of mosh is ENABLED
+~ - Account expiration is DISABLED
+~ - Keyboard input idle <span class="nb">time</span> <span class="k">for</span> session locking is DISABLED
+~ - Keyboard input idle <span class="nb">time</span> <span class="k">for</span> session killing is DISABLED
+~ - The forced <span class="s2">&quot;from&quot;</span> prepend on ingress keys is DISABLED
+~ - The following algorithms are allowed <span class="k">for</span> ingress SSH keys: rsa, ecdsa, ed25519
+~ - The RSA key size <span class="k">for</span> ingress SSH keys must be between <span class="m">2048</span> and <span class="m">8192</span> bits
+~ - The following algorithms are allowed <span class="k">for</span> egress SSH keys: rsa, ecdsa, ed25519
+~ - The RSA key size <span class="k">for</span> egress SSH keys must be between <span class="m">2048</span> and <span class="m">8192</span> bits
+~ - The Multi-Factor Authentication <span class="o">(</span>MFA<span class="o">)</span> policy is ENABLED
+~
+~ Here is your excuse <span class="k">for</span> anything not working today:
+~ BOFH excuse <span class="c1">#444:</span>
+~ overflow error <span class="k">in</span> /dev/null
+</pre></div>
+</div>
+</section>
+<section id="plugin-configuration">
+<h2>Plugin configuration<a class="headerlink" href="#plugin-configuration" title="Permalink to this headline"></a></h2>
+<section id="options">
+<h3>Options<a class="headerlink" href="#options" title="Permalink to this headline"></a></h3>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-info-arg-admin_show_system_info">
+<span id="cmdoption-info-arg-admin-show-system-info"></span><span id="cmdoption-info-arg-boolean"></span><span class="sig-name descname"><span class="pre">admin_show_system_info</span></span><span class="sig-prename descclassname"> <span class="pre">(optional</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">boolean)</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-info-arg-admin_show_system_info" title="Permalink to this definition"></a></dt>
+<dd><p>If enabled, bastion admins get more output regarding information of the
+underlying OS. When omitted, this is enabled by default.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-info-arg-show_fortune">
+<span id="cmdoption-info-arg-show-fortune"></span><span id="cmdoption-info-arg-0"></span><span class="sig-name descname"><span class="pre">show_fortune</span></span><span class="sig-prename descclassname"> <span class="pre">(optional</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">boolean)</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-info-arg-show_fortune" title="Permalink to this definition"></a></dt>
+<dd><p>If enabled, and if the <code class="docutils literal notranslate"><span class="pre">fortune</span></code> package is installed on your OS,
+shows a fortune. When omitted, this is enabled by default.</p>
+</dd></dl>
+
+</section>
+<section id="example">
+<h3>Example<a class="headerlink" href="#example" title="Permalink to this headline"></a></h3>
+<p>Configuration, in JSON format, must be in <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.info.conf</span></code>:</p>
+<div class="highlight-json notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="p">{</span><span class="w"> </span><span class="nt">&quot;admin_show_system_info&quot;</span><span class="p">:</span><span class="w"> </span><span class="kc">false</span><span class="p">,</span><span class="w"> </span><span class="nt">&quot;show_fortune&quot;</span><span class="p">:</span><span class="w"> </span><span class="kc">false</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
+</span></pre></div>
+</div>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="help.html" class="btn btn-neutral float-left" title="help" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="lock.html" class="btn btn-neutral float-right" title="lock" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/lock.html b/plugins/open/lock.html
new file mode 100644
index 000000000..c9d6c47da
--- /dev/null
+++ b/plugins/open/lock.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>lock &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="mtr" href="mtr.html" />
+    <link rel="prev" title="info" href="info.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">lock</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#manually-lock-all-your-current-sessions">Manually lock all your current sessions</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>lock</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/lock.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="lock">
+<h1>lock<a class="headerlink" href="#lock" title="Permalink to this headline"></a></h1>
+<section id="manually-lock-all-your-current-sessions">
+<h2>Manually lock all your current sessions<a class="headerlink" href="#manually-lock-all-your-current-sessions" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh lock</p>
+</div>
+<p>This command will lock all your current sessions on this bastion instance. Note that this only applies to the bastion instance you're launching this command on, not on the whole bastion cluster (if you happen to have one).</p>
+<p>To undo this action, you can use <code class="docutils literal notranslate"><span class="pre">--osh</span> <span class="pre">unlock</span></code> on the same instance.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="info.html" class="btn btn-neutral float-left" title="info" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="mtr.html" class="btn btn-neutral float-right" title="mtr" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/mtr.html b/plugins/open/mtr.html
new file mode 100644
index 000000000..877c65acb
--- /dev/null
+++ b/plugins/open/mtr.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>mtr &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="nc" href="nc.html" />
+    <link rel="prev" title="lock" href="lock.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">mtr</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#runs-the-mtr-tool-to-traceroute-a-host">Runs the mtr tool to traceroute a host</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>mtr</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/mtr.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="mtr">
+<h1>mtr<a class="headerlink" href="#mtr" title="Permalink to this headline"></a></h1>
+<section id="runs-the-mtr-tool-to-traceroute-a-host">
+<h2>Runs the mtr tool to traceroute a host<a class="headerlink" href="#runs-the-mtr-tool-to-traceroute-a-host" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh mtr [--host] HOST [--report]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-mtr-report">
+<span class="sig-name descname"><span class="pre">--report</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-mtr-report" title="Permalink to this definition"></a></dt>
+<dd><p>Don't run mtr interactively, output a text report once done</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="lock.html" class="btn btn-neutral float-left" title="lock" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="nc.html" class="btn btn-neutral float-right" title="nc" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/nc.html b/plugins/open/nc.html
new file mode 100644
index 000000000..db3fa7b04
--- /dev/null
+++ b/plugins/open/nc.html
@@ -0,0 +1,209 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>nc &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="ping" href="ping.html" />
+    <link rel="prev" title="mtr" href="mtr.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">nc</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#check-whether-a-remote-tcp-port-is-open">Check whether a remote TCP port is open</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>nc</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/nc.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="nc">
+<h1>nc<a class="headerlink" href="#nc" title="Permalink to this headline"></a></h1>
+<section id="check-whether-a-remote-tcp-port-is-open">
+<h2>Check whether a remote TCP port is open<a class="headerlink" href="#check-whether-a-remote-tcp-port-is-open" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh nc [--host] HOST [--port] PORT [-w TIMEOUT]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-nc-host">
+<span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST</span></span><a class="headerlink" href="#cmdoption-nc-host" title="Permalink to this definition"></a></dt>
+<dd><p>Host or IP to attempt to connect to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-nc-port">
+<span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-nc-port" title="Permalink to this definition"></a></dt>
+<dd><p>TCP port to attempt to connect to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-nc-w">
+<span class="sig-name descname"><span class="pre">-w</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS</span></span><a class="headerlink" href="#cmdoption-nc-w" title="Permalink to this definition"></a></dt>
+<dd><p>Timeout in seconds (default: 3)</p>
+</dd></dl>
+
+<p>Note that this is not a full-featured <code class="docutils literal notranslate"><span class="pre">netcat</span></code>, we just test whether a remote port is open. There is no way to exchange data using this command.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="mtr.html" class="btn btn-neutral float-left" title="mtr" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="ping.html" class="btn btn-neutral float-right" title="ping" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/ping.html b/plugins/open/ping.html
new file mode 100644
index 000000000..e56ad8c26
--- /dev/null
+++ b/plugins/open/ping.html
@@ -0,0 +1,220 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>ping &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="scp" href="scp.html" />
+    <link rel="prev" title="nc" href="nc.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">ping</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#ping-a-remote-host-from-the-bastion">Ping a remote host from the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>ping</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/ping.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="ping">
+<h1>ping<a class="headerlink" href="#ping" title="Permalink to this headline"></a></h1>
+<section id="ping-a-remote-host-from-the-bastion">
+<h2>Ping a remote host from the bastion<a class="headerlink" href="#ping-a-remote-host-from-the-bastion" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh ping [--host HOST] [-c COUNT] [-s PKTSZ] [-t TTL] [-w TIMEOUT]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-ping-host">
+<span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST</span></span><a class="headerlink" href="#cmdoption-ping-host" title="Permalink to this definition"></a></dt>
+<dd><p>Remote host to ping</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-ping-c">
+<span class="sig-name descname"><span class="pre">-c</span></span><span class="sig-prename descclassname"> <span class="pre">COUNT</span></span><a class="headerlink" href="#cmdoption-ping-c" title="Permalink to this definition"></a></dt>
+<dd><p>Number of pings to send (default: infinite)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-ping-s">
+<span class="sig-name descname"><span class="pre">-s</span></span><span class="sig-prename descclassname"> <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-ping-s" title="Permalink to this definition"></a></dt>
+<dd><p>Specify the packet size to send</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-ping-t">
+<span class="sig-name descname"><span class="pre">-t</span></span><span class="sig-prename descclassname"> <span class="pre">TTL</span></span><a class="headerlink" href="#cmdoption-ping-t" title="Permalink to this definition"></a></dt>
+<dd><p>TTL to set in the ICMP packet (default: OS dependent)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-ping-w">
+<span class="sig-name descname"><span class="pre">-w</span></span><span class="sig-prename descclassname"> <span class="pre">TIMEOUT</span></span><a class="headerlink" href="#cmdoption-ping-w" title="Permalink to this definition"></a></dt>
+<dd><p>Exit unconditionally after this amount of seconds (default &amp; max: 86400)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="nc.html" class="btn btn-neutral float-left" title="nc" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="scp.html" class="btn btn-neutral float-right" title="scp" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/scp.html b/plugins/open/scp.html
new file mode 100644
index 000000000..2b95814cc
--- /dev/null
+++ b/plugins/open/scp.html
@@ -0,0 +1,208 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>scp &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfAddIngressKey" href="selfAddIngressKey.html" />
+    <link rel="prev" title="ping" href="ping.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">scp</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#transfer-files-from-to-remote-servers-using-scp-through-the-bastion">Transfer files from/to remote servers using scp through the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>scp</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/scp.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="scp">
+<h1>scp<a class="headerlink" href="#scp" title="Permalink to this headline"></a></h1>
+<section id="transfer-files-from-to-remote-servers-using-scp-through-the-bastion">
+<h2>Transfer files from/to remote servers using scp through the bastion<a class="headerlink" href="#transfer-files-from-to-remote-servers-using-scp-through-the-bastion" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This plugin generates a valid helper script for you to use the bastion over scp, read below to learn how to use it.</p>
+</div>
+<p>To be able to use <code class="docutils literal notranslate"><span class="pre">scp</span></code> over the bastion, you need to have a helper script that is specific
+to your account on the bastion. This plugin's job is to generate it for you.
+You can simply run it, and follow the guidelines.</p>
+<p>Once this is done, you'll be able to <code class="docutils literal notranslate"><span class="pre">scp</span></code> through the bastion by adding <code class="docutils literal notranslate"><span class="pre">-S</span> <span class="pre">SCP_SCRIPT</span></code> to your
+regular <code class="docutils literal notranslate"><span class="pre">scp</span></code> command, where <code class="docutils literal notranslate"><span class="pre">SCP_SCRIPT</span></code> is the location of the script you've just generated.</p>
+<p>For example, to upload a file:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>scp -S ~/scp_bastion localfile login@server:/dest/folder/
+</pre></div>
+</div>
+<p>Or to recursively download a folder contents:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>scp -S ~/scp_bastion -r login@server:/src/folder/ /tmp/
+</pre></div>
+</div>
+<p>Please note that you need to be granted for uploading or downloading files
+with scp to/from the remote host, in addition to having the right to SSH to it.
+For a group, the right should be added with <code class="docutils literal notranslate"><span class="pre">--scpup</span></code>/<code class="docutils literal notranslate"><span class="pre">--scpdown</span></code> of the <a class="reference internal" href="../group-aclkeeper/groupAddServer.html"><span class="doc">groupAddServer</span></a> command.
+For a personal access, the right should be added with <code class="docutils literal notranslate"><span class="pre">--scpup</span></code>/<code class="docutils literal notranslate"><span class="pre">--scpdown</span></code> of the <a class="reference internal" href="../restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a> command.</p>
+<p>You'll find more information and examples in <a class="reference internal" href="../../using/sftp_scp.html"><span class="doc">SFTP &amp; SCP support</span></a>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="ping.html" class="btn btn-neutral float-left" title="ping" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfAddIngressKey.html" class="btn btn-neutral float-right" title="selfAddIngressKey" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfAddIngressKey.html b/plugins/open/selfAddIngressKey.html
new file mode 100644
index 000000000..0527dddda
--- /dev/null
+++ b/plugins/open/selfAddIngressKey.html
@@ -0,0 +1,212 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfAddIngressKey &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfDelIngressKey" href="selfDelIngressKey.html" />
+    <link rel="prev" title="scp" href="scp.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfAddIngressKey</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-a-new-ingress-public-key-to-your-account">Add a new ingress public key to your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfAddIngressKey</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfAddIngressKey.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfaddingresskey">
+<h1>selfAddIngressKey<a class="headerlink" href="#selfaddingresskey" title="Permalink to this headline"></a></h1>
+<section id="add-a-new-ingress-public-key-to-your-account">
+<h2>Add a new ingress public key to your account<a class="headerlink" href="#add-a-new-ingress-public-key-to-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfAddIngressKey [--public-key '&quot;ssh key text&quot;'] [--piv]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddIngressKey-public-key">
+<span id="cmdoption-selfaddingresskey-public-key"></span><span class="sig-name descname"><span class="pre">--public-key</span></span><span class="sig-prename descclassname"> <span class="pre">KEY</span></span><a class="headerlink" href="#cmdoption-selfAddIngressKey-public-key" title="Permalink to this definition"></a></dt>
+<dd><p>Your new ingress public SSH key to deposit on the bastion, use double-quoting if your're under a shell.</p>
+<blockquote>
+<div><p>If this option is not specified, you'll be prompted interactively for your public SSH key. Note that you
+can also pass it through STDIN directly. If the policy of this bastion allows it, you may prefix the key
+with a 'from=&quot;IP1,IP2,...&quot;' snippet, a la authorized_keys. However the policy might force a configured
+'from' prefix that will override yours, or be used if you don't specify it yourself.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddIngressKey-piv">
+<span id="cmdoption-selfaddingresskey-piv"></span><span class="sig-name descname"><span class="pre">--piv</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddIngressKey-piv" title="Permalink to this definition"></a></dt>
+<dd><p>Add a public SSH key from a PIV-compatible hardware token, along with its attestation certificate and key</p>
+<blockquote>
+<div><p>certificate, both in PEM format. If you specified --public-key, then the attestation and key certificate are
+expected on STDIN only, otherwise the public SSH key, the attestation and key certificate are expected on STDIN.</p>
+</div></blockquote>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="scp.html" class="btn btn-neutral float-left" title="scp" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfDelIngressKey.html" class="btn btn-neutral float-right" title="selfDelIngressKey" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfDelIngressKey.html b/plugins/open/selfDelIngressKey.html
new file mode 100644
index 000000000..d91ea7668
--- /dev/null
+++ b/plugins/open/selfDelIngressKey.html
@@ -0,0 +1,203 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfDelIngressKey &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfForgetHostKey" href="selfForgetHostKey.html" />
+    <link rel="prev" title="selfAddIngressKey" href="selfAddIngressKey.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfDelIngressKey</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-an-ingress-public-key-from-your-account">Remove an ingress public key from your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfDelIngressKey</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfDelIngressKey.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfdelingresskey">
+<h1>selfDelIngressKey<a class="headerlink" href="#selfdelingresskey" title="Permalink to this headline"></a></h1>
+<section id="remove-an-ingress-public-key-from-your-account">
+<h2>Remove an ingress public key from your account<a class="headerlink" href="#remove-an-ingress-public-key-from-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfDelIngressKey [--id-to-delete|-l ID] [--fingerprint-to-delete|-f FP]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelIngressKey-l">
+<span id="cmdoption-selfdelingresskey-l"></span><span id="cmdoption-selfDelIngressKey-id-to-delete"></span><span id="cmdoption-selfdelingresskey-id-to-delete"></span><span class="sig-name descname"><span class="pre">-l</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">--id-to-delete</span></span><span class="sig-prename descclassname"> <span class="pre">ID</span></span><a class="headerlink" href="#cmdoption-selfDelIngressKey-l" title="Permalink to this definition"></a></dt>
+<dd><p>Directly specify key id to delete (CAUTION!), you can get id with selfListIngressKeys</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelIngressKey-f">
+<span id="cmdoption-selfdelingresskey-f"></span><span id="cmdoption-selfDelIngressKey-fingerprint-to-delete"></span><span id="cmdoption-selfdelingresskey-fingerprint-to-delete"></span><span class="sig-name descname"><span class="pre">-f</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">--fingerprint-to-delete</span></span><span class="sig-prename descclassname"> <span class="pre">FP</span></span><a class="headerlink" href="#cmdoption-selfDelIngressKey-f" title="Permalink to this definition"></a></dt>
+<dd><p>Directly specify the fingerprint of the key to delete (CAUTION!)</p>
+</dd></dl>
+
+<p>If none of these options are specified, you'll be prompted interactively.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfAddIngressKey.html" class="btn btn-neutral float-left" title="selfAddIngressKey" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfForgetHostKey.html" class="btn btn-neutral float-right" title="selfForgetHostKey" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfForgetHostKey.html b/plugins/open/selfForgetHostKey.html
new file mode 100644
index 000000000..48953d540
--- /dev/null
+++ b/plugins/open/selfForgetHostKey.html
@@ -0,0 +1,205 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfForgetHostKey &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfGenerateEgressKey" href="selfGenerateEgressKey.html" />
+    <link rel="prev" title="selfDelIngressKey" href="selfDelIngressKey.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfForgetHostKey</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#forget-a-known-host-key-from-your-bastion-account">Forget a known host key from your bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfForgetHostKey</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfForgetHostKey.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfforgethostkey">
+<h1>selfForgetHostKey<a class="headerlink" href="#selfforgethostkey" title="Permalink to this headline"></a></h1>
+<section id="forget-a-known-host-key-from-your-bastion-account">
+<h2>Forget a known host key from your bastion account<a class="headerlink" href="#forget-a-known-host-key-from-your-bastion-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfForgetHostKey [--host HOST] [--port PORT]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfForgetHostKey-host">
+<span id="cmdoption-selfforgethostkey-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST</span></span><a class="headerlink" href="#cmdoption-selfForgetHostKey-host" title="Permalink to this definition"></a></dt>
+<dd><p>Host to remove from the known_hosts file</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfForgetHostKey-port">
+<span id="cmdoption-selfforgethostkey-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-selfForgetHostKey-port" title="Permalink to this definition"></a></dt>
+<dd><p>Port to look for in the known_hosts file (default: 22)</p>
+</dd></dl>
+
+<p>This command is useful to remove the man-in-the-middle warning when a key has changed,
+however please verify that the host key change is legit before using this command.
+The warning SSH gives is there for a reason.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfDelIngressKey.html" class="btn btn-neutral float-left" title="selfDelIngressKey" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfGenerateEgressKey.html" class="btn btn-neutral float-right" title="selfGenerateEgressKey" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfGenerateEgressKey.html b/plugins/open/selfGenerateEgressKey.html
new file mode 100644
index 000000000..0df64b0ed
--- /dev/null
+++ b/plugins/open/selfGenerateEgressKey.html
@@ -0,0 +1,221 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfGenerateEgressKey &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfGeneratePassword" href="selfGeneratePassword.html" />
+    <link rel="prev" title="selfForgetHostKey" href="selfForgetHostKey.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfGenerateEgressKey</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#create-a-new-public-private-key-pair-on-your-bastion-account">Create a new public + private key pair on your bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfGenerateEgressKey</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfGenerateEgressKey.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfgenerateegresskey">
+<h1>selfGenerateEgressKey<a class="headerlink" href="#selfgenerateegresskey" title="Permalink to this headline"></a></h1>
+<section id="create-a-new-public-private-key-pair-on-your-bastion-account">
+<h2>Create a new public + private key pair on your bastion account<a class="headerlink" href="#create-a-new-public-private-key-pair-on-your-bastion-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfGenerateEgressKey --algo ALGO --size SIZE [--encrypted]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGenerateEgressKey-algo">
+<span id="cmdoption-selfgenerateegresskey-algo"></span><span class="sig-name descname"><span class="pre">--algo</span></span><span class="sig-prename descclassname"> <span class="pre">ALGO</span></span><a class="headerlink" href="#cmdoption-selfGenerateEgressKey-algo" title="Permalink to this definition"></a></dt>
+<dd><p>Specifies the algo of the key, either rsa, ecdsa or ed25519.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGenerateEgressKey-size">
+<span id="cmdoption-selfgenerateegresskey-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname"> <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-selfGenerateEgressKey-size" title="Permalink to this definition"></a></dt>
+<dd><p>Specifies the size of the key to be generated.</p>
+<blockquote>
+<div><p>For RSA, choose between 2048 and 8192 (4096 is good).
+For ECDSA, choose either 256, 384 or 521.
+For ED25519, size is always 256.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGenerateEgressKey-encrypted">
+<span id="cmdoption-selfgenerateegresskey-encrypted"></span><span class="sig-name descname"><span class="pre">--encrypted</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfGenerateEgressKey-encrypted" title="Permalink to this definition"></a></dt>
+<dd><p>if specified, a passphrase will be prompted for the new key</p>
+</dd></dl>
+
+<p>A quick overview of the different algorithms:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Ed25519      : robustness[###] speed[###]
+ECDSA        : robustness[##.] speed[###]
+RSA          : robustness[#..] speed[#..]
+</pre></div>
+</div>
+<p>This table is meant as a quick cheat-sheet, you're warmly advised to do
+your own research, as other constraints may apply to your environment.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfForgetHostKey.html" class="btn btn-neutral float-left" title="selfForgetHostKey" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfGeneratePassword.html" class="btn btn-neutral float-right" title="selfGeneratePassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfGeneratePassword.html b/plugins/open/selfGeneratePassword.html
new file mode 100644
index 000000000..a9906a016
--- /dev/null
+++ b/plugins/open/selfGeneratePassword.html
@@ -0,0 +1,211 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfGeneratePassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfGenerateProxyPassword" href="selfGenerateProxyPassword.html" />
+    <link rel="prev" title="selfGenerateEgressKey" href="selfGenerateEgressKey.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfGeneratePassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#generate-a-new-egress-password-for-your-account">Generate a new egress password for your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfGeneratePassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfGeneratePassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfgeneratepassword">
+<h1>selfGeneratePassword<a class="headerlink" href="#selfgeneratepassword" title="Permalink to this headline"></a></h1>
+<section id="generate-a-new-egress-password-for-your-account">
+<h2>Generate a new egress password for your account<a class="headerlink" href="#generate-a-new-egress-password-for-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfGeneratePassword [--size SIZE] --do-it</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGeneratePassword-size">
+<span id="cmdoption-selfgeneratepassword-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname"> <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-selfGeneratePassword-size" title="Permalink to this definition"></a></dt>
+<dd><p>Specify the number of characters of the password to generate</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGeneratePassword-do-it">
+<span id="cmdoption-selfgeneratepassword-do-it"></span><span class="sig-name descname"><span class="pre">--do-it</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfGeneratePassword-do-it" title="Permalink to this definition"></a></dt>
+<dd><p>Required for the password to actually be generated, BEWARE: please read the note below</p>
+</dd></dl>
+
+<p>This plugin generates a new egress password to be used for ssh or telnet</p>
+<p>NOTE: this is only needed for devices that don't support key-based SSH,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access only support telnet or password-based SSH.</p>
+<p>BEWARE: once a new password is generated this way, it'll be set as the new
+egress password to use right away for your account, for any access that requires it.
+A fallback mechanism exists that will auto-try the previous password if this one
+doesn't work, but please ensure that this new password is deployed on the remote
+devices as soon as possible.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfGenerateEgressKey.html" class="btn btn-neutral float-left" title="selfGenerateEgressKey" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfGenerateProxyPassword.html" class="btn btn-neutral float-right" title="selfGenerateProxyPassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfGenerateProxyPassword.html b/plugins/open/selfGenerateProxyPassword.html
new file mode 100644
index 000000000..69faacb5d
--- /dev/null
+++ b/plugins/open/selfGenerateProxyPassword.html
@@ -0,0 +1,208 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfGenerateProxyPassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfListAccesses" href="selfListAccesses.html" />
+    <link rel="prev" title="selfGeneratePassword" href="selfGeneratePassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfGenerateProxyPassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#generate-a-new-ingress-password-to-use-the-bastion-https-proxy">Generate a new ingress password to use the bastion HTTPS proxy</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfGenerateProxyPassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfGenerateProxyPassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfgenerateproxypassword">
+<h1>selfGenerateProxyPassword<a class="headerlink" href="#selfgenerateproxypassword" title="Permalink to this headline"></a></h1>
+<section id="generate-a-new-ingress-password-to-use-the-bastion-https-proxy">
+<h2>Generate a new ingress password to use the bastion HTTPS proxy<a class="headerlink" href="#generate-a-new-ingress-password-to-use-the-bastion-https-proxy" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfGenerateProxyPassword [--size SIZE] --do-it</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGenerateProxyPassword-size">
+<span id="cmdoption-selfgenerateproxypassword-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname"> <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-selfGenerateProxyPassword-size" title="Permalink to this definition"></a></dt>
+<dd><p>Size of the password to generate</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfGenerateProxyPassword-do-it">
+<span id="cmdoption-selfgenerateproxypassword-do-it"></span><span class="sig-name descname"><span class="pre">--do-it</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfGenerateProxyPassword-do-it" title="Permalink to this definition"></a></dt>
+<dd><p>Required for the password to actually be generated, BEWARE: please read the note below</p>
+</dd></dl>
+
+<p>This plugin generates a new ingress password to use the bastion HTTPS proxy.</p>
+<p>NOTE: this is only needed for devices that only support HTTPS API and not ssh,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access are using an HTTPS API.</p>
+<p>BEWARE: once a new password is generated this way, it'll be set as the new
+HTTPS proxy ingress password to use right away for your account.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfGeneratePassword.html" class="btn btn-neutral float-left" title="selfGeneratePassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfListAccesses.html" class="btn btn-neutral float-right" title="selfListAccesses" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfListAccesses.html b/plugins/open/selfListAccesses.html
new file mode 100644
index 000000000..f180cc01c
--- /dev/null
+++ b/plugins/open/selfListAccesses.html
@@ -0,0 +1,227 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfListAccesses &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfListEgressKeys" href="selfListEgressKeys.html" />
+    <link rel="prev" title="selfGenerateProxyPassword" href="selfGenerateProxyPassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfListAccesses</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#show-the-list-of-servers-you-have-access-to">Show the list of servers you have access to</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfListAccesses</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfListAccesses.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selflistaccesses">
+<h1>selfListAccesses<a class="headerlink" href="#selflistaccesses" title="Permalink to this headline"></a></h1>
+<section id="show-the-list-of-servers-you-have-access-to">
+<h2>Show the list of servers you have access to<a class="headerlink" href="#show-the-list-of-servers-you-have-access-to" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfListAccesses [--hide-groups] [--reverse-dns]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListAccesses-hide-groups">
+<span id="cmdoption-selflistaccesses-hide-groups"></span><span class="sig-name descname"><span class="pre">--hide-groups</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfListAccesses-hide-groups" title="Permalink to this definition"></a></dt>
+<dd><p>Don't show the machines you have access to through group rights.</p>
+<blockquote>
+<div><p>In other words, list only your personal accesses.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListAccesses-reverse-dns">
+<span id="cmdoption-selflistaccesses-reverse-dns"></span><span class="sig-name descname"><span class="pre">--reverse-dns</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfListAccesses-reverse-dns" title="Permalink to this definition"></a></dt>
+<dd><p>Attempt to resolve the reverse hostnames (SLOW!)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListAccesses-include">
+<span id="cmdoption-selflistaccesses-include"></span><span class="sig-name descname"><span class="pre">--include</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-selfListAccesses-include" title="Permalink to this definition"></a></dt>
+<dd><p>Only include accesses matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times to refine results</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListAccesses-exclude">
+<span id="cmdoption-selflistaccesses-exclude"></span><span class="sig-name descname"><span class="pre">--exclude</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-selfListAccesses-exclude" title="Permalink to this definition"></a></dt>
+<dd><p>Omit accesses matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times.
+Note that --exclude takes precedence over --include</p>
+</div></blockquote>
+</dd></dl>
+
+<p><strong>Note:</strong> PATTERN supports the <code class="docutils literal notranslate"><span class="pre">*</span></code> and <code class="docutils literal notranslate"><span class="pre">?</span></code> wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfGenerateProxyPassword.html" class="btn btn-neutral float-left" title="selfGenerateProxyPassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfListEgressKeys.html" class="btn btn-neutral float-right" title="selfListEgressKeys" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfListEgressKeys.html b/plugins/open/selfListEgressKeys.html
new file mode 100644
index 000000000..c7d0106a1
--- /dev/null
+++ b/plugins/open/selfListEgressKeys.html
@@ -0,0 +1,194 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfListEgressKeys &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfListIngressKeys" href="selfListIngressKeys.html" />
+    <link rel="prev" title="selfListAccesses" href="selfListAccesses.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfListEgressKeys</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-public-egress-keys-of-your-account">List the public egress keys of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfListEgressKeys</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfListEgressKeys.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selflistegresskeys">
+<h1>selfListEgressKeys<a class="headerlink" href="#selflistegresskeys" title="Permalink to this headline"></a></h1>
+<section id="list-the-public-egress-keys-of-your-account">
+<h2>List the public egress keys of your account<a class="headerlink" href="#list-the-public-egress-keys-of-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfListEgressKeys</p>
+</div>
+<p>The keys listed are the public egress SSH keys tied to your account.
+They can be used to gain access to another machine from this bastion,
+by putting one of those keys in the remote machine's <code class="docutils literal notranslate"><span class="pre">authorized_keys</span></code> file,
+and adding yourself access to this machine with <code class="docutils literal notranslate"><span class="pre">selfAddPersonalAccess</span></code>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfListAccesses.html" class="btn btn-neutral float-left" title="selfListAccesses" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfListIngressKeys.html" class="btn btn-neutral float-right" title="selfListIngressKeys" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfListIngressKeys.html b/plugins/open/selfListIngressKeys.html
new file mode 100644
index 000000000..48fe7a507
--- /dev/null
+++ b/plugins/open/selfListIngressKeys.html
@@ -0,0 +1,193 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfListIngressKeys &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfListPasswords" href="selfListPasswords.html" />
+    <link rel="prev" title="selfListEgressKeys" href="selfListEgressKeys.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfListIngressKeys</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-public-ingress-keys-of-your-account">List the public ingress keys of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfListIngressKeys</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfListIngressKeys.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selflistingresskeys">
+<h1>selfListIngressKeys<a class="headerlink" href="#selflistingresskeys" title="Permalink to this headline"></a></h1>
+<section id="list-the-public-ingress-keys-of-your-account">
+<h2>List the public ingress keys of your account<a class="headerlink" href="#list-the-public-ingress-keys-of-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfListIngressKeys</p>
+</div>
+<p>The keys listed are the public ingress SSH keys tied to your account.
+Their private counterpart should be detained only by you, and used
+to authenticate yourself to this bastion.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfListEgressKeys.html" class="btn btn-neutral float-left" title="selfListEgressKeys" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfListPasswords.html" class="btn btn-neutral float-right" title="selfListPasswords" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfListPasswords.html b/plugins/open/selfListPasswords.html
new file mode 100644
index 000000000..a280ea4d8
--- /dev/null
+++ b/plugins/open/selfListPasswords.html
@@ -0,0 +1,191 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfListPasswords &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfListSessions" href="selfListSessions.html" />
+    <link rel="prev" title="selfListIngressKeys" href="selfListIngressKeys.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfListPasswords</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-your-account">List the hashes and metadata of the egress passwords associated to your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfListPasswords</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfListPasswords.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selflistpasswords">
+<h1>selfListPasswords<a class="headerlink" href="#selflistpasswords" title="Permalink to this headline"></a></h1>
+<section id="list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-your-account">
+<h2>List the hashes and metadata of the egress passwords associated to your account<a class="headerlink" href="#list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfListPasswords</p>
+</div>
+<p>The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfListIngressKeys.html" class="btn btn-neutral float-left" title="selfListIngressKeys" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfListSessions.html" class="btn btn-neutral float-right" title="selfListSessions" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfListSessions.html b/plugins/open/selfListSessions.html
new file mode 100644
index 000000000..aa253f9b2
--- /dev/null
+++ b/plugins/open/selfListSessions.html
@@ -0,0 +1,276 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfListSessions &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfMFAResetPassword" href="selfMFAResetPassword.html" />
+    <link rel="prev" title="selfListPasswords" href="selfListPasswords.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfListSessions</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-few-past-sessions-of-your-account">List the few past sessions of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfListSessions</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfListSessions.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selflistsessions">
+<h1>selfListSessions<a class="headerlink" href="#selflistsessions" title="Permalink to this headline"></a></h1>
+<section id="list-the-few-past-sessions-of-your-account">
+<h2>List the few past sessions of your account<a class="headerlink" href="#list-the-few-past-sessions-of-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfListSessions [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-detailed">
+<span id="cmdoption-selflistsessions-detailed"></span><span class="sig-name descname"><span class="pre">--detailed</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfListSessions-detailed" title="Permalink to this definition"></a></dt>
+<dd><p>Display more information about each session</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-limit">
+<span id="cmdoption-selflistsessions-limit"></span><span class="sig-name descname"><span class="pre">--limit</span></span><span class="sig-prename descclassname"> <span class="pre">LIMIT</span></span><a class="headerlink" href="#cmdoption-selfListSessions-limit" title="Permalink to this definition"></a></dt>
+<dd><p>Limit to LIMIT results</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-id">
+<span id="cmdoption-selflistsessions-id"></span><span class="sig-name descname"><span class="pre">--id</span></span><span class="sig-prename descclassname"> <span class="pre">ID</span></span><a class="headerlink" href="#cmdoption-selfListSessions-id" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions having this ID</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-type">
+<span id="cmdoption-selflistsessions-type"></span><span class="sig-name descname"><span class="pre">--type</span></span><span class="sig-prename descclassname"> <span class="pre">TYPE</span></span><a class="headerlink" href="#cmdoption-selfListSessions-type" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions of specified type (ssh, osh, ...)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-allowed">
+<span id="cmdoption-selflistsessions-allowed"></span><span class="sig-name descname"><span class="pre">--allowed</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfListSessions-allowed" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions that have been allowed by the bastion</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-denied">
+<span id="cmdoption-selflistsessions-denied"></span><span class="sig-name descname"><span class="pre">--denied</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfListSessions-denied" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions that have been denied by the bastion</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-after">
+<span id="cmdoption-selflistsessions-after"></span><span class="sig-name descname"><span class="pre">--after</span></span><span class="sig-prename descclassname"> <span class="pre">WHEN</span></span><a class="headerlink" href="#cmdoption-selfListSessions-after" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions that started after WHEN,</p>
+<blockquote>
+<div><p>WHEN can be a TIMESTAMP, or YYYY-MM-DD[&#64;HH:MM:SS]</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-before">
+<span id="cmdoption-selflistsessions-before"></span><span class="sig-name descname"><span class="pre">--before</span></span><span class="sig-prename descclassname"> <span class="pre">WHEN</span></span><a class="headerlink" href="#cmdoption-selfListSessions-before" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions that started before WHEN,</p>
+<blockquote>
+<div><p>WHEN can be a TIMESTAMP, or YYYY-MM-DD[&#64;HH:MM:SS]</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-host">
+<span id="cmdoption-selflistsessions-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">HOST</span></span><a class="headerlink" href="#cmdoption-selfListSessions-host" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions connecting to remote HOST</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-to-port">
+<span id="cmdoption-selflistsessions-to-port"></span><span class="sig-name descname"><span class="pre">--to-port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-selfListSessions-to-port" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions connecting to remote PORT</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-user">
+<span id="cmdoption-selflistsessions-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-selfListSessions-user" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions connecting using remote USER</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-via">
+<span id="cmdoption-selflistsessions-via"></span><span class="sig-name descname"><span class="pre">--via</span></span><span class="sig-prename descclassname"> <span class="pre">HOST</span></span><a class="headerlink" href="#cmdoption-selfListSessions-via" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions that connected through bastion IP HOST</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfListSessions-via-port">
+<span id="cmdoption-selflistsessions-via-port"></span><span class="sig-name descname"><span class="pre">--via-port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-selfListSessions-via-port" title="Permalink to this definition"></a></dt>
+<dd><p>Only sessions that connected through bastion PORT</p>
+</dd></dl>
+
+<p>Note that only the sessions that happened on this precise bastion instance will be shown,
+not the sessions from its possible cluster siblings.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfListPasswords.html" class="btn btn-neutral float-left" title="selfListPasswords" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfMFAResetPassword.html" class="btn btn-neutral float-right" title="selfMFAResetPassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfMFAResetPassword.html b/plugins/open/selfMFAResetPassword.html
new file mode 100644
index 000000000..fcedca1d0
--- /dev/null
+++ b/plugins/open/selfMFAResetPassword.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfMFAResetPassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfMFAResetTOTP" href="selfMFAResetTOTP.html" />
+    <link rel="prev" title="selfListSessions" href="selfListSessions.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfMFAResetPassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-unix-password-of-your-account">Remove the UNIX password of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfMFAResetPassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfMFAResetPassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfmfaresetpassword">
+<h1>selfMFAResetPassword<a class="headerlink" href="#selfmfaresetpassword" title="Permalink to this headline"></a></h1>
+<section id="remove-the-unix-password-of-your-account">
+<h2>Remove the UNIX password of your account<a class="headerlink" href="#remove-the-unix-password-of-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfMFAResetPassword</p>
+</div>
+<p>Note that if your password is set, you'll be prompted for it.
+Also note that this doesn't remove your UNIX password requirement, if set (see <code class="docutils literal notranslate"><span class="pre">accountModify</span></code> for this).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfListSessions.html" class="btn btn-neutral float-left" title="selfListSessions" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfMFAResetTOTP.html" class="btn btn-neutral float-right" title="selfMFAResetTOTP" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfMFAResetTOTP.html b/plugins/open/selfMFAResetTOTP.html
new file mode 100644
index 000000000..f1a59f869
--- /dev/null
+++ b/plugins/open/selfMFAResetTOTP.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfMFAResetTOTP &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfMFASetupPassword" href="selfMFASetupPassword.html" />
+    <link rel="prev" title="selfMFAResetPassword" href="selfMFAResetPassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfMFAResetTOTP</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-totp-configuration-of-your-account">Remove the TOTP configuration of your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfMFAResetTOTP</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfMFAResetTOTP.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfmfaresettotp">
+<h1>selfMFAResetTOTP<a class="headerlink" href="#selfmfaresettotp" title="Permalink to this headline"></a></h1>
+<section id="remove-the-totp-configuration-of-your-account">
+<h2>Remove the TOTP configuration of your account<a class="headerlink" href="#remove-the-totp-configuration-of-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfMFAResetTOTP</p>
+</div>
+<p>Note that if your TOTP is set, you'll be prompted for it.
+Also note that this doesn't remove your TOTP requirement, if set (see accountModify for this).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfMFAResetPassword.html" class="btn btn-neutral float-left" title="selfMFAResetPassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfMFASetupPassword.html" class="btn btn-neutral float-right" title="selfMFASetupPassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfMFASetupPassword.html b/plugins/open/selfMFASetupPassword.html
new file mode 100644
index 000000000..2b9f31a5c
--- /dev/null
+++ b/plugins/open/selfMFASetupPassword.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfMFASetupPassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfMFASetupTOTP" href="selfMFASetupTOTP.html" />
+    <link rel="prev" title="selfMFAResetTOTP" href="selfMFAResetTOTP.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfMFASetupPassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#setup-an-additional-credential-unix-password-to-access-your-account">Setup an additional credential (UNIX password) to access your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfMFASetupPassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfMFASetupPassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfmfasetuppassword">
+<h1>selfMFASetupPassword<a class="headerlink" href="#selfmfasetuppassword" title="Permalink to this headline"></a></h1>
+<section id="setup-an-additional-credential-unix-password-to-access-your-account">
+<h2>Setup an additional credential (UNIX password) to access your account<a class="headerlink" href="#setup-an-additional-credential-unix-password-to-access-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfMFASetupPassword [--yes]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfMFASetupPassword-yes">
+<span id="cmdoption-selfmfasetuppassword-yes"></span><span class="sig-name descname"><span class="pre">--yes</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfMFASetupPassword-yes" title="Permalink to this definition"></a></dt>
+<dd><p>Don't ask for confirmation</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfMFAResetTOTP.html" class="btn btn-neutral float-left" title="selfMFAResetTOTP" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfMFASetupTOTP.html" class="btn btn-neutral float-right" title="selfMFASetupTOTP" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfMFASetupTOTP.html b/plugins/open/selfMFASetupTOTP.html
new file mode 100644
index 000000000..5b4df1d80
--- /dev/null
+++ b/plugins/open/selfMFASetupTOTP.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfMFASetupTOTP &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfPlaySession" href="selfPlaySession.html" />
+    <link rel="prev" title="selfMFASetupPassword" href="selfMFASetupPassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfMFASetupTOTP</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#setup-an-additional-credential-totp-to-access-your-account">Setup an additional credential (TOTP) to access your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfMFASetupTOTP</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfMFASetupTOTP.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfmfasetuptotp">
+<h1>selfMFASetupTOTP<a class="headerlink" href="#selfmfasetuptotp" title="Permalink to this headline"></a></h1>
+<section id="setup-an-additional-credential-totp-to-access-your-account">
+<h2>Setup an additional credential (TOTP) to access your account<a class="headerlink" href="#setup-an-additional-credential-totp-to-access-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfMFASetupTOTP [--no-confirm]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfMFASetupTOTP-no-confirm">
+<span id="cmdoption-selfmfasetuptotp-no-confirm"></span><span class="sig-name descname"><span class="pre">--no-confirm</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfMFASetupTOTP-no-confirm" title="Permalink to this definition"></a></dt>
+<dd><p>Bypass the confirmation step for TOTP enrollment phase</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfMFASetupPassword.html" class="btn btn-neutral float-left" title="selfMFASetupPassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfPlaySession.html" class="btn btn-neutral float-right" title="selfPlaySession" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/selfPlaySession.html b/plugins/open/selfPlaySession.html
new file mode 100644
index 000000000..49f181e93
--- /dev/null
+++ b/plugins/open/selfPlaySession.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfPlaySession &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="sftp" href="sftp.html" />
+    <link rel="prev" title="selfMFASetupTOTP" href="selfMFASetupTOTP.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfPlaySession</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#replay-the-ttyrec-of-a-past-session">Replay the ttyrec of a past session</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>selfPlaySession</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/selfPlaySession.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfplaysession">
+<h1>selfPlaySession<a class="headerlink" href="#selfplaysession" title="Permalink to this headline"></a></h1>
+<section id="replay-the-ttyrec-of-a-past-session">
+<h2>Replay the ttyrec of a past session<a class="headerlink" href="#replay-the-ttyrec-of-a-past-session" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfPlaySession --id ID</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfPlaySession-id">
+<span id="cmdoption-selfplaysession-id"></span><span class="sig-name descname"><span class="pre">--id</span></span><span class="sig-prename descclassname"> <span class="pre">ID</span></span><a class="headerlink" href="#cmdoption-selfPlaySession-id" title="Permalink to this definition"></a></dt>
+<dd><p>ID of the session to replay, use <code class="docutils literal notranslate"><span class="pre">selfListSessions</span></code> to find it.</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfMFASetupTOTP.html" class="btn btn-neutral float-left" title="selfMFASetupTOTP" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="sftp.html" class="btn btn-neutral float-right" title="sftp" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/sftp.html b/plugins/open/sftp.html
new file mode 100644
index 000000000..d8b402d97
--- /dev/null
+++ b/plugins/open/sftp.html
@@ -0,0 +1,211 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>sftp &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="unlock" href="unlock.html" />
+    <link rel="prev" title="selfPlaySession" href="selfPlaySession.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">sftp</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#transfer-files-from-to-remote-servers-using-sftp-through-the-bastion">Transfer files from/to remote servers using sftp through the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="unlock.html">unlock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>sftp</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/sftp.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="sftp">
+<h1>sftp<a class="headerlink" href="#sftp" title="Permalink to this headline"></a></h1>
+<section id="transfer-files-from-to-remote-servers-using-sftp-through-the-bastion">
+<h2>Transfer files from/to remote servers using sftp through the bastion<a class="headerlink" href="#transfer-files-from-to-remote-servers-using-sftp-through-the-bastion" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This plugin generates a valid helper script for you to use the bastion over scp, read below to learn how to use it.</p>
+</div>
+<p>To be able to use <code class="docutils literal notranslate"><span class="pre">sftp</span></code> over the bastion, you need to have a helper script that is specific
+to your account on the bastion. This plugin's job is to generate it for you.
+You can simply run it, and follow the guidelines.</p>
+<p>Once this is done, you'll be able to <code class="docutils literal notranslate"><span class="pre">sftp</span></code> through the bastion by adding <code class="docutils literal notranslate"><span class="pre">-S</span> <span class="pre">SFTP_SCRIPT</span></code> to your
+regular <code class="docutils literal notranslate"><span class="pre">sftp</span></code> command, where <code class="docutils literal notranslate"><span class="pre">SFTP_SCRIPT</span></code> is the location of the script you've just generated.</p>
+<p>For example:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>sftp -S ~/sftp_bastion login@server
+</pre></div>
+</div>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>If you're getting the 'subsystem request failed on channel 0' error, it usually means that
+sftp is not enabled on the remote server, as this is not always enabled by default, depending
+on the distro you're using.</p>
+</div>
+<p>Please note that you need to be granted for uploading or downloading files
+with SFTP to/from the remote host, in addition to having the right to SSH to it.
+For a group, the right should be added with <code class="docutils literal notranslate"><span class="pre">--sftp</span></code> of the <a class="reference internal" href="../group-aclkeeper/groupAddServer.html"><span class="doc">groupAddServer</span></a> command.
+For a personal access, the right should be added with <code class="docutils literal notranslate"><span class="pre">--sftp</span></code> of the <a class="reference internal" href="../restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a> command.
+<a class="reference internal" href="selfListEgressKeys.html"><span class="doc">selfListEgressKeys</span></a></p>
+<p>You'll find more information and examples in <a class="reference internal" href="../../using/sftp_scp.html"><span class="doc">SFTP &amp; SCP support</span></a>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfPlaySession.html" class="btn btn-neutral float-left" title="selfPlaySession" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="unlock.html" class="btn btn-neutral float-right" title="unlock" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/open/unlock.html b/plugins/open/unlock.html
new file mode 100644
index 000000000..ebb65b359
--- /dev/null
+++ b/plugins/open/unlock.html
@@ -0,0 +1,194 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>unlock &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="restricted plugins" href="../restricted/index.html" />
+    <link rel="prev" title="sftp" href="sftp.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">open plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="alive.html">alive</a></li>
+<li class="toctree-l2"><a class="reference internal" href="batch.html">batch</a></li>
+<li class="toctree-l2"><a class="reference internal" href="clush.html">clush</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupInfo.html">groupInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupList.html">groupList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListPasswords.html">groupListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupListServers.html">groupListServers</a></li>
+<li class="toctree-l2"><a class="reference internal" href="help.html">help</a></li>
+<li class="toctree-l2"><a class="reference internal" href="info.html">info</a></li>
+<li class="toctree-l2"><a class="reference internal" href="lock.html">lock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="mtr.html">mtr</a></li>
+<li class="toctree-l2"><a class="reference internal" href="nc.html">nc</a></li>
+<li class="toctree-l2"><a class="reference internal" href="ping.html">ping</a></li>
+<li class="toctree-l2"><a class="reference internal" href="scp.html">scp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddIngressKey.html">selfAddIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelIngressKey.html">selfDelIngressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfForgetHostKey.html">selfForgetHostKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateEgressKey.html">selfGenerateEgressKey</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGeneratePassword.html">selfGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfGenerateProxyPassword.html">selfGenerateProxyPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListAccesses.html">selfListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListEgressKeys.html">selfListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListIngressKeys.html">selfListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListPasswords.html">selfListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfListSessions.html">selfListSessions</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetPassword.html">selfMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFAResetTOTP.html">selfMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupPassword.html">selfMFASetupPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfMFASetupTOTP.html">selfMFASetupTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfPlaySession.html">selfPlaySession</a></li>
+<li class="toctree-l2"><a class="reference internal" href="sftp.html">sftp</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">unlock</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#unlock-all-your-current-sessions">Unlock all your current sessions</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">open plugins</a> &raquo;</li>
+      <li>unlock</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/open/unlock.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="unlock">
+<h1>unlock<a class="headerlink" href="#unlock" title="Permalink to this headline"></a></h1>
+<section id="unlock-all-your-current-sessions">
+<h2>Unlock all your current sessions<a class="headerlink" href="#unlock-all-your-current-sessions" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh unlock</p>
+</div>
+<p>This command will unlock all your current sessions on this bastion instance,
+that were either locked for inactivity timeout or manually locked by you with <code class="docutils literal notranslate"><span class="pre">lock</span></code>.
+Note that this only applies to the bastion instance you're launching this
+command on, not on the whole bastion cluster (if you happen to have one).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="sftp.html" class="btn btn-neutral float-left" title="sftp" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../restricted/index.html" class="btn btn-neutral float-right" title="restricted plugins" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountAddPersonalAccess.html b/plugins/restricted/accountAddPersonalAccess.html
new file mode 100644
index 000000000..5990e9b85
--- /dev/null
+++ b/plugins/restricted/accountAddPersonalAccess.html
@@ -0,0 +1,307 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountAddPersonalAccess &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountCreate" href="accountCreate.html" />
+    <link rel="prev" title="restricted plugins" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountAddPersonalAccess</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-a-personal-server-access-to-an-account">Add a personal server access to an account</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#plugin-configuration">Plugin configuration</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#options">Options</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#example">Example</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountAddPersonalAccess</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountAddPersonalAccess.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountaddpersonalaccess">
+<h1>accountAddPersonalAccess<a class="headerlink" href="#accountaddpersonalaccess" title="Permalink to this headline"></a></h1>
+<section id="add-a-personal-server-access-to-an-account">
+<h2>Add a personal server access to an account<a class="headerlink" href="#add-a-personal-server-access-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountAddPersonalAccess --account ACCOUNT --host HOST [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-account">
+<span id="cmdoption-accountaddpersonalaccess-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-account" title="Permalink to this definition"></a></dt>
+<dd><p>Bastion account to add the access to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-host">
+<span id="cmdoption-accountaddpersonalaccess-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">IP|HOST|IP/MASK</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-host" title="Permalink to this definition"></a></dt>
+<dd><p>Server to add access to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-user">
+<span id="cmdoption-accountaddpersonalaccess-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-user" title="Permalink to this definition"></a></dt>
+<dd><p>Remote login to use, if you want to allow any login, use --user-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-user-any">
+<span id="cmdoption-accountaddpersonalaccess-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>Allow access with any remote login</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-port">
+<span id="cmdoption-accountaddpersonalaccess-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-port" title="Permalink to this definition"></a></dt>
+<dd><p>Remote SSH port to use, if you want to allow any port, use --port-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-port-any">
+<span id="cmdoption-accountaddpersonalaccess-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>Allow access to all remote ports</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-scpup">
+<span id="cmdoption-accountaddpersonalaccess-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>Allow SCP upload, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-scpdown">
+<span id="cmdoption-accountaddpersonalaccess-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>Allow SCP download, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-sftp">
+<span id="cmdoption-accountaddpersonalaccess-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>Allow usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-force-key">
+<span id="cmdoption-accountaddpersonalaccess-force-key"></span><span class="sig-name descname"><span class="pre">--force-key</span></span><span class="sig-prename descclassname"> <span class="pre">FINGERPRINT</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-force-key" title="Permalink to this definition"></a></dt>
+<dd><p>Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-force-password">
+<span id="cmdoption-accountaddpersonalaccess-force-password"></span><span class="sig-name descname"><span class="pre">--force-password</span></span><span class="sig-prename descclassname"> <span class="pre">HASH</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-force-password" title="Permalink to this definition"></a></dt>
+<dd><p>Only use the password with the specified hash to connect to the server (cf accountListPasswords)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-ttl">
+<span id="cmdoption-accountaddpersonalaccess-ttl"></span><span class="sig-name descname"><span class="pre">--ttl</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS|DURATION</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-ttl" title="Permalink to this definition"></a></dt>
+<dd><p>Specify a number of seconds (or a duration string, such as &quot;1d7h8m&quot;) after which the access will automatically expire</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-comment">
+<span id="cmdoption-accountaddpersonalaccess-comment"></span><span class="sig-name descname"><span class="pre">--comment</span></span><span class="sig-prename descclassname"> <span class="pre">&quot;'ANY</span> <span class="pre">TEXT'&quot;</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-comment" title="Permalink to this definition"></a></dt>
+<dd><p>Add a comment alongside this server. Quote it twice as shown if you're under a shell.</p>
+</dd></dl>
+
+<p>The access will work only if one of the account's personal egress public key has been copied to the remote server.
+To get the list of an account's personal egress public keys, see <code class="docutils literal notranslate"><span class="pre">accountListEgressKeyss</span></code> and <code class="docutils literal notranslate"><span class="pre">selfListEgressKeys</span></code>.</p>
+</section>
+<section id="plugin-configuration">
+<h2>Plugin configuration<a class="headerlink" href="#plugin-configuration" title="Permalink to this headline"></a></h2>
+<section id="options">
+<h3>Options<a class="headerlink" href="#options" title="Permalink to this headline"></a></h3>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix">
+<span id="cmdoption-accountaddpersonalaccess-arg-widest-v4-prefix"></span><span id="cmdoption-accountAddPersonalAccess-arg-integer"></span><span id="cmdoption-accountaddpersonalaccess-arg-integer"></span><span id="cmdoption-accountAddPersonalAccess-arg-between"></span><span id="cmdoption-accountaddpersonalaccess-arg-between"></span><span class="sig-name descname"><span class="pre">widest_v4_prefix</span></span><span class="sig-prename descclassname"> <span class="pre">(optional</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">integer</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">between</span></span><span class="sig-prename descclassname"> <span class="pre">0</span> <span class="pre">and</span> <span class="pre">32)</span></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix" title="Permalink to this definition"></a></dt>
+<dd><p>When specified, this limits the size of prefixes that can be added to an
+ACL, e.g. 24 would not allow prefixes wider than /24 (such as /20 or
+/16).
+Note that this doesn't prevent users from adding thousands of ACLs to
+cover a wide range of networks, but this helps ensuring ACLs such as
+0.0.0.0/0 can't be added in a single command.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountAddPersonalAccess-arg-self_remote_user_only">
+<span id="cmdoption-accountaddpersonalaccess-arg-self-remote-user-only"></span><span id="cmdoption-accountAddPersonalAccess-arg-boolean"></span><span id="cmdoption-accountaddpersonalaccess-arg-boolean"></span><span class="sig-name descname"><span class="pre">self_remote_user_only</span></span><span class="sig-prename descclassname"> <span class="pre">(optional</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">boolean)</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountAddPersonalAccess-arg-self_remote_user_only" title="Permalink to this definition"></a></dt>
+<dd><p>When true, this only allows to add ACLs with the remote user being the
+same than the account name, i.e. adding an access to a bastion account
+named &quot;johndoe&quot; can only be done specifying this very account name as
+the remote user name, with <code class="docutils literal notranslate"><span class="pre">accountAddPersonalAccess</span> <span class="pre">--user</span> <span class="pre">johndoe</span></code>.</p>
+</dd></dl>
+
+</section>
+<section id="example">
+<h3>Example<a class="headerlink" href="#example" title="Permalink to this headline"></a></h3>
+<p>Configuration, in JSON format, must be in <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.accountAddPersonalAccess.conf</span></code>:</p>
+<div class="highlight-json notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="p">{</span><span class="w"> </span><span class="nt">&quot;widest_v4_prefix&quot;</span><span class="p">:</span><span class="w"> </span><span class="mi">24</span><span class="p">,</span><span class="w"> </span><span class="nt">&quot;self_remote_user_only&quot;</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
+</span></pre></div>
+</div>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="restricted plugins" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountCreate.html" class="btn btn-neutral float-right" title="accountCreate" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountCreate.html b/plugins/restricted/accountCreate.html
new file mode 100644
index 000000000..6f2c63064
--- /dev/null
+++ b/plugins/restricted/accountCreate.html
@@ -0,0 +1,264 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountCreate &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountDelPersonalAccess" href="accountDelPersonalAccess.html" />
+    <link rel="prev" title="accountAddPersonalAccess" href="accountAddPersonalAccess.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountCreate</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#create-a-new-bastion-account">Create a new bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountCreate</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountCreate.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountcreate">
+<h1>accountCreate<a class="headerlink" href="#accountcreate" title="Permalink to this headline"></a></h1>
+<section id="create-a-new-bastion-account">
+<h2>Create a new bastion account<a class="headerlink" href="#create-a-new-bastion-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountCreate --account ACCOUNT &lt;--uid UID|--uid-auto&gt; [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-account">
+<span id="cmdoption-accountcreate-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">NAME</span></span><a class="headerlink" href="#cmdoption-accountCreate-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account name to create, NAME must contain only valid UNIX account name characters</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-uid">
+<span id="cmdoption-accountcreate-uid"></span><span class="sig-name descname"><span class="pre">--uid</span></span><span class="sig-prename descclassname"> <span class="pre">UID</span></span><a class="headerlink" href="#cmdoption-accountCreate-uid" title="Permalink to this definition"></a></dt>
+<dd><p>Account system UID, also see --uid-auto</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-uid-auto">
+<span id="cmdoption-accountcreate-uid-auto"></span><span class="sig-name descname"><span class="pre">--uid-auto</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountCreate-uid-auto" title="Permalink to this definition"></a></dt>
+<dd><p>Auto-select an UID from the allowed range (the upper available one will be used)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-always-active">
+<span id="cmdoption-accountcreate-always-active"></span><span class="sig-name descname"><span class="pre">--always-active</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountCreate-always-active" title="Permalink to this definition"></a></dt>
+<dd><p>This account's activation won't be challenged on connection, even if the bastion is globally</p>
+<blockquote>
+<div><p>configured to check for account activation</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-osh-only">
+<span id="cmdoption-accountcreate-osh-only"></span><span class="sig-name descname"><span class="pre">--osh-only</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountCreate-osh-only" title="Permalink to this definition"></a></dt>
+<dd><p>This account will only be able to use <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands, and can't connect anywhere through the bastion</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-max-inactive-days">
+<span id="cmdoption-accountcreate-max-inactive-days"></span><span class="sig-name descname"><span class="pre">--max-inactive-days</span></span><span class="sig-prename descclassname"> <span class="pre">DAYS</span></span><a class="headerlink" href="#cmdoption-accountCreate-max-inactive-days" title="Permalink to this definition"></a></dt>
+<dd><p>Set account expiration policy, overriding the global bastion configuration 'accountMaxInactiveDays',</p>
+<blockquote>
+<div><p>setting this option to zero disables account expiration.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-immutable-key">
+<span id="cmdoption-accountcreate-immutable-key"></span><span class="sig-name descname"><span class="pre">--immutable-key</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountCreate-immutable-key" title="Permalink to this definition"></a></dt>
+<dd><p>Deny any subsequent modification of the account key (selfAddKey and selfDelKey are denied)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-comment">
+<span id="cmdoption-accountcreate-comment"></span><span class="sig-name descname"><span class="pre">--comment</span></span><span class="sig-prename descclassname"> <span class="pre">'&quot;STRING&quot;'</span></span><a class="headerlink" href="#cmdoption-accountCreate-comment" title="Permalink to this definition"></a></dt>
+<dd><p>An optional comment when creating the account. Quote it twice as shown if you're under a shell.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-public-key">
+<span id="cmdoption-accountcreate-public-key"></span><span class="sig-name descname"><span class="pre">--public-key</span></span><span class="sig-prename descclassname"> <span class="pre">'&quot;KEY&quot;'</span></span><a class="headerlink" href="#cmdoption-accountCreate-public-key" title="Permalink to this definition"></a></dt>
+<dd><p>Account public SSH key to deposit on the bastion, if not present,</p>
+<blockquote>
+<div><p>you'll be prompted interactively for it. Quote it twice as shown if your're under a shell.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-no-key">
+<span id="cmdoption-accountcreate-no-key"></span><span class="sig-name descname"><span class="pre">--no-key</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountCreate-no-key" title="Permalink to this definition"></a></dt>
+<dd><p>Don't prompt for an SSH key, no ingress public key will be installed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountCreate-ttl">
+<span id="cmdoption-accountcreate-ttl"></span><span class="sig-name descname"><span class="pre">--ttl</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS|DURATION</span></span><a class="headerlink" href="#cmdoption-accountCreate-ttl" title="Permalink to this definition"></a></dt>
+<dd><p>Time after which the account will be deactivated (amount of seconds, or duration string such as &quot;4d12h15m&quot;)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountAddPersonalAccess.html" class="btn btn-neutral float-left" title="accountAddPersonalAccess" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountDelPersonalAccess.html" class="btn btn-neutral float-right" title="accountDelPersonalAccess" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountDelPersonalAccess.html b/plugins/restricted/accountDelPersonalAccess.html
new file mode 100644
index 000000000..7e9cd92ca
--- /dev/null
+++ b/plugins/restricted/accountDelPersonalAccess.html
@@ -0,0 +1,243 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountDelPersonalAccess &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountDelete" href="accountDelete.html" />
+    <link rel="prev" title="accountCreate" href="accountCreate.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountDelPersonalAccess</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-a-personal-server-access-from-an-account">Remove a personal server access from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountDelPersonalAccess</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountDelPersonalAccess.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountdelpersonalaccess">
+<h1>accountDelPersonalAccess<a class="headerlink" href="#accountdelpersonalaccess" title="Permalink to this headline"></a></h1>
+<section id="remove-a-personal-server-access-from-an-account">
+<h2>Remove a personal server access from an account<a class="headerlink" href="#remove-a-personal-server-access-from-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountDelPersonalAccess --account ACCOUNT --host HOST [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-account">
+<span id="cmdoption-accountdelpersonalaccess-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-account" title="Permalink to this definition"></a></dt>
+<dd><p>Bastion account to remove access from</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-host">
+<span id="cmdoption-accountdelpersonalaccess-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">IP|HOST|IP/MASK</span></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-host" title="Permalink to this definition"></a></dt>
+<dd><p>Server to remove access from</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-user">
+<span id="cmdoption-accountdelpersonalaccess-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-user" title="Permalink to this definition"></a></dt>
+<dd><p>Remote user that was allowed, if any user was allowed, use --user-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-user-any">
+<span id="cmdoption-accountdelpersonalaccess-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>Use if any remote login was allowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-port">
+<span id="cmdoption-accountdelpersonalaccess-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-port" title="Permalink to this definition"></a></dt>
+<dd><p>Remote SSH port that was allowed, if any port was allowed, use --port-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-port-any">
+<span id="cmdoption-accountdelpersonalaccess-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>Use if any remote port was allowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-scpup">
+<span id="cmdoption-accountdelpersonalaccess-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>Remove SCP upload right, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-scpdown">
+<span id="cmdoption-accountdelpersonalaccess-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>Remove SCP download right, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelPersonalAccess-sftp">
+<span id="cmdoption-accountdelpersonalaccess-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelPersonalAccess-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>Remove usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountCreate.html" class="btn btn-neutral float-left" title="accountCreate" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountDelete.html" class="btn btn-neutral float-right" title="accountDelete" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountDelete.html b/plugins/restricted/accountDelete.html
new file mode 100644
index 000000000..4da387fe2
--- /dev/null
+++ b/plugins/restricted/accountDelete.html
@@ -0,0 +1,201 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountDelete &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountFreeze" href="accountFreeze.html" />
+    <link rel="prev" title="accountDelPersonalAccess" href="accountDelPersonalAccess.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountDelete</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#delete-an-account-from-the-bastion">Delete an account from the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountDelete</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountDelete.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountdelete">
+<h1>accountDelete<a class="headerlink" href="#accountdelete" title="Permalink to this headline"></a></h1>
+<section id="delete-an-account-from-the-bastion">
+<h2>Delete an account from the bastion<a class="headerlink" href="#delete-an-account-from-the-bastion" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountDelete --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelete-account">
+<span id="cmdoption-accountdelete-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountDelete-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account name to delete</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountDelete-no-confirm">
+<span id="cmdoption-accountdelete-no-confirm"></span><span class="sig-name descname"><span class="pre">--no-confirm</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountDelete-no-confirm" title="Permalink to this definition"></a></dt>
+<dd><p>Don't ask for confirmation, and blame yourself if you deleted the wrong account</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountDelPersonalAccess.html" class="btn btn-neutral float-left" title="accountDelPersonalAccess" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountFreeze.html" class="btn btn-neutral float-right" title="accountFreeze" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountFreeze.html b/plugins/restricted/accountFreeze.html
new file mode 100644
index 000000000..88d79e480
--- /dev/null
+++ b/plugins/restricted/accountFreeze.html
@@ -0,0 +1,204 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountFreeze &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountGeneratePassword" href="accountGeneratePassword.html" />
+    <link rel="prev" title="accountDelete" href="accountDelete.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountFreeze</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#freeze-an-account-to-prevent-it-from-connecting">Freeze an account, to prevent it from connecting</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountFreeze</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountFreeze.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountfreeze">
+<h1>accountFreeze<a class="headerlink" href="#accountfreeze" title="Permalink to this headline"></a></h1>
+<section id="freeze-an-account-to-prevent-it-from-connecting">
+<h2>Freeze an account, to prevent it from connecting<a class="headerlink" href="#freeze-an-account-to-prevent-it-from-connecting" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountFreeze --account ACCOUNT [--reason &quot;'SOME REASON'&quot;]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountFreeze-account">
+<span id="cmdoption-accountfreeze-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountFreeze-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account to freeze</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountFreeze-reason">
+<span id="cmdoption-accountfreeze-reason"></span><span class="sig-name descname"><span class="pre">--reason</span></span><span class="sig-prename descclassname">&#160; <span class="pre">&quot;'SOME</span> <span class="pre">REASON'&quot;</span></span><a class="headerlink" href="#cmdoption-accountFreeze-reason" title="Permalink to this definition"></a></dt>
+<dd><p>Optional reason for the account to be frozen (will be displayed to the user),</p>
+<blockquote>
+<div><p>if you are in a shell (and not in interactive mode), quote it twice as shown.</p>
+</div></blockquote>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountDelete.html" class="btn btn-neutral float-left" title="accountDelete" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountGeneratePassword.html" class="btn btn-neutral float-right" title="accountGeneratePassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountGeneratePassword.html b/plugins/restricted/accountGeneratePassword.html
new file mode 100644
index 000000000..deffe2e34
--- /dev/null
+++ b/plugins/restricted/accountGeneratePassword.html
@@ -0,0 +1,216 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountGeneratePassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountGrantCommand" href="accountGrantCommand.html" />
+    <link rel="prev" title="accountFreeze" href="accountFreeze.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountGeneratePassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#generate-a-new-egress-password-for-an-account">Generate a new egress password for an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountGeneratePassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountGeneratePassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountgeneratepassword">
+<h1>accountGeneratePassword<a class="headerlink" href="#accountgeneratepassword" title="Permalink to this headline"></a></h1>
+<section id="generate-a-new-egress-password-for-an-account">
+<h2>Generate a new egress password for an account<a class="headerlink" href="#generate-a-new-egress-password-for-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountGeneratePassword --account ACCOUNT [--size SIZE] --do-it</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountGeneratePassword-account">
+<span id="cmdoption-accountgeneratepassword-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountGeneratePassword-account" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which account you want to generate a password for</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountGeneratePassword-size">
+<span id="cmdoption-accountgeneratepassword-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname">&#160;&#160;&#160; <span class="pre">SIZE</span></span><a class="headerlink" href="#cmdoption-accountGeneratePassword-size" title="Permalink to this definition"></a></dt>
+<dd><p>Specify the number of characters of the password to generate</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountGeneratePassword-do-it">
+<span id="cmdoption-accountgeneratepassword-do-it"></span><span class="sig-name descname"><span class="pre">--do-it</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountGeneratePassword-do-it" title="Permalink to this definition"></a></dt>
+<dd><p>Required for the password to actually be generated, BEWARE: please read the note below</p>
+</dd></dl>
+
+<p>This plugin generates a new egress password to be used for ssh or telnet</p>
+<p>NOTE: this is only needed for devices that don't support key-based SSH,
+in most cases you should ignore this command completely, unless you
+know that devices you need to access only support telnet or password-based SSH.</p>
+<p>BEWARE: once a new password is generated this way, it'll be set as the new
+egress password to use right away for the account, for any access that requires it.
+A fallback mechanism exists that will auto-try the previous password if this one
+doesn't work, but please ensure that this new password is deployed on the remote
+devices as soon as possible.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountFreeze.html" class="btn btn-neutral float-left" title="accountFreeze" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountGrantCommand.html" class="btn btn-neutral float-right" title="accountGrantCommand" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountGrantCommand.html b/plugins/restricted/accountGrantCommand.html
new file mode 100644
index 000000000..334f070d5
--- /dev/null
+++ b/plugins/restricted/accountGrantCommand.html
@@ -0,0 +1,206 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountGrantCommand &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountInfo" href="accountInfo.html" />
+    <link rel="prev" title="accountGeneratePassword" href="accountGeneratePassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountGrantCommand</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#grant-access-to-a-restricted-command">Grant access to a restricted command</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountGrantCommand</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountGrantCommand.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountgrantcommand">
+<h1>accountGrantCommand<a class="headerlink" href="#accountgrantcommand" title="Permalink to this headline"></a></h1>
+<section id="grant-access-to-a-restricted-command">
+<h2>Grant access to a restricted command<a class="headerlink" href="#grant-access-to-a-restricted-command" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountGrantCommand --account ACCOUNT --command COMMAND</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountGrantCommand-account">
+<span id="cmdoption-accountgrantcommand-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountGrantCommand-account" title="Permalink to this definition"></a></dt>
+<dd><p>Bastion account to work on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountGrantCommand-command">
+<span id="cmdoption-accountgrantcommand-command"></span><span class="sig-name descname"><span class="pre">--command</span></span><span class="sig-prename descclassname"> <span class="pre">COMMAND</span></span><a class="headerlink" href="#cmdoption-accountGrantCommand-command" title="Permalink to this definition"></a></dt>
+<dd><p>The name of the OSH plugin to grant (omit to get the list)</p>
+</dd></dl>
+
+<p>Note that accountGrantCommand being a restricted command as any other, you can grant it to somebody else,
+but then they'll be able to grant themselves or anybody else to this or any other restricted command.</p>
+<p>A specific command that can be granted is <code class="docutils literal notranslate"><span class="pre">auditor</span></code>, it is not an osh plugin per-se, but activates
+more verbose output for several other commands, suitable to audit rights or grants without needing
+to be granted (e.g. to groups).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountGeneratePassword.html" class="btn btn-neutral float-left" title="accountGeneratePassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountInfo.html" class="btn btn-neutral float-right" title="accountInfo" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountInfo.html b/plugins/restricted/accountInfo.html
new file mode 100644
index 000000000..44161f240
--- /dev/null
+++ b/plugins/restricted/accountInfo.html
@@ -0,0 +1,297 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountInfo &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountList" href="accountList.html" />
+    <link rel="prev" title="accountGrantCommand" href="accountGrantCommand.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountInfo</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#display-some-information-about-an-account">Display some information about an account</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#usage-examples">Usage examples</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#output-example">Output example</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountInfo</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountInfo.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountinfo">
+<h1>accountInfo<a class="headerlink" href="#accountinfo" title="Permalink to this headline"></a></h1>
+<section id="display-some-information-about-an-account">
+<h2>Display some information about an account<a class="headerlink" href="#display-some-information-about-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountInfo &lt;--account ACCOUNT|--all&gt; [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountInfo-account">
+<span id="cmdoption-accountinfo-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountInfo-account" title="Permalink to this definition"></a></dt>
+<dd><p>The account name to work on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountInfo-all">
+<span id="cmdoption-accountinfo-all"></span><span class="sig-name descname"><span class="pre">--all</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountInfo-all" title="Permalink to this definition"></a></dt>
+<dd><p>Dump info for all accounts (auditors only), use with <code class="docutils literal notranslate"><span class="pre">--json</span></code></p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountInfo-with-out-everything">
+<span id="cmdoption-accountinfo-with-out-everything"></span><span class="sig-name descname"><span class="pre">--with[out]-everything</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountInfo-with-out-everything" title="Permalink to this definition"></a></dt>
+<dd><p>Include or exclude all below options, including future ones</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountInfo-with-out-groups">
+<span id="cmdoption-accountinfo-with-out-groups"></span><span class="sig-name descname"><span class="pre">--with[out]-groups</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountInfo-with-out-groups" title="Permalink to this definition"></a></dt>
+<dd><p>Whether to include the groups the account has a role on (SLOW, default: no)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountInfo-with-out-mfa-password-info">
+<span id="cmdoption-accountinfo-with-out-mfa-password-info"></span><span class="sig-name descname"><span class="pre">--with[out]-mfa-password-info</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountInfo-with-out-mfa-password-info" title="Permalink to this definition"></a></dt>
+<dd><p>Whether to include MFA password info of the account (SLOW, auditors only, default: no)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountInfo-with-out-egress-keys">
+<span id="cmdoption-accountinfo-with-out-egress-keys"></span><span class="sig-name descname"><span class="pre">--with[out]-egress-keys</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountInfo-with-out-egress-keys" title="Permalink to this definition"></a></dt>
+<dd><p>Whether to include the account's egress keys (SLOW, auditors only, default: no)</p>
+</dd></dl>
+
+</section>
+<section id="usage-examples">
+<h2>Usage examples<a class="headerlink" href="#usage-examples" title="Permalink to this headline"></a></h2>
+<p>Show info about a specific account:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh accountInfo --account jdoe12
+</pre></div>
+</div>
+<p>Gather info about all accounts, with no extra data except their egress keys:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh accountInfo --all --without-everything --with-egress-keys --json
+</pre></div>
+</div>
+<p>Gather info about all accounts, including all extra data (and possibly future options):</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>--osh accountInfo --all --with-everything --json
+</pre></div>
+</div>
+</section>
+<section id="output-example">
+<h2>Output example<a class="headerlink" href="#output-example" title="Permalink to this headline"></a></h2>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>│ user1 is a bastion admin
+│ user1 is a bastion superowner
+│ user1 is a bastion auditor
+│
+│ user1 has access to the following restricted commands:
+│ - accountCreate
+│ - accountDelete
+│ - groupCreate
+│ - groupDelete
+│
+│ This account is part of the following groups:
+│         testgroup1 Owner GateKeeper ACLKeeper Member     -
+│    gatekeeper-grp2 Owner GateKeeper         -      -     -
+│
+│ This account is active
+│ This account has no TTL <span class="nb">set</span>
+│ This account is not frozen
+│ This account has seen recent-enough activity to not be activity-expired
+│ As a consequence, this account can connect to this bastion
+│
+│ Last seen on Thu <span class="m">2023</span>-03-16 <span class="m">07</span>:51:49 UTC <span class="o">(</span><span class="m">00</span>:00:00 ago<span class="o">)</span>
+│ Created on Fri <span class="m">2022</span>-06-17 <span class="m">09</span>:52:50 UTC <span class="o">(</span>271d+21:58:59 ago<span class="o">)</span>
+│ Created by jdoe
+│ Created using The Bastion v3.08.01
+│
+│ Account egress SSH config:
+│ - <span class="o">(</span>default<span class="o">)</span>
+│
+│ PIV-enforced policy <span class="k">for</span> ingress keys on this account is enabled
+│
+│ Account Multi-Factor Authentication status:
+│ - Additional password authentication is not required <span class="k">for</span> this account
+│ - Additional password authentication bypass is disabled <span class="k">for</span> this account
+│ - Additional password authentication is enabled and active
+│ - Additional TOTP authentication is not required <span class="k">for</span> this account
+│ - Additional TOTP authentication bypass is disabled <span class="k">for</span> this account
+│ - Additional TOTP authentication is disabled
+│ - PAM authentication bypass is disabled
+│ - Optional public key authentication is disabled
+│ - MFA policy on personal accesses <span class="o">(</span>using personal keys<span class="o">)</span> on egress side is: password
+│
+│ - Account is immune to idle counter-measures: no
+│ - Maximum number of days of inactivity before account is disabled: <span class="o">(</span>default<span class="o">)</span>
+│
+│ Account PAM UNIX password information <span class="o">(</span>used <span class="k">for</span> password MFA<span class="o">)</span>:
+│ - Password is <span class="nb">set</span>
+│ - Password was last changed on <span class="m">2023</span>-01-27
+│ - Password must be changed every <span class="m">90</span> days at least
+│ - A warning is displayed <span class="m">75</span> days before expiration
+│ - Account will not be disabled after password expiration
+</pre></div>
+</div>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountGrantCommand.html" class="btn btn-neutral float-left" title="accountGrantCommand" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountList.html" class="btn btn-neutral float-right" title="accountList" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountList.html b/plugins/restricted/accountList.html
new file mode 100644
index 000000000..e9652f96f
--- /dev/null
+++ b/plugins/restricted/accountList.html
@@ -0,0 +1,240 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountList &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountListAccesses" href="accountListAccesses.html" />
+    <link rel="prev" title="accountInfo" href="accountInfo.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountList</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-bastion-accounts">List the bastion accounts</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountList</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountList.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountlist">
+<h1>accountList<a class="headerlink" href="#accountlist" title="Permalink to this headline"></a></h1>
+<section id="list-the-bastion-accounts">
+<h2>List the bastion accounts<a class="headerlink" href="#list-the-bastion-accounts" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountList [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-account">
+<span id="cmdoption-accountlist-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountList-account" title="Permalink to this definition"></a></dt>
+<dd><p>Only list the specified account. This is an easy way to check whether the account exists</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-inactive-only">
+<span id="cmdoption-accountlist-inactive-only"></span><span class="sig-name descname"><span class="pre">--inactive-only</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountList-inactive-only" title="Permalink to this definition"></a></dt>
+<dd><p>Only list inactive accounts</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-audit">
+<span id="cmdoption-accountlist-audit"></span><span class="sig-name descname"><span class="pre">--audit</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountList-audit" title="Permalink to this definition"></a></dt>
+<dd><p>Show more verbose information (SLOW!), you need to be a bastion auditor</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-no-password-info">
+<span id="cmdoption-accountlist-no-password-info"></span><span class="sig-name descname"><span class="pre">--no-password-info</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountList-no-password-info" title="Permalink to this definition"></a></dt>
+<dd><p>Don't gather password info in audit mode (makes --audit way faster)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-no-output">
+<span id="cmdoption-accountlist-no-output"></span><span class="sig-name descname"><span class="pre">--no-output</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountList-no-output" title="Permalink to this definition"></a></dt>
+<dd><p>Don't print human-readable output (faster, use with --json)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-include">
+<span id="cmdoption-accountlist-include"></span><span class="sig-name descname"><span class="pre">--include</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-accountList-include" title="Permalink to this definition"></a></dt>
+<dd><p>Only show accounts whose name match the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times to refine results</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountList-exclude">
+<span id="cmdoption-accountlist-exclude"></span><span class="sig-name descname"><span class="pre">--exclude</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-accountList-exclude" title="Permalink to this definition"></a></dt>
+<dd><p>Omit accounts whose name match the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times.
+Note that --exclude takes precedence over --include</p>
+</div></blockquote>
+</dd></dl>
+
+<p><strong>Note:</strong> PATTERN supports the <code class="docutils literal notranslate"><span class="pre">*</span></code> and <code class="docutils literal notranslate"><span class="pre">?</span></code> wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountInfo.html" class="btn btn-neutral float-left" title="accountInfo" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountListAccesses.html" class="btn btn-neutral float-right" title="accountListAccesses" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountListAccesses.html b/plugins/restricted/accountListAccesses.html
new file mode 100644
index 000000000..bcaf607a0
--- /dev/null
+++ b/plugins/restricted/accountListAccesses.html
@@ -0,0 +1,232 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountListAccesses &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountListEgressKeys" href="accountListEgressKeys.html" />
+    <link rel="prev" title="accountList" href="accountList.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountListAccesses</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#view-the-expanded-access-list-of-a-given-bastion-account">View the expanded access list of a given bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountListAccesses</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountListAccesses.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountlistaccesses">
+<h1>accountListAccesses<a class="headerlink" href="#accountlistaccesses" title="Permalink to this headline"></a></h1>
+<section id="view-the-expanded-access-list-of-a-given-bastion-account">
+<h2>View the expanded access list of a given bastion account<a class="headerlink" href="#view-the-expanded-access-list-of-a-given-bastion-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountListAccesses --account ACCOUNT [--hide-groups] [--reverse-dns]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListAccesses-account">
+<span id="cmdoption-accountlistaccesses-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountListAccesses-account" title="Permalink to this definition"></a></dt>
+<dd><p>The account to work on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListAccesses-hide-groups">
+<span id="cmdoption-accountlistaccesses-hide-groups"></span><span class="sig-name descname"><span class="pre">--hide-groups</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountListAccesses-hide-groups" title="Permalink to this definition"></a></dt>
+<dd><p>Don't show the machines the accouns has access to through group rights.</p>
+<blockquote>
+<div><p>In other words, list only the account's personal accesses.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListAccesses-reverse-dns">
+<span id="cmdoption-accountlistaccesses-reverse-dns"></span><span class="sig-name descname"><span class="pre">--reverse-dns</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-accountListAccesses-reverse-dns" title="Permalink to this definition"></a></dt>
+<dd><p>Attempt to resolve the reverse hostnames (SLOW!)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListAccesses-include">
+<span id="cmdoption-accountlistaccesses-include"></span><span class="sig-name descname"><span class="pre">--include</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-accountListAccesses-include" title="Permalink to this definition"></a></dt>
+<dd><p>Only include accesses matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times to refine results</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListAccesses-exclude">
+<span id="cmdoption-accountlistaccesses-exclude"></span><span class="sig-name descname"><span class="pre">--exclude</span></span><span class="sig-prename descclassname"> <span class="pre">PATTERN</span></span><a class="headerlink" href="#cmdoption-accountListAccesses-exclude" title="Permalink to this definition"></a></dt>
+<dd><p>Omit accesses matching the given PATTERN (see below)</p>
+<blockquote>
+<div><p>This option can be used multiple times.
+Note that --exclude takes precedence over --include</p>
+</div></blockquote>
+</dd></dl>
+
+<p><strong>Note:</strong> PATTERN supports the <code class="docutils literal notranslate"><span class="pre">*</span></code> and <code class="docutils literal notranslate"><span class="pre">?</span></code> wildcards.
+If PATTERN is a simple string without wildcards, then names containing this string will be considered.
+The matching is done on the text output of the command.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountList.html" class="btn btn-neutral float-left" title="accountList" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountListEgressKeys.html" class="btn btn-neutral float-right" title="accountListEgressKeys" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountListEgressKeys.html b/plugins/restricted/accountListEgressKeys.html
new file mode 100644
index 000000000..daee881da
--- /dev/null
+++ b/plugins/restricted/accountListEgressKeys.html
@@ -0,0 +1,199 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountListEgressKeys &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountListIngressKeys" href="accountListIngressKeys.html" />
+    <link rel="prev" title="accountListAccesses" href="accountListAccesses.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountListEgressKeys</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-public-egress-keys-of-an-account">List the public egress keys of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountListEgressKeys</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountListEgressKeys.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountlistegresskeys">
+<h1>accountListEgressKeys<a class="headerlink" href="#accountlistegresskeys" title="Permalink to this headline"></a></h1>
+<section id="list-the-public-egress-keys-of-an-account">
+<h2>List the public egress keys of an account<a class="headerlink" href="#list-the-public-egress-keys-of-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountListEgressKeys --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListEgressKeys-account">
+<span id="cmdoption-accountlistegresskeys-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountListEgressKeys-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account to display the public egress keys of</p>
+</dd></dl>
+
+<p>The keys listed are the public egress SSH keys tied to this account.
+They can be used to gain access to another machine from this bastion,
+by putting one of those keys in the remote machine's <code class="docutils literal notranslate"><span class="pre">authorized_keys</span></code> file,
+and adding this account access to this machine with <code class="docutils literal notranslate"><span class="pre">accountAddPersonalAccess</span></code>.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountListAccesses.html" class="btn btn-neutral float-left" title="accountListAccesses" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountListIngressKeys.html" class="btn btn-neutral float-right" title="accountListIngressKeys" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountListIngressKeys.html b/plugins/restricted/accountListIngressKeys.html
new file mode 100644
index 000000000..ab39db110
--- /dev/null
+++ b/plugins/restricted/accountListIngressKeys.html
@@ -0,0 +1,198 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountListIngressKeys &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountListPasswords" href="accountListPasswords.html" />
+    <link rel="prev" title="accountListEgressKeys" href="accountListEgressKeys.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountListIngressKeys</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-public-ingress-keys-of-an-account">List the public ingress keys of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountListIngressKeys</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountListIngressKeys.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountlistingresskeys">
+<h1>accountListIngressKeys<a class="headerlink" href="#accountlistingresskeys" title="Permalink to this headline"></a></h1>
+<section id="list-the-public-ingress-keys-of-an-account">
+<h2>List the public ingress keys of an account<a class="headerlink" href="#list-the-public-ingress-keys-of-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountListIngressKeys --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListIngressKeys-account">
+<span id="cmdoption-accountlistingresskeys-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountListIngressKeys-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account to list the keys of</p>
+</dd></dl>
+
+<p>The keys listed are the public ingress SSH keys tied to this account.
+Their private counterpart should be detained only by this account's user,
+so that they can to authenticate themselves to this bastion.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountListEgressKeys.html" class="btn btn-neutral float-left" title="accountListEgressKeys" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountListPasswords.html" class="btn btn-neutral float-right" title="accountListPasswords" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountListPasswords.html b/plugins/restricted/accountListPasswords.html
new file mode 100644
index 000000000..449df0299
--- /dev/null
+++ b/plugins/restricted/accountListPasswords.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountListPasswords &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountMFAResetPassword" href="accountMFAResetPassword.html" />
+    <link rel="prev" title="accountListIngressKeys" href="accountListIngressKeys.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountListPasswords</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-an-account">List the hashes and metadata of the egress passwords associated to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountListPasswords</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountListPasswords.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountlistpasswords">
+<h1>accountListPasswords<a class="headerlink" href="#accountlistpasswords" title="Permalink to this headline"></a></h1>
+<section id="list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-an-account">
+<h2>List the hashes and metadata of the egress passwords associated to an account<a class="headerlink" href="#list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountListPasswords --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountListPasswords-account">
+<span id="cmdoption-accountlistpasswords-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountListPasswords-account" title="Permalink to this definition"></a></dt>
+<dd><p>The account name to work on</p>
+</dd></dl>
+
+<p>The passwords corresponding to these hashes are only needed for devices that don't support key-based SSH</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountListIngressKeys.html" class="btn btn-neutral float-left" title="accountListIngressKeys" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountMFAResetPassword.html" class="btn btn-neutral float-right" title="accountMFAResetPassword" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountMFAResetPassword.html b/plugins/restricted/accountMFAResetPassword.html
new file mode 100644
index 000000000..2d72c02a2
--- /dev/null
+++ b/plugins/restricted/accountMFAResetPassword.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountMFAResetPassword &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountMFAResetTOTP" href="accountMFAResetTOTP.html" />
+    <link rel="prev" title="accountListPasswords" href="accountListPasswords.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountMFAResetPassword</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-unix-password-of-an-account">Remove the UNIX password of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountMFAResetPassword</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountMFAResetPassword.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountmfaresetpassword">
+<h1>accountMFAResetPassword<a class="headerlink" href="#accountmfaresetpassword" title="Permalink to this headline"></a></h1>
+<section id="remove-the-unix-password-of-an-account">
+<h2>Remove the UNIX password of an account<a class="headerlink" href="#remove-the-unix-password-of-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountMFAResetPassword --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountMFAResetPassword-account">
+<span id="cmdoption-accountmfaresetpassword-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountMFAResetPassword-account" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which account you want to remove the UNIX password of</p>
+</dd></dl>
+
+<p>Note that if doesn't remove the account UNIX password requirement, if set (see <code class="docutils literal notranslate"><span class="pre">accountModify</span></code> for this)</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountListPasswords.html" class="btn btn-neutral float-left" title="accountListPasswords" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountMFAResetTOTP.html" class="btn btn-neutral float-right" title="accountMFAResetTOTP" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountMFAResetTOTP.html b/plugins/restricted/accountMFAResetTOTP.html
new file mode 100644
index 000000000..67c9bb773
--- /dev/null
+++ b/plugins/restricted/accountMFAResetTOTP.html
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountMFAResetTOTP &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountModify" href="accountModify.html" />
+    <link rel="prev" title="accountMFAResetPassword" href="accountMFAResetPassword.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountMFAResetTOTP</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-the-totp-configuration-of-an-account">Remove the TOTP configuration of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountMFAResetTOTP</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountMFAResetTOTP.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountmfaresettotp">
+<h1>accountMFAResetTOTP<a class="headerlink" href="#accountmfaresettotp" title="Permalink to this headline"></a></h1>
+<section id="remove-the-totp-configuration-of-an-account">
+<h2>Remove the TOTP configuration of an account<a class="headerlink" href="#remove-the-totp-configuration-of-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountMFAResetTOTP --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountMFAResetTOTP-account">
+<span id="cmdoption-accountmfaresettotp-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountMFAResetTOTP-account" title="Permalink to this definition"></a></dt>
+<dd><p>Specify which account you want to remove the TOTP configuration of</p>
+</dd></dl>
+
+<p>Note that if doesn't remove the TOTP requirement, if set (see <code class="docutils literal notranslate"><span class="pre">accountModify</span></code> for this).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountMFAResetPassword.html" class="btn btn-neutral float-left" title="accountMFAResetPassword" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountModify.html" class="btn btn-neutral float-right" title="accountModify" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountModify.html b/plugins/restricted/accountModify.html
new file mode 100644
index 000000000..539459a93
--- /dev/null
+++ b/plugins/restricted/accountModify.html
@@ -0,0 +1,289 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountModify &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountPIV" href="accountPIV.html" />
+    <link rel="prev" title="accountMFAResetTOTP" href="accountMFAResetTOTP.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountModify</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#modify-an-account-configuration">Modify an account configuration</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountModify</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountModify.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountmodify">
+<h1>accountModify<a class="headerlink" href="#accountmodify" title="Permalink to this headline"></a></h1>
+<section id="modify-an-account-configuration">
+<h2>Modify an account configuration<a class="headerlink" href="#modify-an-account-configuration" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountModify --account ACCOUNT [--option value [--option value [...]]]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-account">
+<span id="cmdoption-accountmodify-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountModify-account" title="Permalink to this definition"></a></dt>
+<dd><p>Bastion account to work on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-pam-auth-bypass">
+<span id="cmdoption-accountmodify-pam-auth-bypass"></span><span class="sig-name descname"><span class="pre">--pam-auth-bypass</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no</span></span><a class="headerlink" href="#cmdoption-accountModify-pam-auth-bypass" title="Permalink to this definition"></a></dt>
+<dd><p>Enable or disable PAM auth bypass for this account in addition to pubkey auth (default is 'no'),</p>
+<blockquote>
+<div><p>in that case sshd will not rely at all on PAM auth and /etc/pam.d/sshd configuration. This
+does not change the behaviour of the code, just the PAM auth handled by SSH itself</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-mfa-password-required">
+<span id="cmdoption-accountmodify-mfa-password-required"></span><span class="sig-name descname"><span class="pre">--mfa-password-required</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no|bypass</span></span><a class="headerlink" href="#cmdoption-accountModify-mfa-password-required" title="Permalink to this definition"></a></dt>
+<dd><p>Enable or disable UNIX password requirement for this account in addition to pubkey auth (default is 'no'),</p>
+<blockquote>
+<div><p>this overrides the global bastion configuration 'accountMFAPolicy'. If 'bypass' is specified,
+no password will ever be asked, even for groups or plugins explicitly requiring it</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-mfa-totp-required">
+<span id="cmdoption-accountmodify-mfa-totp-required"></span><span class="sig-name descname"><span class="pre">--mfa-totp-required</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no|bypass</span></span><a class="headerlink" href="#cmdoption-accountModify-mfa-totp-required" title="Permalink to this definition"></a></dt>
+<dd><p>Enable or disable TOTP requirement for this account in addition to pubkey auth (default is 'no'),</p>
+<blockquote>
+<div><p>this overrides the global bastion configuration 'accountMFAPolicy'. If 'bypass' is specified,
+no OTP will ever be asked, even for groups or plugins explicitly requiring it</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-egress-strict-host-key-checking">
+<span id="cmdoption-accountmodify-egress-strict-host-key-checking"></span><span class="sig-name descname"><span class="pre">--egress-strict-host-key-checking</span></span><span class="sig-prename descclassname"> <span class="pre">POLICY</span></span><a class="headerlink" href="#cmdoption-accountModify-egress-strict-host-key-checking" title="Permalink to this definition"></a></dt>
+<dd><p>Modify the egress SSH behavior of this account regarding <code class="docutils literal notranslate"><span class="pre">StrictHostKeyChecking</span></code> (see <cite>man ssh_config</cite>),</p>
+<blockquote>
+<div><p>POLICY can be 'yes', 'accept-new', 'no', 'ask', 'default' or 'bypass'.
+'bypass' means setting <code class="docutils literal notranslate"><span class="pre">StrictHostKeyChecking=no</span></code> and <code class="docutils literal notranslate"><span class="pre">UserKnownHostsFile=/dev/null</span></code>,
+which will permit egress connections in all cases, even when host keys change all the time on the same target.
+This effectively suppress the host key checking entirely. Please don't enable this blindly.
+'default' will remove this account's <code class="docutils literal notranslate"><span class="pre">StrictHostKeyChecking</span></code> setting override.
+All the other policies carry the same meaning that what is documented in <cite>man ssh_config</cite>.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-personal-egress-mfa-required">
+<span id="cmdoption-accountmodify-personal-egress-mfa-required"></span><span class="sig-name descname"><span class="pre">--personal-egress-mfa-required</span></span><span class="sig-prename descclassname"> <span class="pre">POLICY</span></span><a class="headerlink" href="#cmdoption-accountModify-personal-egress-mfa-required" title="Permalink to this definition"></a></dt>
+<dd><p>Enforce UNIX password requirement, or TOTP requirement, or any MFA requirement, when connecting to a server</p>
+<blockquote>
+<div><p>using the personal keys of the account, POLICY can be 'password', 'totp', 'any' or 'none'</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-always-active">
+<span id="cmdoption-accountmodify-always-active"></span><span class="sig-name descname"><span class="pre">--always-active</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no</span></span><a class="headerlink" href="#cmdoption-accountModify-always-active" title="Permalink to this definition"></a></dt>
+<dd><p>Set or unset the account as always active (i.e. disable the check of the 'active' status on this account)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-idle-ignore">
+<span id="cmdoption-accountmodify-idle-ignore"></span><span class="sig-name descname"><span class="pre">--idle-ignore</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no</span></span><a class="headerlink" href="#cmdoption-accountModify-idle-ignore" title="Permalink to this definition"></a></dt>
+<dd><p>If enabled, this account is immune to the idleLockTimeout and idleKillTimeout bastion-wide policy</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-max-inactive-days">
+<span id="cmdoption-accountmodify-max-inactive-days"></span><span class="sig-name descname"><span class="pre">--max-inactive-days</span></span><span class="sig-prename descclassname"> <span class="pre">DAYS</span></span><a class="headerlink" href="#cmdoption-accountModify-max-inactive-days" title="Permalink to this definition"></a></dt>
+<dd><p>Set account expiration policy, overriding the global bastion configuration 'accountMaxInactiveDays'.</p>
+<blockquote>
+<div><p>Setting this option to zero disables account expiration. Setting this option to -1 removes this account
+expiration policy, i.e. the global bastion setting will apply.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-osh-only">
+<span id="cmdoption-accountmodify-osh-only"></span><span class="sig-name descname"><span class="pre">--osh-only</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no</span></span><a class="headerlink" href="#cmdoption-accountModify-osh-only" title="Permalink to this definition"></a></dt>
+<dd><p>If enabled, this account can only use <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands, and can't connect anywhere through the bastion</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountModify-pubkey-auth-optional">
+<span id="cmdoption-accountmodify-pubkey-auth-optional"></span><span class="sig-name descname"><span class="pre">--pubkey-auth-optional</span></span><span class="sig-prename descclassname"> <span class="pre">yes|no</span></span><a class="headerlink" href="#cmdoption-accountModify-pubkey-auth-optional" title="Permalink to this definition"></a></dt>
+<dd><p>Make the public key optional on ingress for the account (default is 'no').</p>
+<blockquote>
+<div><p>When enabled the public key part of the authentication becomes optional when a password and/or TOTP is defined,
+allowing to login with just the password/TOTP. If no password/TOTP is defined then the public key is the only way to authenticate,
+because some form of authentication is always required.
+When disabled, the public key is always required.
+Egress is not affected.</p>
+</div></blockquote>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountMFAResetTOTP.html" class="btn btn-neutral float-left" title="accountMFAResetTOTP" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountPIV.html" class="btn btn-neutral float-right" title="accountPIV" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountPIV.html b/plugins/restricted/accountPIV.html
new file mode 100644
index 000000000..63dc8f995
--- /dev/null
+++ b/plugins/restricted/accountPIV.html
@@ -0,0 +1,233 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountPIV &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountRevokeCommand" href="accountRevokeCommand.html" />
+    <link rel="prev" title="accountModify" href="accountModify.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountPIV</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#modify-the-piv-policy-for-the-ingress-keys-of-an-account">Modify the PIV policy for the ingress keys of an account</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#possible-policy-values">Possible POLICY values:</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountPIV</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountPIV.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountpiv">
+<h1>accountPIV<a class="headerlink" href="#accountpiv" title="Permalink to this headline"></a></h1>
+<section id="modify-the-piv-policy-for-the-ingress-keys-of-an-account">
+<h2>Modify the PIV policy for the ingress keys of an account<a class="headerlink" href="#modify-the-piv-policy-for-the-ingress-keys-of-an-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountPIV --account ACCOUNT --policy &lt;default|enforce|never|grace --ttl SECONDS|DURATION&gt;</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountPIV-account">
+<span id="cmdoption-accountpiv-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountPIV-account" title="Permalink to this definition"></a></dt>
+<dd><p>Bastion account to work on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountPIV-policy">
+<span id="cmdoption-accountpiv-policy"></span><span class="sig-name descname"><span class="pre">--policy</span></span><span class="sig-prename descclassname">&#160; <span class="pre">POLICY</span></span><a class="headerlink" href="#cmdoption-accountPIV-policy" title="Permalink to this definition"></a></dt>
+<dd><p>Changes the PIV policy of account. See below for a description of available policies.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountPIV-ttl">
+<span id="cmdoption-accountpiv-ttl"></span><span class="sig-name descname"><span class="pre">--ttl</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS|DURATION</span></span><a class="headerlink" href="#cmdoption-accountPIV-ttl" title="Permalink to this definition"></a></dt>
+<dd><p>For the <code class="docutils literal notranslate"><span class="pre">grace</span></code> policy, amount of time after which the account will automatically revert</p>
+<blockquote>
+<div><p>to its previous policy (amount of seconds, or duration string such as &quot;4d12h15m&quot;).</p>
+</div></blockquote>
+</dd></dl>
+
+<section id="possible-policy-values">
+<h3>Possible POLICY values:<a class="headerlink" href="#possible-policy-values" title="Permalink to this headline"></a></h3>
+<dl class="simple">
+<dt>default</dt><dd><p>No specific policy is defined for this account, the default bastion policy applies (see the <a class="reference internal" href="../../administration/configuration/bastion_conf.html#ingressrequirepiv"><span class="std std-ref">ingressRequirePIV</span></a> global option).</p>
+</dd>
+<dt>enforce</dt><dd><p>Only verified PIV keys can be added as ingress SSH keys for this account. Note that setting the policy to <code class="docutils literal notranslate"><span class="pre">enforce</span></code> also immediately
+disables any non-PIV keys from the account's ingress keys. If no valid PIV key is found, this in effect disables all the keys of said
+account, preventing connection. The disabled keys are still kept so that setting back the policy to <code class="docutils literal notranslate"><span class="pre">default</span></code> or <code class="docutils literal notranslate"><span class="pre">never</span></code> does restore
+the non-PIV keys.</p>
+</dd>
+<dt>never</dt><dd><p>Regardless of the global configuration of the bastion (see the <a class="reference internal" href="../../administration/configuration/bastion_conf.html#ingressrequirepiv"><span class="std std-ref">ingressRequirePIV</span></a> global option), this account will never be required
+to use only PIV keys. This can be needed for a non-human account if PIV is enabled bastion-wide.</p>
+</dd>
+<dt>grace</dt><dd><p>enables temporary deactivation of PIV enforcement on this account. This is only meaningful when the policy is already set to <code class="docutils literal notranslate"><span class="pre">enforce</span></code>
+for this account, or if the global <a class="reference internal" href="../../administration/configuration/bastion_conf.html#ingressrequirepiv"><span class="std std-ref">ingressRequirePIV</span></a> option is set to true. This policy requires the use of the <code class="docutils literal notranslate"><span class="pre">--ttl</span></code> option to
+specify how much time the policy will be relaxed for this account before going back to its previous policy automatically. This can be
+useful when people forget their PIV-enabled hardware token and you don't want to send them back home.</p>
+</dd>
+</dl>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountModify.html" class="btn btn-neutral float-left" title="accountModify" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountRevokeCommand.html" class="btn btn-neutral float-right" title="accountRevokeCommand" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountRevokeCommand.html b/plugins/restricted/accountRevokeCommand.html
new file mode 100644
index 000000000..14d56ac8b
--- /dev/null
+++ b/plugins/restricted/accountRevokeCommand.html
@@ -0,0 +1,201 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountRevokeCommand &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountUnexpire" href="accountUnexpire.html" />
+    <link rel="prev" title="accountPIV" href="accountPIV.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountRevokeCommand</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#revoke-access-to-a-restricted-command">Revoke access to a restricted command</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountRevokeCommand</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountRevokeCommand.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountrevokecommand">
+<h1>accountRevokeCommand<a class="headerlink" href="#accountrevokecommand" title="Permalink to this headline"></a></h1>
+<section id="revoke-access-to-a-restricted-command">
+<h2>Revoke access to a restricted command<a class="headerlink" href="#revoke-access-to-a-restricted-command" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountRevokeCommand --account ACCOUNT --command COMMAND</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountRevokeCommand-account">
+<span id="cmdoption-accountrevokecommand-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountRevokeCommand-account" title="Permalink to this definition"></a></dt>
+<dd><p>Bastion account to work on</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountRevokeCommand-command">
+<span id="cmdoption-accountrevokecommand-command"></span><span class="sig-name descname"><span class="pre">--command</span></span><span class="sig-prename descclassname"> <span class="pre">COMMAND</span></span><a class="headerlink" href="#cmdoption-accountRevokeCommand-command" title="Permalink to this definition"></a></dt>
+<dd><p>The name of the OSH plugin to revoke access to (omit to get the list)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountPIV.html" class="btn btn-neutral float-left" title="accountPIV" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountUnexpire.html" class="btn btn-neutral float-right" title="accountUnexpire" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountUnexpire.html b/plugins/restricted/accountUnexpire.html
new file mode 100644
index 000000000..d0a68440d
--- /dev/null
+++ b/plugins/restricted/accountUnexpire.html
@@ -0,0 +1,197 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountUnexpire &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountUnfreeze" href="accountUnfreeze.html" />
+    <link rel="prev" title="accountRevokeCommand" href="accountRevokeCommand.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountUnexpire</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#unexpire-an-inactivity-expired-account">Unexpire an inactivity-expired account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountUnexpire</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountUnexpire.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountunexpire">
+<h1>accountUnexpire<a class="headerlink" href="#accountunexpire" title="Permalink to this headline"></a></h1>
+<section id="unexpire-an-inactivity-expired-account">
+<h2>Unexpire an inactivity-expired account<a class="headerlink" href="#unexpire-an-inactivity-expired-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountUnexpire --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountUnexpire-account">
+<span id="cmdoption-accountunexpire-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountUnexpire-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account to work on</p>
+</dd></dl>
+
+<p>When the bastion is configured to expire accounts that haven't been seen in a while,
+this command can be used to activate them back.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountRevokeCommand.html" class="btn btn-neutral float-left" title="accountRevokeCommand" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountUnfreeze.html" class="btn btn-neutral float-right" title="accountUnfreeze" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountUnfreeze.html b/plugins/restricted/accountUnfreeze.html
new file mode 100644
index 000000000..52e11fcb6
--- /dev/null
+++ b/plugins/restricted/accountUnfreeze.html
@@ -0,0 +1,195 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountUnfreeze &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountUnlock" href="accountUnlock.html" />
+    <link rel="prev" title="accountUnexpire" href="accountUnexpire.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountUnfreeze</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#unfreeze-a-frozen-account">Unfreeze a frozen account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountUnfreeze</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountUnfreeze.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountunfreeze">
+<h1>accountUnfreeze<a class="headerlink" href="#accountunfreeze" title="Permalink to this headline"></a></h1>
+<section id="unfreeze-a-frozen-account">
+<h2>Unfreeze a frozen account<a class="headerlink" href="#unfreeze-a-frozen-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountUnfreeze --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountUnfreeze-account">
+<span id="cmdoption-accountunfreeze-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountUnfreeze-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account to unfreeze</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountUnexpire.html" class="btn btn-neutral float-left" title="accountUnexpire" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountUnlock.html" class="btn btn-neutral float-right" title="accountUnlock" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/accountUnlock.html b/plugins/restricted/accountUnlock.html
new file mode 100644
index 000000000..a24e11b6c
--- /dev/null
+++ b/plugins/restricted/accountUnlock.html
@@ -0,0 +1,195 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>accountUnlock &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupCreate" href="groupCreate.html" />
+    <link rel="prev" title="accountUnfreeze" href="accountUnfreeze.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">accountUnlock</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#unlock-an-account-locked-by-pam-tally-pam-tally2-or-pam-faillock">Unlock an account locked by pam_tally, pam_tally2 or pam_faillock</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>accountUnlock</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/accountUnlock.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="accountunlock">
+<h1>accountUnlock<a class="headerlink" href="#accountunlock" title="Permalink to this headline"></a></h1>
+<section id="unlock-an-account-locked-by-pam-tally-pam-tally2-or-pam-faillock">
+<h2>Unlock an account locked by pam_tally, pam_tally2 or pam_faillock<a class="headerlink" href="#unlock-an-account-locked-by-pam-tally-pam-tally2-or-pam-faillock" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh accountUnlock --account ACCOUNT</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-accountUnlock-account">
+<span id="cmdoption-accountunlock-account"></span><span class="sig-name descname"><span class="pre">--account</span></span><span class="sig-prename descclassname"> <span class="pre">ACCOUNT</span></span><a class="headerlink" href="#cmdoption-accountUnlock-account" title="Permalink to this definition"></a></dt>
+<dd><p>Account to work on</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountUnfreeze.html" class="btn btn-neutral float-left" title="accountUnfreeze" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupCreate.html" class="btn btn-neutral float-right" title="groupCreate" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/groupCreate.html b/plugins/restricted/groupCreate.html
new file mode 100644
index 000000000..27f92af77
--- /dev/null
+++ b/plugins/restricted/groupCreate.html
@@ -0,0 +1,241 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupCreate &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="groupDelete" href="groupDelete.html" />
+    <link rel="prev" title="accountUnlock" href="accountUnlock.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupCreate</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#create-a-group">Create a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>groupCreate</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/groupCreate.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupcreate">
+<h1>groupCreate<a class="headerlink" href="#groupcreate" title="Permalink to this headline"></a></h1>
+<section id="create-a-group">
+<h2>Create a group<a class="headerlink" href="#create-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupCreate --group GROUP --owner ACCOUNT &lt;--algo ALGO --size SIZE [--encrypted]|--no-key&gt;</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupCreate-group">
+<span id="cmdoption-groupcreate-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupCreate-group" title="Permalink to this definition"></a></dt>
+<dd><p>Group name to create</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupCreate-owner">
+<span id="cmdoption-groupcreate-owner"></span><span class="sig-name descname"><span class="pre">--owner</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupCreate-owner" title="Permalink to this definition"></a></dt>
+<dd><p>Preexisting bastion account to assign as owner (can be you)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupCreate-encrypted">
+<span id="cmdoption-groupcreate-encrypted"></span><span class="sig-name descname"><span class="pre">--encrypted</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupCreate-encrypted" title="Permalink to this definition"></a></dt>
+<dd><p>Add a passphrase to the key. Beware that you'll have to enter it for each use.</p>
+<blockquote>
+<div><p>Do NOT add the passphrase after this option, you'll be prompted interactively for it.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupCreate-algo">
+<span id="cmdoption-groupcreate-algo"></span><span class="sig-name descname"><span class="pre">--algo</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupCreate-algo" title="Permalink to this definition"></a></dt>
+<dd><p>Specifies the algo of the key, either rsa, ecdsa or ed25519.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupCreate-size">
+<span id="cmdoption-groupcreate-size"></span><span class="sig-name descname"><span class="pre">--size</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupCreate-size" title="Permalink to this definition"></a></dt>
+<dd><p>Specifies the size of the key to be generated.</p>
+<blockquote>
+<div><p>For RSA, choose between 2048 and 8192 (4096 is good).
+For ECDSA, choose either 256, 384 or 521.
+For ED25519, size is always 256.</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupCreate-no-key">
+<span id="cmdoption-groupcreate-no-key"></span><span class="sig-name descname"><span class="pre">--no-key</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupCreate-no-key" title="Permalink to this definition"></a></dt>
+<dd><p>Don't generate an egress SSH key at all for this group</p>
+</dd></dl>
+
+<p>A quick overview of the different algorithms:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Ed25519      : robustness[###] speed[###]
+ECDSA        : robustness[##.] speed[###]
+RSA          : robustness[#..] speed[#..]
+</pre></div>
+</div>
+<p>This table is meant as a quick cheat-sheet, you're warmly advised to do
+your own research, as other constraints may apply to your environment.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="accountUnlock.html" class="btn btn-neutral float-left" title="accountUnlock" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="groupDelete.html" class="btn btn-neutral float-right" title="groupDelete" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/groupDelete.html b/plugins/restricted/groupDelete.html
new file mode 100644
index 000000000..b538469dd
--- /dev/null
+++ b/plugins/restricted/groupDelete.html
@@ -0,0 +1,203 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>groupDelete &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="realmCreate" href="realmCreate.html" />
+    <link rel="prev" title="groupCreate" href="groupCreate.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">groupDelete</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#delete-a-group">Delete a group</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>groupDelete</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/groupDelete.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="groupdelete">
+<h1>groupDelete<a class="headerlink" href="#groupdelete" title="Permalink to this headline"></a></h1>
+<section id="delete-a-group">
+<h2>Delete a group<a class="headerlink" href="#delete-a-group" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh groupDelete --group GROUP</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelete-group">
+<span id="cmdoption-groupdelete-group"></span><span class="sig-name descname"><span class="pre">--group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-groupDelete-group" title="Permalink to this definition"></a></dt>
+<dd><p>Group name to delete</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-groupDelete-no-confirm">
+<span id="cmdoption-groupdelete-no-confirm"></span><span class="sig-name descname"><span class="pre">--no-confirm</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-groupDelete-no-confirm" title="Permalink to this definition"></a></dt>
+<dd><p>Skip group name confirmation, but blame yourself if you deleted the wrong group!</p>
+</dd></dl>
+
+<p>This restricted command is able to delete any group. Group owners can however delete
+their own groups using the sibling <cite>groupDestroy</cite> command.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupCreate.html" class="btn btn-neutral float-left" title="groupCreate" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="realmCreate.html" class="btn btn-neutral float-right" title="realmCreate" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/index.html b/plugins/restricted/index.html
new file mode 100644
index 000000000..3a7d92be0
--- /dev/null
+++ b/plugins/restricted/index.html
@@ -0,0 +1,321 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>restricted plugins &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="accountAddPersonalAccess" href="accountAddPersonalAccess.html" />
+    <link rel="prev" title="unlock" href="../open/unlock.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">restricted plugins</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>restricted plugins</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="restricted-plugins">
+<h1>restricted plugins<a class="headerlink" href="#restricted-plugins" title="Permalink to this headline"></a></h1>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html#add-a-personal-server-access-to-an-account">Add a personal server access to an account</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html#plugin-configuration">Plugin configuration</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="accountAddPersonalAccess.html#options">Options</a></li>
+<li class="toctree-l3"><a class="reference internal" href="accountAddPersonalAccess.html#example">Example</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountCreate.html">accountCreate</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html#create-a-new-bastion-account">Create a new bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html#remove-a-personal-server-access-from-an-account">Remove a personal server access from an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountDelete.html">accountDelete</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html#delete-an-account-from-the-bastion">Delete an account from the bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountFreeze.html">accountFreeze</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html#freeze-an-account-to-prevent-it-from-connecting">Freeze an account, to prevent it from connecting</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html#generate-a-new-egress-password-for-an-account">Generate a new egress password for an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html#grant-access-to-a-restricted-command">Grant access to a restricted command</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountInfo.html">accountInfo</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html#display-some-information-about-an-account">Display some information about an account</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html#usage-examples">Usage examples</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html#output-example">Output example</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountList.html">accountList</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html#list-the-bastion-accounts">List the bastion accounts</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html#view-the-expanded-access-list-of-a-given-bastion-account">View the expanded access list of a given bastion account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html#list-the-public-egress-keys-of-an-account">List the public egress keys of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html#list-the-public-ingress-keys-of-an-account">List the public ingress keys of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html#list-the-hashes-and-metadata-of-the-egress-passwords-associated-to-an-account">List the hashes and metadata of the egress passwords associated to an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html#remove-the-unix-password-of-an-account">Remove the UNIX password of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html#remove-the-totp-configuration-of-an-account">Remove the TOTP configuration of an account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountModify.html">accountModify</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html#modify-an-account-configuration">Modify an account configuration</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountPIV.html">accountPIV</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html#modify-the-piv-policy-for-the-ingress-keys-of-an-account">Modify the PIV policy for the ingress keys of an account</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="accountPIV.html#possible-policy-values">Possible POLICY values:</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html#revoke-access-to-a-restricted-command">Revoke access to a restricted command</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html#unexpire-an-inactivity-expired-account">Unexpire an inactivity-expired account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html#unfreeze-a-frozen-account">Unfreeze a frozen account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="accountUnlock.html">accountUnlock</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html#unlock-an-account-locked-by-pam-tally-pam-tally2-or-pam-faillock">Unlock an account locked by pam_tally, pam_tally2 or pam_faillock</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupCreate.html">groupCreate</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html#create-a-group">Create a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="groupDelete.html">groupDelete</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html#delete-a-group">Delete a group</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="realmCreate.html">realmCreate</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html#declare-and-create-a-new-trusted-realm">Declare and create a new trusted realm</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="realmDelete.html">realmDelete</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html#delete-a-bastion-realm">Delete a bastion realm</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="realmInfo.html">realmInfo</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html#display-information-about-a-bastion-realm">Display information about a bastion realm</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="realmList.html">realmList</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html#list-the-bastions-realms">List the bastions realms</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html#list-the-public-keys-to-connect-as-root-on-this-bastion">List the public keys to connect as root on this bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html#add-a-personal-server-access-on-your-account">Add a personal server access on your account</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html#plugin-configuration">Plugin configuration</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="selfAddPersonalAccess.html#options">Options</a></li>
+<li class="toctree-l3"><a class="reference internal" href="selfAddPersonalAccess.html#example">Example</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html#remove-a-personal-server-access-from-your-account">Remove a personal server access from your account</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html#list-the-accounts-that-have-access-to-a-given-server">List the accounts that have access to a given server</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../open/unlock.html" class="btn btn-neutral float-left" title="unlock" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="accountAddPersonalAccess.html" class="btn btn-neutral float-right" title="accountAddPersonalAccess" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/realmCreate.html b/plugins/restricted/realmCreate.html
new file mode 100644
index 000000000..84124d0bf
--- /dev/null
+++ b/plugins/restricted/realmCreate.html
@@ -0,0 +1,219 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>realmCreate &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="realmDelete" href="realmDelete.html" />
+    <link rel="prev" title="groupDelete" href="groupDelete.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">realmCreate</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#declare-and-create-a-new-trusted-realm">Declare and create a new trusted realm</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>realmCreate</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/realmCreate.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="realmcreate">
+<h1>realmCreate<a class="headerlink" href="#realmcreate" title="Permalink to this headline"></a></h1>
+<section id="declare-and-create-a-new-trusted-realm">
+<h2>Declare and create a new trusted realm<a class="headerlink" href="#declare-and-create-a-new-trusted-realm" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh realmCreate --realm REALM --from IP1,IP2 [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmCreate-realm">
+<span id="cmdoption-realmcreate-realm"></span><span class="sig-name descname"><span class="pre">--realm</span></span><span class="sig-prename descclassname">&#160;&#160; <span class="pre">REALM</span></span><a class="headerlink" href="#cmdoption-realmCreate-realm" title="Permalink to this definition"></a></dt>
+<dd><p>Realm name to create</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmCreate-comment">
+<span id="cmdoption-realmcreate-comment"></span><span class="sig-name descname"><span class="pre">--comment</span></span><span class="sig-prename descclassname"> <span class="pre">STRING</span></span><a class="headerlink" href="#cmdoption-realmCreate-comment" title="Permalink to this definition"></a></dt>
+<dd><p>An optional comment when creating the realm. Double-quote if you're under a shell.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmCreate-from">
+<span id="cmdoption-realmcreate-from"></span><span class="sig-name descname"><span class="pre">--from</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-realmCreate-from" title="Permalink to this definition"></a></dt>
+<dd><p>IP1,IP2   Comma-separated list of outgoing IPs used by the realm we're declaring (i.e. IPs used by the bastion(s) on the other side)</p>
+<blockquote>
+<div><p>the expected format is the one used by the from=&quot;&quot; directive on SSH keys (IP and prefixes are supported)</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmCreate-public-key">
+<span id="cmdoption-realmcreate-public-key"></span><span class="sig-name descname"><span class="pre">--public-key</span></span><span class="sig-prename descclassname"> <span class="pre">KEY</span></span><a class="headerlink" href="#cmdoption-realmCreate-public-key" title="Permalink to this definition"></a></dt>
+<dd><p>Public SSH key to deposit on the bastion to access this realm. If not present,</p>
+<blockquote>
+<div><p>you'll be prompted interactively for it. Use double-quoting if your're under a shell.</p>
+</div></blockquote>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="groupDelete.html" class="btn btn-neutral float-left" title="groupDelete" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="realmDelete.html" class="btn btn-neutral float-right" title="realmDelete" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/realmDelete.html b/plugins/restricted/realmDelete.html
new file mode 100644
index 000000000..dd438360a
--- /dev/null
+++ b/plugins/restricted/realmDelete.html
@@ -0,0 +1,195 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>realmDelete &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="realmInfo" href="realmInfo.html" />
+    <link rel="prev" title="realmCreate" href="realmCreate.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">realmDelete</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#delete-a-bastion-realm">Delete a bastion realm</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>realmDelete</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/realmDelete.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="realmdelete">
+<h1>realmDelete<a class="headerlink" href="#realmdelete" title="Permalink to this headline"></a></h1>
+<section id="delete-a-bastion-realm">
+<h2>Delete a bastion realm<a class="headerlink" href="#delete-a-bastion-realm" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh realmDelete --realm REALM</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmDelete-realm">
+<span id="cmdoption-realmdelete-realm"></span><span class="sig-name descname"><span class="pre">--realm</span></span><span class="sig-prename descclassname"> <span class="pre">REALM</span></span><a class="headerlink" href="#cmdoption-realmDelete-realm" title="Permalink to this definition"></a></dt>
+<dd><p>Name of the realm to delete</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="realmCreate.html" class="btn btn-neutral float-left" title="realmCreate" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="realmInfo.html" class="btn btn-neutral float-right" title="realmInfo" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/realmInfo.html b/plugins/restricted/realmInfo.html
new file mode 100644
index 000000000..5c6e93d91
--- /dev/null
+++ b/plugins/restricted/realmInfo.html
@@ -0,0 +1,195 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>realmInfo &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="realmList" href="realmList.html" />
+    <link rel="prev" title="realmDelete" href="realmDelete.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">realmInfo</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#display-information-about-a-bastion-realm">Display information about a bastion realm</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>realmInfo</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/realmInfo.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="realminfo">
+<h1>realmInfo<a class="headerlink" href="#realminfo" title="Permalink to this headline"></a></h1>
+<section id="display-information-about-a-bastion-realm">
+<h2>Display information about a bastion realm<a class="headerlink" href="#display-information-about-a-bastion-realm" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh realmInfo --realm REALM</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmInfo-realm">
+<span id="cmdoption-realminfo-realm"></span><span class="sig-name descname"><span class="pre">--realm</span></span><span class="sig-prename descclassname"> <span class="pre">REALM</span></span><a class="headerlink" href="#cmdoption-realmInfo-realm" title="Permalink to this definition"></a></dt>
+<dd><p>Name of the realm to show info about</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="realmDelete.html" class="btn btn-neutral float-left" title="realmDelete" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="realmList.html" class="btn btn-neutral float-right" title="realmList" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/realmList.html b/plugins/restricted/realmList.html
new file mode 100644
index 000000000..3517adbb3
--- /dev/null
+++ b/plugins/restricted/realmList.html
@@ -0,0 +1,195 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>realmList &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="rootListIngressKeys" href="rootListIngressKeys.html" />
+    <link rel="prev" title="realmInfo" href="realmInfo.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">realmList</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-bastions-realms">List the bastions realms</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>realmList</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/realmList.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="realmlist">
+<h1>realmList<a class="headerlink" href="#realmlist" title="Permalink to this headline"></a></h1>
+<section id="list-the-bastions-realms">
+<h2>List the bastions realms<a class="headerlink" href="#list-the-bastions-realms" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh realmList [--realm REALM]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-realmList-realm">
+<span id="cmdoption-realmlist-realm"></span><span class="sig-name descname"><span class="pre">--realm</span></span><span class="sig-prename descclassname"> <span class="pre">REALM</span></span><a class="headerlink" href="#cmdoption-realmList-realm" title="Permalink to this definition"></a></dt>
+<dd><p>Only list the specified realm (mainly: check if it exists)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="realmInfo.html" class="btn btn-neutral float-left" title="realmInfo" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="rootListIngressKeys.html" class="btn btn-neutral float-right" title="rootListIngressKeys" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/rootListIngressKeys.html b/plugins/restricted/rootListIngressKeys.html
new file mode 100644
index 000000000..f6db5560d
--- /dev/null
+++ b/plugins/restricted/rootListIngressKeys.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>rootListIngressKeys &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfAddPersonalAccess" href="selfAddPersonalAccess.html" />
+    <link rel="prev" title="realmList" href="realmList.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">rootListIngressKeys</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-public-keys-to-connect-as-root-on-this-bastion">List the public keys to connect as root on this bastion</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>rootListIngressKeys</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/rootListIngressKeys.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="rootlistingresskeys">
+<h1>rootListIngressKeys<a class="headerlink" href="#rootlistingresskeys" title="Permalink to this headline"></a></h1>
+<section id="list-the-public-keys-to-connect-as-root-on-this-bastion">
+<h2>List the public keys to connect as root on this bastion<a class="headerlink" href="#list-the-public-keys-to-connect-as-root-on-this-bastion" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh rootListIngressKeys</p>
+</div>
+<p>This command is mainly useful for auditability purposes.
+As it gives some information as to who can be root on the underlying system,
+please grant this command only to accounts that need to have this information.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="realmList.html" class="btn btn-neutral float-left" title="realmList" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfAddPersonalAccess.html" class="btn btn-neutral float-right" title="selfAddPersonalAccess" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/selfAddPersonalAccess.html b/plugins/restricted/selfAddPersonalAccess.html
new file mode 100644
index 000000000..49475acfd
--- /dev/null
+++ b/plugins/restricted/selfAddPersonalAccess.html
@@ -0,0 +1,304 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfAddPersonalAccess &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="selfDelPersonalAccess" href="selfDelPersonalAccess.html" />
+    <link rel="prev" title="rootListIngressKeys" href="rootListIngressKeys.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfAddPersonalAccess</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#add-a-personal-server-access-on-your-account">Add a personal server access on your account</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#plugin-configuration">Plugin configuration</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#options">Options</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#example">Example</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>selfAddPersonalAccess</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/selfAddPersonalAccess.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfaddpersonalaccess">
+<h1>selfAddPersonalAccess<a class="headerlink" href="#selfaddpersonalaccess" title="Permalink to this headline"></a></h1>
+<section id="add-a-personal-server-access-on-your-account">
+<h2>Add a personal server access on your account<a class="headerlink" href="#add-a-personal-server-access-on-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfAddPersonalAccess --host HOST [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-host">
+<span id="cmdoption-selfaddpersonalaccess-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">IP|HOST|IP/MASK</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-host" title="Permalink to this definition"></a></dt>
+<dd><p>Server to add access to</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-user">
+<span id="cmdoption-selfaddpersonalaccess-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-user" title="Permalink to this definition"></a></dt>
+<dd><p>Remote login to use, if you want to allow any login, use --user-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-user-any">
+<span id="cmdoption-selfaddpersonalaccess-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>Allow access with any remote login</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-port">
+<span id="cmdoption-selfaddpersonalaccess-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-port" title="Permalink to this definition"></a></dt>
+<dd><p>Remote SSH port to use, if you want to allow any port, use --port-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-port-any">
+<span id="cmdoption-selfaddpersonalaccess-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>Allow access to all remote ports</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-scpup">
+<span id="cmdoption-selfaddpersonalaccess-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>Allow SCP upload, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-scpdown">
+<span id="cmdoption-selfaddpersonalaccess-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>Allow SCP download, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-sftp">
+<span id="cmdoption-selfaddpersonalaccess-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>Allow usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-force">
+<span id="cmdoption-selfaddpersonalaccess-force"></span><span class="sig-name descname"><span class="pre">--force</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-force" title="Permalink to this definition"></a></dt>
+<dd><p>Add the access without checking that the public SSH key is properly installed remotely</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-force-key">
+<span id="cmdoption-selfaddpersonalaccess-force-key"></span><span class="sig-name descname"><span class="pre">--force-key</span></span><span class="sig-prename descclassname"> <span class="pre">FINGERPRINT</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-force-key" title="Permalink to this definition"></a></dt>
+<dd><p>Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-force-password">
+<span id="cmdoption-selfaddpersonalaccess-force-password"></span><span class="sig-name descname"><span class="pre">--force-password</span></span><span class="sig-prename descclassname"> <span class="pre">HASH</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-force-password" title="Permalink to this definition"></a></dt>
+<dd><p>Only use the password with the specified hash to connect to the server (cf selfListPasswords)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-ttl">
+<span id="cmdoption-selfaddpersonalaccess-ttl"></span><span class="sig-name descname"><span class="pre">--ttl</span></span><span class="sig-prename descclassname"> <span class="pre">SECONDS|DURATION</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-ttl" title="Permalink to this definition"></a></dt>
+<dd><p>Specify a number of seconds (or a duration string, such as &quot;1d7h8m&quot;) after which the access will automatically expire</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-comment">
+<span id="cmdoption-selfaddpersonalaccess-comment"></span><span class="sig-name descname"><span class="pre">--comment</span></span><span class="sig-prename descclassname"> <span class="pre">&quot;'ANY</span> <span class="pre">TEXT'&quot;</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-comment" title="Permalink to this definition"></a></dt>
+<dd><p>Add a comment alongside this server. Quote it twice as shown if you're under a shell.</p>
+</dd></dl>
+
+</section>
+<section id="plugin-configuration">
+<h2>Plugin configuration<a class="headerlink" href="#plugin-configuration" title="Permalink to this headline"></a></h2>
+<section id="options">
+<h3>Options<a class="headerlink" href="#options" title="Permalink to this headline"></a></h3>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix">
+<span id="cmdoption-selfaddpersonalaccess-arg-widest-v4-prefix"></span><span id="cmdoption-selfAddPersonalAccess-arg-integer"></span><span id="cmdoption-selfaddpersonalaccess-arg-integer"></span><span id="cmdoption-selfAddPersonalAccess-arg-between"></span><span id="cmdoption-selfaddpersonalaccess-arg-between"></span><span class="sig-name descname"><span class="pre">widest_v4_prefix</span></span><span class="sig-prename descclassname"> <span class="pre">(optional</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">integer</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">between</span></span><span class="sig-prename descclassname"> <span class="pre">0</span> <span class="pre">and</span> <span class="pre">32)</span></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix" title="Permalink to this definition"></a></dt>
+<dd><p>When specified, this limits the size of prefixes that can be added to an
+ACL, e.g. 24 would not allow prefixes wider than /24 (such as /20 or
+/16).
+Note that this doesn't prevent users from adding thousands of ACLs to
+cover a wide range of networks, but this helps ensuring ACLs such as
+0.0.0.0/0 can't be added in a single command.</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfAddPersonalAccess-arg-self_remote_user_only">
+<span id="cmdoption-selfaddpersonalaccess-arg-self-remote-user-only"></span><span id="cmdoption-selfAddPersonalAccess-arg-boolean"></span><span id="cmdoption-selfaddpersonalaccess-arg-boolean"></span><span class="sig-name descname"><span class="pre">self_remote_user_only</span></span><span class="sig-prename descclassname"> <span class="pre">(optional</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">boolean)</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfAddPersonalAccess-arg-self_remote_user_only" title="Permalink to this definition"></a></dt>
+<dd><p>When true, this only allows to add ACLs with the remote user being the
+same than the account name, i.e. a bastion account named &quot;johndoe&quot; would
+only be able to use <code class="docutils literal notranslate"><span class="pre">selfAddPersonalAccess</span> <span class="pre">--user</span> <span class="pre">johndoe</span></code>.</p>
+</dd></dl>
+
+</section>
+<section id="example">
+<h3>Example<a class="headerlink" href="#example" title="Permalink to this headline"></a></h3>
+<p>Configuration, in JSON format, must be in <code class="file docutils literal notranslate"><span class="pre">/etc/bastion/plugin.selfAddPersonalAccess.conf</span></code>:</p>
+<div class="highlight-json notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="p">{</span><span class="w"> </span><span class="nt">&quot;widest_v4_prefix&quot;</span><span class="p">:</span><span class="w"> </span><span class="mi">24</span><span class="p">,</span><span class="w"> </span><span class="nt">&quot;self_remote_user_only&quot;</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
+</span></pre></div>
+</div>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="rootListIngressKeys.html" class="btn btn-neutral float-left" title="rootListIngressKeys" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="selfDelPersonalAccess.html" class="btn btn-neutral float-right" title="selfDelPersonalAccess" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/selfDelPersonalAccess.html b/plugins/restricted/selfDelPersonalAccess.html
new file mode 100644
index 000000000..f9929b168
--- /dev/null
+++ b/plugins/restricted/selfDelPersonalAccess.html
@@ -0,0 +1,237 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>selfDelPersonalAccess &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="whoHasAccessTo" href="whoHasAccessTo.html" />
+    <link rel="prev" title="selfAddPersonalAccess" href="selfAddPersonalAccess.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">selfDelPersonalAccess</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#remove-a-personal-server-access-from-your-account">Remove a personal server access from your account</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="whoHasAccessTo.html">whoHasAccessTo</a></li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>selfDelPersonalAccess</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/selfDelPersonalAccess.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="selfdelpersonalaccess">
+<h1>selfDelPersonalAccess<a class="headerlink" href="#selfdelpersonalaccess" title="Permalink to this headline"></a></h1>
+<section id="remove-a-personal-server-access-from-your-account">
+<h2>Remove a personal server access from your account<a class="headerlink" href="#remove-a-personal-server-access-from-your-account" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh selfDelPersonalAccess --host HOST [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-host">
+<span id="cmdoption-selfdelpersonalaccess-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">IP|HOST|IP/MASK</span></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-host" title="Permalink to this definition"></a></dt>
+<dd><p>Server to remove access from</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-user">
+<span id="cmdoption-selfdelpersonalaccess-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-user" title="Permalink to this definition"></a></dt>
+<dd><p>Remote user that was allowed, if any user was allowed, use --user-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-user-any">
+<span id="cmdoption-selfdelpersonalaccess-user-any"></span><span class="sig-name descname"><span class="pre">--user-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-user-any" title="Permalink to this definition"></a></dt>
+<dd><p>Use if any remote login was allowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-port">
+<span id="cmdoption-selfdelpersonalaccess-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-port" title="Permalink to this definition"></a></dt>
+<dd><p>Remote SSH port that was allowed, if any port was allowed, use --port-any</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-port-any">
+<span id="cmdoption-selfdelpersonalaccess-port-any"></span><span class="sig-name descname"><span class="pre">--port-any</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-port-any" title="Permalink to this definition"></a></dt>
+<dd><p>Use if any remote port was allowed</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-scpup">
+<span id="cmdoption-selfdelpersonalaccess-scpup"></span><span class="sig-name descname"><span class="pre">--scpup</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-scpup" title="Permalink to this definition"></a></dt>
+<dd><p>Remove SCP upload right, you--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-scpdown">
+<span id="cmdoption-selfdelpersonalaccess-scpdown"></span><span class="sig-name descname"><span class="pre">--scpdown</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-scpdown" title="Permalink to this definition"></a></dt>
+<dd><p>Remove SCP download right, you&lt;--bastion--server (omit --user in this case)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-selfDelPersonalAccess-sftp">
+<span id="cmdoption-selfdelpersonalaccess-sftp"></span><span class="sig-name descname"><span class="pre">--sftp</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-selfDelPersonalAccess-sftp" title="Permalink to this definition"></a></dt>
+<dd><p>Remove usage of the SFTP subsystem, you&lt;--bastion--&gt;server (omit --user in this case)</p>
+</dd></dl>
+
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfAddPersonalAccess.html" class="btn btn-neutral float-left" title="selfAddPersonalAccess" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="whoHasAccessTo.html" class="btn btn-neutral float-right" title="whoHasAccessTo" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/plugins/restricted/whoHasAccessTo.html b/plugins/restricted/whoHasAccessTo.html
new file mode 100644
index 000000000..5f8c4ede9
--- /dev/null
+++ b/plugins/restricted/whoHasAccessTo.html
@@ -0,0 +1,233 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>whoHasAccessTo &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="prev" title="selfDelPersonalAccess" href="selfDelPersonalAccess.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../open/index.html">open plugins</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">restricted plugins</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="accountAddPersonalAccess.html">accountAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountCreate.html">accountCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelPersonalAccess.html">accountDelPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountDelete.html">accountDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountFreeze.html">accountFreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGeneratePassword.html">accountGeneratePassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountGrantCommand.html">accountGrantCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountInfo.html">accountInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountList.html">accountList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListAccesses.html">accountListAccesses</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListEgressKeys.html">accountListEgressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListIngressKeys.html">accountListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountListPasswords.html">accountListPasswords</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetPassword.html">accountMFAResetPassword</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountMFAResetTOTP.html">accountMFAResetTOTP</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountModify.html">accountModify</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountPIV.html">accountPIV</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountRevokeCommand.html">accountRevokeCommand</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnexpire.html">accountUnexpire</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnfreeze.html">accountUnfreeze</a></li>
+<li class="toctree-l2"><a class="reference internal" href="accountUnlock.html">accountUnlock</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupCreate.html">groupCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="groupDelete.html">groupDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmCreate.html">realmCreate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmDelete.html">realmDelete</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmInfo.html">realmInfo</a></li>
+<li class="toctree-l2"><a class="reference internal" href="realmList.html">realmList</a></li>
+<li class="toctree-l2"><a class="reference internal" href="rootListIngressKeys.html">rootListIngressKeys</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfAddPersonalAccess.html">selfAddPersonalAccess</a></li>
+<li class="toctree-l2"><a class="reference internal" href="selfDelPersonalAccess.html">selfDelPersonalAccess</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">whoHasAccessTo</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#list-the-accounts-that-have-access-to-a-given-server">List the accounts that have access to a given server</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">restricted plugins</a> &raquo;</li>
+      <li>whoHasAccessTo</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/plugins/restricted/whoHasAccessTo.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="whohasaccessto">
+<h1>whoHasAccessTo<a class="headerlink" href="#whohasaccessto" title="Permalink to this headline"></a></h1>
+<section id="list-the-accounts-that-have-access-to-a-given-server">
+<h2>List the accounts that have access to a given server<a class="headerlink" href="#list-the-accounts-that-have-access-to-a-given-server" title="Permalink to this headline"></a></h2>
+<div class="cmdusage admonition">
+<p class="admonition-title">usage</p>
+<p>--osh whoHasAccessTo --host SERVER [OPTIONS]</p>
+</div>
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-whoHasAccessTo-host">
+<span id="cmdoption-whohasaccessto-host"></span><span class="sig-name descname"><span class="pre">--host</span></span><span class="sig-prename descclassname"> <span class="pre">SERVER</span></span><a class="headerlink" href="#cmdoption-whoHasAccessTo-host" title="Permalink to this definition"></a></dt>
+<dd><p>List declared accesses to this server</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-whoHasAccessTo-user">
+<span id="cmdoption-whohasaccessto-user"></span><span class="sig-name descname"><span class="pre">--user</span></span><span class="sig-prename descclassname"> <span class="pre">USER</span></span><a class="headerlink" href="#cmdoption-whoHasAccessTo-user" title="Permalink to this definition"></a></dt>
+<dd><p>Remote user allowed (if not specified, ignore user specifications)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-whoHasAccessTo-port">
+<span id="cmdoption-whohasaccessto-port"></span><span class="sig-name descname"><span class="pre">--port</span></span><span class="sig-prename descclassname"> <span class="pre">PORT</span></span><a class="headerlink" href="#cmdoption-whoHasAccessTo-port" title="Permalink to this definition"></a></dt>
+<dd><p>Remote port allowed (if not specified, ignore port specifications)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-whoHasAccessTo-ignore-personal">
+<span id="cmdoption-whohasaccessto-ignore-personal"></span><span class="sig-name descname"><span class="pre">--ignore-personal</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-whoHasAccessTo-ignore-personal" title="Permalink to this definition"></a></dt>
+<dd><p>Don't check accounts' personal accesses (i.e. only check groups)</p>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-whoHasAccessTo-ignore-group">
+<span id="cmdoption-whohasaccessto-ignore-group"></span><span class="sig-name descname"><span class="pre">--ignore-group</span></span><span class="sig-prename descclassname"> <span class="pre">GROUP</span></span><a class="headerlink" href="#cmdoption-whoHasAccessTo-ignore-group" title="Permalink to this definition"></a></dt>
+<dd><p>Ignore accesses by this group, if you know GROUP public key is in fact</p>
+<blockquote>
+<div><p>not present on remote server but bastion thinks it is</p>
+</div></blockquote>
+</dd></dl>
+
+<dl class="std option">
+<dt class="sig sig-object std" id="cmdoption-whoHasAccessTo-show-wildcards">
+<span id="cmdoption-whohasaccessto-show-wildcards"></span><span class="sig-name descname"><span class="pre">--show-wildcards</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-whoHasAccessTo-show-wildcards" title="Permalink to this definition"></a></dt>
+<dd><p>Also list accesses that match because 0.0.0.0/0 is listed in a group or private access,</p>
+<blockquote>
+<div><p>this is disabled by default because this is almost always just noise (see Note below)</p>
+</div></blockquote>
+</dd></dl>
+
+<p>Note: This list is what the bastion THINKS is true, which means that if some group has 0.0.0.0/0 in its list,
+then it'll show all the members of that group as having access to the machine you're specifying, through this group key.
+This is only true if the remote server does have the group key installed, of course, which the bastion
+can't tell without trying to connect &quot;right now&quot; (which it won't do).</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="selfDelPersonalAccess.html" class="btn btn-neutral float-left" title="selfDelPersonalAccess" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/presentation/features.html b/presentation/features.html
new file mode 100644
index 000000000..0af40e08d
--- /dev/null
+++ b/presentation/features.html
@@ -0,0 +1,176 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Features &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Security" href="security.html" />
+    <link rel="prev" title="Principles" href="principles.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="principles.html">Principles</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Features</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/presentation/features.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="features">
+<h1>Features<a class="headerlink" href="#features" title="Permalink to this headline"></a></h1>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This aims to be a quick overview of the main supported features of The Bastion, focusing on use cases.
+For a better introduction about the basic features, please refer to the front page of the documentation.</p>
+</div>
+<div class="admonition warning">
+<p class="admonition-title">Warning</p>
+<p>Documentation might not be present yet for all the features below.</p>
+</div>
+<ul class="simple">
+<li><p>Personal and group access schemes with group roles delegation to ensure teams autonomy without security trade-offs</p></li>
+<li><p>SSH protocol break between the ingress and egress connections (see other <a class="reference internal" href="security.html"><span class="doc">security measures</span></a>)</p></li>
+<li><p>Self-reliance achieved through virtually no external dependencies (see other <a class="reference internal" href="security.html"><span class="doc">security measures</span></a>)</p></li>
+<li><p>Interactive session recording (in standard <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code> files)</p></li>
+<li><p>Non-interactive session recording (<cite>stdout</cite> and <cite>stderr</cite> through <code class="docutils literal notranslate"><span class="pre">ttyrec</span></code>)</p></li>
+<li><p>Extensive logging support through <cite>syslog</cite> for easy SIEM consumption</p></li>
+<li><p>Supports <a class="reference external" href="https://github.com/mobile-shell/mosh">MOSH</a> on the ingress connection side</p></li>
+<li><p>Supports <code class="docutils literal notranslate"><span class="pre">scp</span></code> passthrough, to upload and/or download files from/to remote servers</p></li>
+<li><p>Supports <code class="docutils literal notranslate"><span class="pre">netconf</span></code> SSH subsystem passthrough</p></li>
+<li><p>Supports Yubico PIV keys
+<a class="reference external" href="https://developers.yubico.com/PIV/Introduction/Yubico_extensions.html">attestation checking</a> and enforcement
+on the ingress connection side</p></li>
+<li><p>Supports realms, to create a trust between two bastions of possibly two different companies,
+splitting the authentication and authorization phases while still enforcing local policies</p></li>
+<li><p>Supports SSH password autologin on the egress side for legacy devices not supporting pubkey authentication,
+while still forcing proper pubkey authentication on the ingress side</p></li>
+<li><p>Supports telnet password autologin on the egress side for ancient devices not supporting SSH,
+while still forcing proper SSH pubkey authentication on the ingress side</p></li>
+<li><p>Supports HTTPS proxying with man-in-the-middle authentication and authorization handling,
+for ingress and egress password decoupling (mainly useful for network device APIs)</p></li>
+</ul>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="principles.html" class="btn btn-neutral float-left" title="Principles" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="security.html" class="btn btn-neutral float-right" title="Security" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/presentation/principles.html b/presentation/principles.html
new file mode 100644
index 000000000..ef40fd6b9
--- /dev/null
+++ b/presentation/principles.html
@@ -0,0 +1,156 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Principles &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Features" href="features.html" />
+    <link rel="prev" title="Welcome to The Bastion documentation!" href="../index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Principles</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/presentation/principles.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="principles">
+<h1>Principles<a class="headerlink" href="#principles" title="Permalink to this headline"></a></h1>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>Most of the principles of The Bastion are well explained in the <strong>Part 2</strong> of the blog post
+that announced the release. The links are below.</p>
+</div>
+<ul class="simple">
+<li><p><a class="reference external" href="https://blog.ovhcloud.com/the-ovhcloud-bastion-part-1/">Part 1 - Genesis</a></p></li>
+<li><p><a class="reference external" href="https://blog.ovhcloud.com/the-ovhcloud-ssh-bastion-part-2-delegation-dizziness/">Part 2 - Delegation Dizziness</a></p></li>
+<li><p><a class="reference external" href="https://blog.ovhcloud.com/the-bastion-part-3-security-at-the-core/">Part 3 - Security at the Core</a></p></li>
+<li><p><a class="reference external" href="https://blog.ovhcloud.com/the-bastion-part-4-a-new-era/">Part 4 - A new era</a></p></li>
+</ul>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../index.html" class="btn btn-neutral float-left" title="Welcome to The Bastion documentation!" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="features.html" class="btn btn-neutral float-right" title="Features" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/presentation/security.html b/presentation/security.html
new file mode 100644
index 000000000..b7bd353d6
--- /dev/null
+++ b/presentation/security.html
@@ -0,0 +1,227 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Security &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="FAQ" href="../faq.html" />
+    <link rel="prev" title="Features" href="features.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="features.html">Features</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Security</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#security-principles-at-the-core">Security principles at the core</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#auditability">Auditability</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Security</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/presentation/security.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="security">
+<h1>Security<a class="headerlink" href="#security" title="Permalink to this headline"></a></h1>
+<section id="security-principles-at-the-core">
+<h2>Security principles at the core<a class="headerlink" href="#security-principles-at-the-core" title="Permalink to this headline"></a></h2>
+<p>Even with the most conservative, precautionous and paranoid coding process, code has bugs,
+so it shouldn't be trusted blindly. Hence the bastion doesn't trust its own code.
+It leverages the operating system security primitives to get additional security, as seen below.</p>
+<ul>
+<li><p>Uses the well-known and trusted UNIX Discretionary Access Control:</p>
+<blockquote>
+<div><ul class="simple">
+<li><p>Bastion users are mapped to actual system users</p></li>
+<li><p>Bastion groups are mapped to actual system groups</p></li>
+<li><p>All the code is constantly checking rights before allowing any action</p></li>
+<li><p>UNIX DAC is used as a safety belt to prevent an action from succeeding even if the code
+is tricked into allowing it</p></li>
+</ul>
+</div></blockquote>
+</li>
+<li><p>The bastion main script is declared as the bastion user's system shell:</p>
+<blockquote>
+<div><ul class="simple">
+<li><p>No user has real (<code class="docutils literal notranslate"><span class="pre">bash</span></code>-like) shell access on the system</p></li>
+<li><p>All code is ran under the unprivileged user's system account rights</p></li>
+<li><p>Even if a user could escape to a real shell, they wouldn't be able to connect to machines they don't have
+access to, because they don't have filesystem-level read access to the SSH keys</p></li>
+</ul>
+</div></blockquote>
+</li>
+<li><p>The code is modular</p>
+<blockquote>
+<div><ul>
+<li><p>The main code mainly checks rights, logs actions, and enable <code class="docutils literal notranslate"><span class="pre">ssh</span></code> access to other machines</p></li>
+<li><p>All side commands, called <strong>plugins</strong>, are in modules separated from the main code</p></li>
+<li><p>The modules can either be <strong>open</strong> or <strong>restricted</strong></p>
+<blockquote>
+<div><ul class="simple">
+<li><p>Only accounts that have been specifically granted on a need-to-use basis can run a specific restricted plugin</p></li>
+<li><p>This is checked by the code, and also enforced by UNIX DAC (the plugin is only readable and
+executable by the system group specific to the plugin)</p></li>
+</ul>
+</div></blockquote>
+</li>
+</ul>
+</div></blockquote>
+</li>
+<li><p>All the code needing extended system privileges is separated from the main code, in modules called <strong>helpers</strong></p>
+<blockquote>
+<div><ul class="simple">
+<li><p>Helpers are run exclusively under <code class="docutils literal notranslate"><span class="pre">sudo</span></code></p></li>
+<li><p>The <code class="docutils literal notranslate"><span class="pre">sudoers</span></code> configuration is attached to a system group specific to the command,
+which is granted to accounts on a need-to-use basis</p></li>
+<li><p>The helpers are only readable and executable by the system group specific to the command</p></li>
+<li><p>The helpers path and some of their immutable parameters are hardcoded in the <code class="docutils literal notranslate"><span class="pre">sudoers</span></code> configuration</p></li>
+<li><p>Perl tainted mode (<code class="docutils literal notranslate"><span class="pre">-T</span></code>) is used for all code running under <code class="docutils literal notranslate"><span class="pre">sudo</span></code>, preventing any user-input to
+interfere with the logic, by halting execution immediately</p></li>
+<li><p>Code running under <code class="docutils literal notranslate"><span class="pre">sudo</span></code> doesn't trust its caller and re-checks every input</p></li>
+<li><p>Communication between unprivileged and privileged-code are done using JSON</p></li>
+</ul>
+</div></blockquote>
+</li>
+</ul>
+</section>
+<section id="auditability">
+<h2>Auditability<a class="headerlink" href="#auditability" title="Permalink to this headline"></a></h2>
+<ul>
+<li><p>Bastion administrators must use the bastion's logic to connect to itself to administer it (or better,
+use another bastion to do so), this ensures auditability in all cases</p></li>
+<li><p>Every access and action (whether allowed or denied) is logged with:</p>
+<blockquote>
+<div><ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">syslog</span></code>, which should also be sent to a remote syslog server to ensure even
+bastion administrators can't tamper their tracks, and/or</p></li>
+<li><p>local <code class="docutils literal notranslate"><span class="pre">sqlite3</span></code> databases for easy searching</p></li>
+</ul>
+</div></blockquote>
+</li>
+<li><p>This code is used in production in several PCI-DSS, ISO 27001, SOC1 and SOC2 certified environments</p></li>
+</ul>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="features.html" class="btn btn-neutral float-left" title="Features" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../faq.html" class="btn btn-neutral float-right" title="FAQ" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/search.html b/search.html
new file mode 100644
index 000000000..1508ca7bb
--- /dev/null
+++ b/search.html
@@ -0,0 +1,156 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Search &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="_static/css/thebastion.css" type="text/css" />
+    
+  
+        <script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
+        <script src="_static/jquery.js"></script>
+        <script src="_static/underscore.js"></script>
+        <script src="_static/doctools.js"></script>
+    <script src="_static/js/theme.js"></script>
+    <script src="_static/searchtools.js"></script>
+    <script src="_static/language_data.js"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="#" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="#" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="using/basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="using/specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Search</li>
+      <li class="wy-breadcrumbs-aside">
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <noscript>
+  <div id="fallback" class="admonition warning">
+    <p class="last">
+      Please activate JavaScript to enable the search functionality.
+    </p>
+  </div>
+  </noscript>
+
+  
+  <div id="search-results">
+  
+  </div>
+
+           </div>
+          </div>
+          <footer>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script>
+  <script>
+    jQuery(function() { Search.loadIndex("searchindex.js"); });
+  </script>
+  
+  <script id="searchindexloader"></script>
+   
+
+
+</body>
+</html>
\ No newline at end of file
diff --git a/searchindex.js b/searchindex.js
new file mode 100644
index 000000000..3988ddeac
--- /dev/null
+++ b/searchindex.js
@@ -0,0 +1 @@
+Search.setIndex({docnames:["administration/configuration/bastion_conf","administration/configuration/index","administration/configuration/osh-backup-acl-keys_conf","administration/configuration/osh-cleanup-guest-key-access_conf","administration/configuration/osh-encrypt-rsync_conf","administration/configuration/osh-http-proxy_conf","administration/configuration/osh-lingering-sessions-reaper_conf","administration/configuration/osh-orphaned-homedir_conf","administration/configuration/osh-piv-grace-reaper_conf","administration/configuration/osh-remove-empty-folders_conf","administration/configuration/osh-sync-watcher_sh","administration/logs","administration/mfa","administration/security_advisories","administration/security_advisories/cve_2023_45140","development/setup","development/tests","faq","index","installation/advanced","installation/basic","installation/docker","installation/restoring_from_backup","installation/upgrading","plugins/admin/adminMaintenance","plugins/admin/adminSudo","plugins/admin/index","plugins/group-aclkeeper/groupAddServer","plugins/group-aclkeeper/groupDelServer","plugins/group-aclkeeper/index","plugins/group-gatekeeper/groupAddGuestAccess","plugins/group-gatekeeper/groupAddMember","plugins/group-gatekeeper/groupDelGuestAccess","plugins/group-gatekeeper/groupDelMember","plugins/group-gatekeeper/groupListGuestAccesses","plugins/group-gatekeeper/index","plugins/group-owner/groupAddAclkeeper","plugins/group-owner/groupAddGatekeeper","plugins/group-owner/groupAddOwner","plugins/group-owner/groupDelAclkeeper","plugins/group-owner/groupDelEgressKey","plugins/group-owner/groupDelGatekeeper","plugins/group-owner/groupDelOwner","plugins/group-owner/groupDestroy","plugins/group-owner/groupGenerateEgressKey","plugins/group-owner/groupGeneratePassword","plugins/group-owner/groupModify","plugins/group-owner/groupTransmitOwnership","plugins/group-owner/index","plugins/open/alive","plugins/open/batch","plugins/open/clush","plugins/open/groupInfo","plugins/open/groupList","plugins/open/groupListPasswords","plugins/open/groupListServers","plugins/open/help","plugins/open/index","plugins/open/info","plugins/open/lock","plugins/open/mtr","plugins/open/nc","plugins/open/ping","plugins/open/scp","plugins/open/selfAddIngressKey","plugins/open/selfDelIngressKey","plugins/open/selfForgetHostKey","plugins/open/selfGenerateEgressKey","plugins/open/selfGeneratePassword","plugins/open/selfGenerateProxyPassword","plugins/open/selfListAccesses","plugins/open/selfListEgressKeys","plugins/open/selfListIngressKeys","plugins/open/selfListPasswords","plugins/open/selfListSessions","plugins/open/selfMFAResetPassword","plugins/open/selfMFAResetTOTP","plugins/open/selfMFASetupPassword","plugins/open/selfMFASetupTOTP","plugins/open/selfPlaySession","plugins/open/sftp","plugins/open/unlock","plugins/restricted/accountAddPersonalAccess","plugins/restricted/accountCreate","plugins/restricted/accountDelPersonalAccess","plugins/restricted/accountDelete","plugins/restricted/accountFreeze","plugins/restricted/accountGeneratePassword","plugins/restricted/accountGrantCommand","plugins/restricted/accountInfo","plugins/restricted/accountList","plugins/restricted/accountListAccesses","plugins/restricted/accountListEgressKeys","plugins/restricted/accountListIngressKeys","plugins/restricted/accountListPasswords","plugins/restricted/accountMFAResetPassword","plugins/restricted/accountMFAResetTOTP","plugins/restricted/accountModify","plugins/restricted/accountPIV","plugins/restricted/accountRevokeCommand","plugins/restricted/accountUnexpire","plugins/restricted/accountUnfreeze","plugins/restricted/accountUnlock","plugins/restricted/groupCreate","plugins/restricted/groupDelete","plugins/restricted/index","plugins/restricted/realmCreate","plugins/restricted/realmDelete","plugins/restricted/realmInfo","plugins/restricted/realmList","plugins/restricted/rootListIngressKeys","plugins/restricted/selfAddPersonalAccess","plugins/restricted/selfDelPersonalAccess","plugins/restricted/whoHasAccessTo","presentation/features","presentation/principles","presentation/security","using/api","using/basics/access_management","using/basics/first_steps","using/basics/index","using/http_proxy","using/piv","using/sftp_scp","using/specific_ssh_clients_tutorials/index","using/specific_ssh_clients_tutorials/putty"],envversion:{"sphinx.domains.c":2,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":4,"sphinx.domains.index":1,"sphinx.domains.javascript":2,"sphinx.domains.math":2,"sphinx.domains.python":3,"sphinx.domains.rst":2,"sphinx.domains.std":2,sphinx:56},filenames:["administration/configuration/bastion_conf.rst","administration/configuration/index.rst","administration/configuration/osh-backup-acl-keys_conf.rst","administration/configuration/osh-cleanup-guest-key-access_conf.rst","administration/configuration/osh-encrypt-rsync_conf.rst","administration/configuration/osh-http-proxy_conf.rst","administration/configuration/osh-lingering-sessions-reaper_conf.rst","administration/configuration/osh-orphaned-homedir_conf.rst","administration/configuration/osh-piv-grace-reaper_conf.rst","administration/configuration/osh-remove-empty-folders_conf.rst","administration/configuration/osh-sync-watcher_sh.rst","administration/logs.rst","administration/mfa.rst","administration/security_advisories.rst","administration/security_advisories/cve_2023_45140.rst","development/setup.rst","development/tests.rst","faq.rst","index.rst","installation/advanced.rst","installation/basic.rst","installation/docker.rst","installation/restoring_from_backup.rst","installation/upgrading.rst","plugins/admin/adminMaintenance.rst","plugins/admin/adminSudo.rst","plugins/admin/index.rst","plugins/group-aclkeeper/groupAddServer.rst","plugins/group-aclkeeper/groupDelServer.rst","plugins/group-aclkeeper/index.rst","plugins/group-gatekeeper/groupAddGuestAccess.rst","plugins/group-gatekeeper/groupAddMember.rst","plugins/group-gatekeeper/groupDelGuestAccess.rst","plugins/group-gatekeeper/groupDelMember.rst","plugins/group-gatekeeper/groupListGuestAccesses.rst","plugins/group-gatekeeper/index.rst","plugins/group-owner/groupAddAclkeeper.rst","plugins/group-owner/groupAddGatekeeper.rst","plugins/group-owner/groupAddOwner.rst","plugins/group-owner/groupDelAclkeeper.rst","plugins/group-owner/groupDelEgressKey.rst","plugins/group-owner/groupDelGatekeeper.rst","plugins/group-owner/groupDelOwner.rst","plugins/group-owner/groupDestroy.rst","plugins/group-owner/groupGenerateEgressKey.rst","plugins/group-owner/groupGeneratePassword.rst","plugins/group-owner/groupModify.rst","plugins/group-owner/groupTransmitOwnership.rst","plugins/group-owner/index.rst","plugins/open/alive.rst","plugins/open/batch.rst","plugins/open/clush.rst","plugins/open/groupInfo.rst","plugins/open/groupList.rst","plugins/open/groupListPasswords.rst","plugins/open/groupListServers.rst","plugins/open/help.rst","plugins/open/index.rst","plugins/open/info.rst","plugins/open/lock.rst","plugins/open/mtr.rst","plugins/open/nc.rst","plugins/open/ping.rst","plugins/open/scp.rst","plugins/open/selfAddIngressKey.rst","plugins/open/selfDelIngressKey.rst","plugins/open/selfForgetHostKey.rst","plugins/open/selfGenerateEgressKey.rst","plugins/open/selfGeneratePassword.rst","plugins/open/selfGenerateProxyPassword.rst","plugins/open/selfListAccesses.rst","plugins/open/selfListEgressKeys.rst","plugins/open/selfListIngressKeys.rst","plugins/open/selfListPasswords.rst","plugins/open/selfListSessions.rst","plugins/open/selfMFAResetPassword.rst","plugins/open/selfMFAResetTOTP.rst","plugins/open/selfMFASetupPassword.rst","plugins/open/selfMFASetupTOTP.rst","plugins/open/selfPlaySession.rst","plugins/open/sftp.rst","plugins/open/unlock.rst","plugins/restricted/accountAddPersonalAccess.rst","plugins/restricted/accountCreate.rst","plugins/restricted/accountDelPersonalAccess.rst","plugins/restricted/accountDelete.rst","plugins/restricted/accountFreeze.rst","plugins/restricted/accountGeneratePassword.rst","plugins/restricted/accountGrantCommand.rst","plugins/restricted/accountInfo.rst","plugins/restricted/accountList.rst","plugins/restricted/accountListAccesses.rst","plugins/restricted/accountListEgressKeys.rst","plugins/restricted/accountListIngressKeys.rst","plugins/restricted/accountListPasswords.rst","plugins/restricted/accountMFAResetPassword.rst","plugins/restricted/accountMFAResetTOTP.rst","plugins/restricted/accountModify.rst","plugins/restricted/accountPIV.rst","plugins/restricted/accountRevokeCommand.rst","plugins/restricted/accountUnexpire.rst","plugins/restricted/accountUnfreeze.rst","plugins/restricted/accountUnlock.rst","plugins/restricted/groupCreate.rst","plugins/restricted/groupDelete.rst","plugins/restricted/index.rst","plugins/restricted/realmCreate.rst","plugins/restricted/realmDelete.rst","plugins/restricted/realmInfo.rst","plugins/restricted/realmList.rst","plugins/restricted/rootListIngressKeys.rst","plugins/restricted/selfAddPersonalAccess.rst","plugins/restricted/selfDelPersonalAccess.rst","plugins/restricted/whoHasAccessTo.rst","presentation/features.rst","presentation/principles.rst","presentation/security.rst","using/api.rst","using/basics/access_management.rst","using/basics/first_steps.rst","using/basics/index.rst","using/http_proxy.rst","using/piv.rst","using/sftp_scp.rst","using/specific_ssh_clients_tutorials/index.rst","using/specific_ssh_clients_tutorials/putty.rst"],objects:{accountAddPersonalAccess:[[82,0,1,"cmdoption-accountAddPersonalAccess-account","--account"],[82,0,1,"cmdoption-accountAddPersonalAccess-comment","--comment"],[82,0,1,"cmdoption-accountAddPersonalAccess-force-key","--force-key"],[82,0,1,"cmdoption-accountAddPersonalAccess-force-password","--force-password"],[82,0,1,"cmdoption-accountAddPersonalAccess-host","--host"],[82,0,1,"cmdoption-accountAddPersonalAccess-port","--port"],[82,0,1,"cmdoption-accountAddPersonalAccess-port-any","--port-any"],[82,0,1,"cmdoption-accountAddPersonalAccess-scpdown","--scpdown"],[82,0,1,"cmdoption-accountAddPersonalAccess-scpup","--scpup"],[82,0,1,"cmdoption-accountAddPersonalAccess-sftp","--sftp"],[82,0,1,"cmdoption-accountAddPersonalAccess-ttl","--ttl"],[82,0,1,"cmdoption-accountAddPersonalAccess-user","--user"],[82,0,1,"cmdoption-accountAddPersonalAccess-user-any","--user-any"],[82,0,1,"cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix","between"],[82,0,1,"cmdoption-accountAddPersonalAccess-arg-self_remote_user_only","boolean)"],[82,0,1,"cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix","integer"],[82,0,1,"cmdoption-accountAddPersonalAccess-arg-self_remote_user_only","self_remote_user_only"],[82,0,1,"cmdoption-accountAddPersonalAccess-arg-widest_v4_prefix","widest_v4_prefix"]],accountCreate:[[83,0,1,"cmdoption-accountCreate-account","--account"],[83,0,1,"cmdoption-accountCreate-always-active","--always-active"],[83,0,1,"cmdoption-accountCreate-comment","--comment"],[83,0,1,"cmdoption-accountCreate-immutable-key","--immutable-key"],[83,0,1,"cmdoption-accountCreate-max-inactive-days","--max-inactive-days"],[83,0,1,"cmdoption-accountCreate-no-key","--no-key"],[83,0,1,"cmdoption-accountCreate-osh-only","--osh-only"],[83,0,1,"cmdoption-accountCreate-public-key","--public-key"],[83,0,1,"cmdoption-accountCreate-ttl","--ttl"],[83,0,1,"cmdoption-accountCreate-uid","--uid"],[83,0,1,"cmdoption-accountCreate-uid-auto","--uid-auto"]],accountDelPersonalAccess:[[84,0,1,"cmdoption-accountDelPersonalAccess-account","--account"],[84,0,1,"cmdoption-accountDelPersonalAccess-host","--host"],[84,0,1,"cmdoption-accountDelPersonalAccess-port","--port"],[84,0,1,"cmdoption-accountDelPersonalAccess-port-any","--port-any"],[84,0,1,"cmdoption-accountDelPersonalAccess-scpdown","--scpdown"],[84,0,1,"cmdoption-accountDelPersonalAccess-scpup","--scpup"],[84,0,1,"cmdoption-accountDelPersonalAccess-sftp","--sftp"],[84,0,1,"cmdoption-accountDelPersonalAccess-user","--user"],[84,0,1,"cmdoption-accountDelPersonalAccess-user-any","--user-any"]],accountDelete:[[85,0,1,"cmdoption-accountDelete-account","--account"],[85,0,1,"cmdoption-accountDelete-no-confirm","--no-confirm"]],accountFreeze:[[86,0,1,"cmdoption-accountFreeze-account","--account"],[86,0,1,"cmdoption-accountFreeze-reason","--reason"]],accountGeneratePassword:[[87,0,1,"cmdoption-accountGeneratePassword-account","--account"],[87,0,1,"cmdoption-accountGeneratePassword-do-it","--do-it"],[87,0,1,"cmdoption-accountGeneratePassword-size","--size"]],accountGrantCommand:[[88,0,1,"cmdoption-accountGrantCommand-account","--account"],[88,0,1,"cmdoption-accountGrantCommand-command","--command"]],accountInfo:[[89,0,1,"cmdoption-accountInfo-account","--account"],[89,0,1,"cmdoption-accountInfo-all","--all"],[89,0,1,"cmdoption-accountInfo-with-out-egress-keys","--with[out]-egress-keys"],[89,0,1,"cmdoption-accountInfo-with-out-everything","--with[out]-everything"],[89,0,1,"cmdoption-accountInfo-with-out-groups","--with[out]-groups"],[89,0,1,"cmdoption-accountInfo-with-out-mfa-password-info","--with[out]-mfa-password-info"]],accountList:[[90,0,1,"cmdoption-accountList-account","--account"],[90,0,1,"cmdoption-accountList-audit","--audit"],[90,0,1,"cmdoption-accountList-exclude","--exclude"],[90,0,1,"cmdoption-accountList-inactive-only","--inactive-only"],[90,0,1,"cmdoption-accountList-include","--include"],[90,0,1,"cmdoption-accountList-no-output","--no-output"],[90,0,1,"cmdoption-accountList-no-password-info","--no-password-info"]],accountListAccesses:[[91,0,1,"cmdoption-accountListAccesses-account","--account"],[91,0,1,"cmdoption-accountListAccesses-exclude","--exclude"],[91,0,1,"cmdoption-accountListAccesses-hide-groups","--hide-groups"],[91,0,1,"cmdoption-accountListAccesses-include","--include"],[91,0,1,"cmdoption-accountListAccesses-reverse-dns","--reverse-dns"]],accountListEgressKeys:[[92,0,1,"cmdoption-accountListEgressKeys-account","--account"]],accountListIngressKeys:[[93,0,1,"cmdoption-accountListIngressKeys-account","--account"]],accountListPasswords:[[94,0,1,"cmdoption-accountListPasswords-account","--account"]],accountMFAResetPassword:[[95,0,1,"cmdoption-accountMFAResetPassword-account","--account"]],accountMFAResetTOTP:[[96,0,1,"cmdoption-accountMFAResetTOTP-account","--account"]],accountModify:[[97,0,1,"cmdoption-accountModify-account","--account"],[97,0,1,"cmdoption-accountModify-always-active","--always-active"],[97,0,1,"cmdoption-accountModify-egress-strict-host-key-checking","--egress-strict-host-key-checking"],[97,0,1,"cmdoption-accountModify-idle-ignore","--idle-ignore"],[97,0,1,"cmdoption-accountModify-max-inactive-days","--max-inactive-days"],[97,0,1,"cmdoption-accountModify-mfa-password-required","--mfa-password-required"],[97,0,1,"cmdoption-accountModify-mfa-totp-required","--mfa-totp-required"],[97,0,1,"cmdoption-accountModify-osh-only","--osh-only"],[97,0,1,"cmdoption-accountModify-pam-auth-bypass","--pam-auth-bypass"],[97,0,1,"cmdoption-accountModify-personal-egress-mfa-required","--personal-egress-mfa-required"],[97,0,1,"cmdoption-accountModify-pubkey-auth-optional","--pubkey-auth-optional"]],accountPIV:[[98,0,1,"cmdoption-accountPIV-account","--account"],[98,0,1,"cmdoption-accountPIV-policy","--policy"],[98,0,1,"cmdoption-accountPIV-ttl","--ttl"]],accountRevokeCommand:[[99,0,1,"cmdoption-accountRevokeCommand-account","--account"],[99,0,1,"cmdoption-accountRevokeCommand-command","--command"]],accountUnexpire:[[100,0,1,"cmdoption-accountUnexpire-account","--account"]],accountUnfreeze:[[101,0,1,"cmdoption-accountUnfreeze-account","--account"]],accountUnlock:[[102,0,1,"cmdoption-accountUnlock-account","--account"]],adminMaintenance:[[24,0,1,"cmdoption-adminMaintenance-lock","--lock"],[24,0,1,"cmdoption-adminMaintenance-message","--message"],[24,0,1,"cmdoption-adminMaintenance-unlock","--unlock"]],adminSudo:[[25,0,1,"cmdoption-adminSudo-sudo-as","--sudo-as"],[25,0,1,"cmdoption-adminSudo-sudo-cmd","--sudo-cmd"]],alive:[[49,0,1,"cmdoption-alive-host","--host"]],clush:[[51,0,1,"cmdoption-clush-command","--command"],[51,0,1,"cmdoption-clush-list","--list"],[51,0,1,"cmdoption-clush-no-confirm","--no-confirm"],[51,0,1,"cmdoption-clush-no-pause-on-failure","--no-pause-on-failure"],[51,0,1,"cmdoption-clush-port","--port"],[51,0,1,"cmdoption-clush-step-by-step","--step-by-step"],[51,0,1,"cmdoption-clush-user","--user"]],groupAddAclkeeper:[[36,0,1,"cmdoption-groupAddAclkeeper-account","--account"],[36,0,1,"cmdoption-groupAddAclkeeper-group","--group"]],groupAddGatekeeper:[[37,0,1,"cmdoption-groupAddGatekeeper-account","--account"],[37,0,1,"cmdoption-groupAddGatekeeper-group","--group"]],groupAddGuestAccess:[[30,0,1,"cmdoption-groupAddGuestAccess-account","--account"],[30,0,1,"cmdoption-groupAddGuestAccess-comment","--comment"],[30,0,1,"cmdoption-groupAddGuestAccess-group","--group"],[30,0,1,"cmdoption-groupAddGuestAccess-host","--host"],[30,0,1,"cmdoption-groupAddGuestAccess-port","--port"],[30,0,1,"cmdoption-groupAddGuestAccess-port-any","--port-any"],[30,0,1,"cmdoption-groupAddGuestAccess-scpdown","--scpdown"],[30,0,1,"cmdoption-groupAddGuestAccess-scpup","--scpup"],[30,0,1,"cmdoption-groupAddGuestAccess-sftp","--sftp"],[30,0,1,"cmdoption-groupAddGuestAccess-ttl","--ttl"],[30,0,1,"cmdoption-groupAddGuestAccess-user","--user"],[30,0,1,"cmdoption-groupAddGuestAccess-user-any","--user-any"]],groupAddMember:[[31,0,1,"cmdoption-groupAddMember-account","--account"],[31,0,1,"cmdoption-groupAddMember-group","--group"]],groupAddOwner:[[38,0,1,"cmdoption-groupAddOwner-account","--account"],[38,0,1,"cmdoption-groupAddOwner-group","--group"]],groupAddServer:[[27,0,1,"cmdoption-groupAddServer-comment","--comment"],[27,0,1,"cmdoption-groupAddServer-force","--force"],[27,0,1,"cmdoption-groupAddServer-force-key","--force-key"],[27,0,1,"cmdoption-groupAddServer-force-password","--force-password"],[27,0,1,"cmdoption-groupAddServer-group","--group"],[27,0,1,"cmdoption-groupAddServer-host","--host"],[27,0,1,"cmdoption-groupAddServer-port","--port"],[27,0,1,"cmdoption-groupAddServer-port-any","--port-any"],[27,0,1,"cmdoption-groupAddServer-scpdown","--scpdown"],[27,0,1,"cmdoption-groupAddServer-scpup","--scpup"],[27,0,1,"cmdoption-groupAddServer-sftp","--sftp"],[27,0,1,"cmdoption-groupAddServer-ttl","--ttl"],[27,0,1,"cmdoption-groupAddServer-user","--user"],[27,0,1,"cmdoption-groupAddServer-user-any","--user-any"]],groupCreate:[[103,0,1,"cmdoption-groupCreate-algo","--algo"],[103,0,1,"cmdoption-groupCreate-encrypted","--encrypted"],[103,0,1,"cmdoption-groupCreate-group","--group"],[103,0,1,"cmdoption-groupCreate-no-key","--no-key"],[103,0,1,"cmdoption-groupCreate-owner","--owner"],[103,0,1,"cmdoption-groupCreate-size","--size"]],groupDelAclkeeper:[[39,0,1,"cmdoption-groupDelAclkeeper-account","--account"],[39,0,1,"cmdoption-groupDelAclkeeper-group","--group"]],groupDelEgressKey:[[40,0,1,"cmdoption-groupDelEgressKey-group","--group"],[40,0,1,"cmdoption-groupDelEgressKey-id","--id"]],groupDelGatekeeper:[[41,0,1,"cmdoption-groupDelGatekeeper-account","--account"],[41,0,1,"cmdoption-groupDelGatekeeper-group","--group"]],groupDelGuestAccess:[[32,0,1,"cmdoption-groupDelGuestAccess-group","--group"],[32,0,1,"cmdoption-groupDelGuestAccess-host","--host"],[32,0,1,"cmdoption-groupDelGuestAccess-port","--port"],[32,0,1,"cmdoption-groupDelGuestAccess-port-any","--port-any"],[32,0,1,"cmdoption-groupDelGuestAccess-scpdown","--scpdown"],[32,0,1,"cmdoption-groupDelGuestAccess-scpup","--scpup"],[32,0,1,"cmdoption-groupDelGuestAccess-sftp","--sftp"],[32,0,1,"cmdoption-groupDelGuestAccess-user","--user"],[32,0,1,"cmdoption-groupDelGuestAccess-user-any","--user-any"]],groupDelMember:[[33,0,1,"cmdoption-groupDelMember-account","--account"],[33,0,1,"cmdoption-groupDelMember-group","--group"]],groupDelOwner:[[42,0,1,"cmdoption-groupDelOwner-account","--account"],[42,0,1,"cmdoption-groupDelOwner-group","--group"]],groupDelServer:[[28,0,1,"cmdoption-groupDelServer-group","--group"],[28,0,1,"cmdoption-groupDelServer-host","--host"],[28,0,1,"cmdoption-groupDelServer-port","--port"],[28,0,1,"cmdoption-groupDelServer-port-any","--port-any"],[28,0,1,"cmdoption-groupDelServer-scpdown","--scpdown"],[28,0,1,"cmdoption-groupDelServer-scpup","--scpup"],[28,0,1,"cmdoption-groupDelServer-sftp","--sftp"],[28,0,1,"cmdoption-groupDelServer-user","--user"],[28,0,1,"cmdoption-groupDelServer-user-any","--user-any"]],groupDelete:[[104,0,1,"cmdoption-groupDelete-group","--group"],[104,0,1,"cmdoption-groupDelete-no-confirm","--no-confirm"]],groupDestroy:[[43,0,1,"cmdoption-groupDestroy-group","--group"],[43,0,1,"cmdoption-groupDestroy-no-confirm","--no-confirm"]],groupGenerateEgressKey:[[44,0,1,"cmdoption-groupGenerateEgressKey-algo","--algo"],[44,0,1,"cmdoption-groupGenerateEgressKey-encrypted","--encrypted"],[44,0,1,"cmdoption-groupGenerateEgressKey-group","--group"],[44,0,1,"cmdoption-groupGenerateEgressKey-size","--size"]],groupGeneratePassword:[[45,0,1,"cmdoption-groupGeneratePassword-do-it","--do-it"],[45,0,1,"cmdoption-groupGeneratePassword-group","--group"],[45,0,1,"cmdoption-groupGeneratePassword-size","--size"]],groupInfo:[[52,0,1,"cmdoption-groupInfo-all","--all"],[52,0,1,"cmdoption-groupInfo-group","--group"],[52,0,1,"cmdoption-groupInfo-with-out-everything","--with[out]-everything"],[52,0,1,"cmdoption-groupInfo-with-out-keys","--with[out]-keys"]],groupList:[[53,0,1,"cmdoption-groupList-all","--all"],[53,0,1,"cmdoption-groupList-exclude","--exclude"],[53,0,1,"cmdoption-groupList-include","--include"]],groupListGuestAccesses:[[34,0,1,"cmdoption-groupListGuestAccesses-account","--account"],[34,0,1,"cmdoption-groupListGuestAccesses-exclude","--exclude"],[34,0,1,"cmdoption-groupListGuestAccesses-group","--group"],[34,0,1,"cmdoption-groupListGuestAccesses-include","--include"],[34,0,1,"cmdoption-groupListGuestAccesses-reverse-dns","--reverse-dns"]],groupListPasswords:[[54,0,1,"cmdoption-groupListPasswords-group","--group"]],groupListServers:[[55,0,1,"cmdoption-groupListServers-exclude","--exclude"],[55,0,1,"cmdoption-groupListServers-group","--group"],[55,0,1,"cmdoption-groupListServers-include","--include"],[55,0,1,"cmdoption-groupListServers-reverse-dns","--reverse-dns"]],groupModify:[[46,0,1,"cmdoption-groupModify-group","--group"],[46,0,1,"cmdoption-groupModify-guest-ttl-limit","--guest-ttl-limit"],[46,0,1,"cmdoption-groupModify-mfa-required","--mfa-required"]],groupTransmitOwnership:[[47,0,1,"cmdoption-groupTransmitOwnership-account","--account"],[47,0,1,"cmdoption-groupTransmitOwnership-group","--group"]],info:[[58,0,1,"cmdoption-info-arg-admin_show_system_info","admin_show_system_info"],[58,0,1,"cmdoption-info-arg-show_fortune","boolean)"],[58,0,1,"cmdoption-info-arg-show_fortune","show_fortune"]],mtr:[[60,0,1,"cmdoption-mtr-report","--report"]],nc:[[61,0,1,"cmdoption-nc-host","--host"],[61,0,1,"cmdoption-nc-port","--port"],[61,0,1,"cmdoption-nc-w","-w"]],ping:[[62,0,1,"cmdoption-ping-host","--host"],[62,0,1,"cmdoption-ping-c","-c"],[62,0,1,"cmdoption-ping-s","-s"],[62,0,1,"cmdoption-ping-t","-t"],[62,0,1,"cmdoption-ping-w","-w"]],realmCreate:[[106,0,1,"cmdoption-realmCreate-comment","--comment"],[106,0,1,"cmdoption-realmCreate-from","--from"],[106,0,1,"cmdoption-realmCreate-public-key","--public-key"],[106,0,1,"cmdoption-realmCreate-realm","--realm"]],realmDelete:[[107,0,1,"cmdoption-realmDelete-realm","--realm"]],realmInfo:[[108,0,1,"cmdoption-realmInfo-realm","--realm"]],realmList:[[109,0,1,"cmdoption-realmList-realm","--realm"]],selfAddIngressKey:[[64,0,1,"cmdoption-selfAddIngressKey-piv","--piv"],[64,0,1,"cmdoption-selfAddIngressKey-public-key","--public-key"]],selfAddPersonalAccess:[[111,0,1,"cmdoption-selfAddPersonalAccess-comment","--comment"],[111,0,1,"cmdoption-selfAddPersonalAccess-force","--force"],[111,0,1,"cmdoption-selfAddPersonalAccess-force-key","--force-key"],[111,0,1,"cmdoption-selfAddPersonalAccess-force-password","--force-password"],[111,0,1,"cmdoption-selfAddPersonalAccess-host","--host"],[111,0,1,"cmdoption-selfAddPersonalAccess-port","--port"],[111,0,1,"cmdoption-selfAddPersonalAccess-port-any","--port-any"],[111,0,1,"cmdoption-selfAddPersonalAccess-scpdown","--scpdown"],[111,0,1,"cmdoption-selfAddPersonalAccess-scpup","--scpup"],[111,0,1,"cmdoption-selfAddPersonalAccess-sftp","--sftp"],[111,0,1,"cmdoption-selfAddPersonalAccess-ttl","--ttl"],[111,0,1,"cmdoption-selfAddPersonalAccess-user","--user"],[111,0,1,"cmdoption-selfAddPersonalAccess-user-any","--user-any"],[111,0,1,"cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix","between"],[111,0,1,"cmdoption-selfAddPersonalAccess-arg-self_remote_user_only","boolean)"],[111,0,1,"cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix","integer"],[111,0,1,"cmdoption-selfAddPersonalAccess-arg-self_remote_user_only","self_remote_user_only"],[111,0,1,"cmdoption-selfAddPersonalAccess-arg-widest_v4_prefix","widest_v4_prefix"]],selfDelIngressKey:[[65,0,1,"cmdoption-selfDelIngressKey-f","--fingerprint-to-delete"],[65,0,1,"cmdoption-selfDelIngressKey-l","--id-to-delete"],[65,0,1,"cmdoption-selfDelIngressKey-f","-f"],[65,0,1,"cmdoption-selfDelIngressKey-l","-l"]],selfDelPersonalAccess:[[112,0,1,"cmdoption-selfDelPersonalAccess-host","--host"],[112,0,1,"cmdoption-selfDelPersonalAccess-port","--port"],[112,0,1,"cmdoption-selfDelPersonalAccess-port-any","--port-any"],[112,0,1,"cmdoption-selfDelPersonalAccess-scpdown","--scpdown"],[112,0,1,"cmdoption-selfDelPersonalAccess-scpup","--scpup"],[112,0,1,"cmdoption-selfDelPersonalAccess-sftp","--sftp"],[112,0,1,"cmdoption-selfDelPersonalAccess-user","--user"],[112,0,1,"cmdoption-selfDelPersonalAccess-user-any","--user-any"]],selfForgetHostKey:[[66,0,1,"cmdoption-selfForgetHostKey-host","--host"],[66,0,1,"cmdoption-selfForgetHostKey-port","--port"]],selfGenerateEgressKey:[[67,0,1,"cmdoption-selfGenerateEgressKey-algo","--algo"],[67,0,1,"cmdoption-selfGenerateEgressKey-encrypted","--encrypted"],[67,0,1,"cmdoption-selfGenerateEgressKey-size","--size"]],selfGeneratePassword:[[68,0,1,"cmdoption-selfGeneratePassword-do-it","--do-it"],[68,0,1,"cmdoption-selfGeneratePassword-size","--size"]],selfGenerateProxyPassword:[[69,0,1,"cmdoption-selfGenerateProxyPassword-do-it","--do-it"],[69,0,1,"cmdoption-selfGenerateProxyPassword-size","--size"]],selfListAccesses:[[70,0,1,"cmdoption-selfListAccesses-exclude","--exclude"],[70,0,1,"cmdoption-selfListAccesses-hide-groups","--hide-groups"],[70,0,1,"cmdoption-selfListAccesses-include","--include"],[70,0,1,"cmdoption-selfListAccesses-reverse-dns","--reverse-dns"]],selfListSessions:[[74,0,1,"cmdoption-selfListSessions-after","--after"],[74,0,1,"cmdoption-selfListSessions-allowed","--allowed"],[74,0,1,"cmdoption-selfListSessions-before","--before"],[74,0,1,"cmdoption-selfListSessions-denied","--denied"],[74,0,1,"cmdoption-selfListSessions-detailed","--detailed"],[74,0,1,"cmdoption-selfListSessions-host","--host"],[74,0,1,"cmdoption-selfListSessions-id","--id"],[74,0,1,"cmdoption-selfListSessions-limit","--limit"],[74,0,1,"cmdoption-selfListSessions-to-port","--to-port"],[74,0,1,"cmdoption-selfListSessions-type","--type"],[74,0,1,"cmdoption-selfListSessions-user","--user"],[74,0,1,"cmdoption-selfListSessions-via","--via"],[74,0,1,"cmdoption-selfListSessions-via-port","--via-port"]],selfMFASetupPassword:[[77,0,1,"cmdoption-selfMFASetupPassword-yes","--yes"]],selfMFASetupTOTP:[[78,0,1,"cmdoption-selfMFASetupTOTP-no-confirm","--no-confirm"]],selfPlaySession:[[79,0,1,"cmdoption-selfPlaySession-id","--id"]],whoHasAccessTo:[[113,0,1,"cmdoption-whoHasAccessTo-host","--host"],[113,0,1,"cmdoption-whoHasAccessTo-ignore-group","--ignore-group"],[113,0,1,"cmdoption-whoHasAccessTo-ignore-personal","--ignore-personal"],[113,0,1,"cmdoption-whoHasAccessTo-port","--port"],[113,0,1,"cmdoption-whoHasAccessTo-show-wildcards","--show-wildcards"],[113,0,1,"cmdoption-whoHasAccessTo-user","--user"]]},objnames:{"0":["std","cmdoption","program option"]},objtypes:{"0":"std:cmdoption"},terms:{"0":[0,2,4,5,6,7,9,10,11,12,14,15,16,18,19,21,23,27,46,51,58,80,82,111,113,119],"00":[11,12,19,89,117,119,121,122],"0000":15,"0010":16,"0021":16,"0022":23,"00m04":16,"00m05":16,"01":[11,12,20,89,119,121,122],"02":[11,12,19,122],"03":[11,12,15,19,22,89,121,122],"04":[19,20],"046":19,"05":[19,117,119],"06":[14,89],"0640":[2,4],"07":[11,14,89,117,119],"071":19,"074894":11,"08":[12,14,15,19,89,117,119,121],"09":[19,89,119,122],"0d":119,"0f":19,"0m":19,"0n":19,"0q":19,"0x5575da15aa78":11,"0x5575da36b690":11,"1":[0,2,4,5,6,7,9,10,11,12,14,15,17,18,19,21,22,23,46,97,115,117,119,121],"10":[0,12,14,15,19,20,121,122],"100":[0,16,17,19,119],"100000":0,"10006":11,"1001":19,"10057":11,"1024":5,"105":19,"1072497":11,"1072528":11,"11":[11,12,14,19,20,119],"111":0,"11264":19,"113":[0,27],"11860":19,"119":19,"12":[10,11,12,19,20,117,122],"120":[5,10,19],"123":11,"12345678":122,"127":[12,21,23,117],"13":[20,119,122],"1305":19,"13180":19,"1325900":11,"1325901":11,"14":[4,11,14],"1445":19,"15":[0,12,14,19,20,121],"153156":19,"1562861572":119,"1594384739":11,"16":[0,5,11,20,82,89,111,121],"1607524914":11,"1608561026":11,"1609427402":122,"168":0,"17":[10,11,12,89,122],"172":[11,12],"1789":19,"18":[19,20],"18720":11,"18721":11,"18802":11,"18803":11,"19":[0,15],"192":[0,2,10,19,58,119],"198":[19,119],"1d7h8m":[23,27,82,111],"1u":19,"1wfzo0umr15wzfis5fpy0m":122,"2":[0,2,4,5,10,11,12,15,17,18,19,23,58,115,117,119,121,122],"20":[0,15,19,20,82,111],"2000":0,"2018":19,"2019":119,"2020":[11,19,119,122],"2021":[22,121,122],"2022":89,"2023":[12,13,15,18,89,117],"20268":19,"203":[0,27],"2048":[0,44,58,67,103,122],"20518":11,"20519":11,"2070":11,"2091":19,"21":[11,19,89,121],"21mb":19,"22":[11,16,20,21,27,51,58,66,117,119,121,122,123],"222":[4,11],"2227":19,"2244":10,"224548":19,"23":11,"237":23,"24":[0,27,82,111],"2467":19,"2484":19,"249220":19,"25":[11,15,19],"250":17,"253440":19,"255":119,"256":[11,12,44,67,103,119],"26":[11,119],"2604":11,"2644":19,"27":[12,19,22,89],"27001":116,"271d":89,"28":[11,19,119],"29":[119,121,122],"2993de2bb014":122,"2d":122,"2dh2ojqj9bmgo5fuuupek":121,"2fa":[0,12,18],"2vo1ukyjjcq9exmcaweaaanomewweqykkwybbagcxaodawqdbqiembqgcisgaqqb":122,"2xd1agud":121,"3":[0,4,11,12,14,16,18,19,23,50,61,115,117,118,121,122],"30":[0,5,11,16,19],"31":[4,12,117],"3116603":11,"3116604":11,"31t15":122,"32":[5,58,82,111,119],"320":[15,16],"33":19,"3308206":11,"3308212":11,"33450":119,"3346532":19,"339483ff":2,"341":119,"35":12,"36":12,"3600":5,"37":119,"3708842":11,"3708843":11,"3709642":11,"3709643":11,"379":11,"38":[15,19,121],"382820":119,"384":[44,67,103],"386":21,"39":19,"391":11,"39696":11,"3am":20,"3dfb21e3857f562a603bd4f83f379ca7ecdf0537":19,"3f379ca7ecdf0537":19,"3noxi2xw0hwqu1":122,"4":[0,2,11,12,14,18,19,23,115,117,122],"40":19,"40000":0,"40610":119,"4088":19,"4096":[0,19,22,44,67,103,122],"41":[11,19],"41fdb9c7":2,"42":[0,19,58,119,121],"43":[11,15,119],"44":19,"440":19,"443":121,"444":58,"45":[58,119],"45140":[13,18,23],"4572":19,"46":[58,119],"48":122,"485":11,"48h":122,"49":89,"497020":119,"49999":0,"4d12h15m":[83,98],"4g":20,"4k":23,"4xuyr":119,"5":[11,16,17,18,23,121,122],"50":[15,19,23,89],"5000":16,"50000038":19,"50000039":19,"51":[19,89,119],"512":[5,19],"52":89,"521":[44,67,103,122],"537252":11,"537253":11,"55":15,"56":[11,117],"566":19,"56f321fb3e58":11,"57":119,"58":89,"59":89,"5d3cfdffa4480f26":19,"5h9f7csgi":122,"5zmznsyigdw7ft7co4tpld9d0pqvhdpk7f1zhifuxunfsewgtb3iqxldlgdacmzrri11v6q":122,"6":[0,18,121],"60":[0,12,119],"601a17b5e5ba":11,"605950307":15,"618577295":15,"65535":5,"65536":5,"664":14,"692":11,"7":18,"705":19,"70qigxnkfv":122,"75":[19,89],"75ysw6nprdozjkjnwxg19lttvcmcy3eprfz":122,"77":11,"7wuu5uhszt3jvoz28rnij1p":122,"8":[0,5,11,14,18,19,23],"8192":[0,44,58,67,103],"8423":11,"8431":11,"8443":[5,121],"85tftxotxoiazy8upat2gggtsmcwo3shshjuyxrycf8e6jtjl":122,"86400":[0,6,62],"88":[12,119],"89":12,"8b0t6174kupl1itsyc0upndovuacgykpu8zo9rb2lco":122,"8k23zfjytn5nibk13ubxewshmuue1zcnfp0kdhqxbjyss":122,"8mb":19,"8pcvwcgkwcpvynbcmcdcm":122,"9":[18,19,23],"90":[0,2,12,89],"900":0,"905392":19,"91016":19,"94yetennwuy9ytg1dgadxgunq6zzjpjlddfxjuh0czw":12,"98d2f32b1a2d":11,"99":[119,121],"99994":11,"99998":11,"99999":0,"9_":117,"9a":122,"9f352fd4b85c":119,"9q":122,"9qsl1":121,"9sb2":121,"abstract":17,"boolean":[0,11,58,82,111],"break":[0,17,18,23,114],"byte":19,"case":[0,2,4,5,11,12,14,16,17,18,19,20,22,23,27,28,30,32,45,56,68,69,82,84,87,97,111,112,114,116,117,118,119,121,122,123],"catch":[0,46],"char":15,"default":[0,1,2,3,4,5,6,7,8,9,10,11,12,14,15,17,19,21,23,46,51,52,58,61,62,66,80,89,97,98,113,121],"do":[0,2,4,5,8,10,11,12,15,17,18,19,20,22,23,44,45,50,67,68,69,87,103,113,116,117,118,119,121,122],"export":[15,19,23,118],"final":12,"function":[0,2,15,16,17,18,20,24],"import":[0,11,14,17,23,118],"int":[0,2,4,5,6,9,10],"long":[2,4,5,11,12,17,19,22],"new":[0,5,10,11,12,15,16,17,19,20,22,23,24,48,57,97,105,115,117,118,121,122,125],"null":[16,58,97,117],"public":[0,2,4,11,12,14,19,20,21,23,27,30,48,52,57,82,83,89,97,105,106,111,113,118,119,122,125],"return":[0,11,15,16,19,23,51,117,119],"short":[0,2,4,11,20,119],"static":[20,23],"super":[0,11,119],"true":[0,3,5,8,11,12,14,17,19,23,82,98,111,113],"try":[11,12,17,19,21,23,27,45,68,87,113,119],"var":[11,19,23],"while":[0,10,11,17,19,23,100,114,122],A:[0,4,11,14,16,17,18,19,23,44,45,67,68,87,88,89,103,115,117,118,119,121,123],AND:12,AT:[117,119],And:[22,120],As:[2,4,11,12,15,16,19,22,23,89,110,117,118,121,122],At:118,BY:[117,119],Be:21,But:20,By:[0,11,23],For:[0,5,10,11,12,14,15,17,20,23,44,56,63,67,80,98,103,114,119,123],IF:[119,121],IN:0,IS:[10,119,121],IT:120,If:[0,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,30,31,32,34,44,46,51,53,55,56,58,64,65,70,80,90,91,97,98,106,117,118,119,121,122,123],In:[0,4,11,12,15,16,19,20,22,23,38,70,91,117,118,119,121,122,123],It:[0,4,11,15,17,19,20,21,22,23,116,117,118,120,121],Its:123,NO:0,NOT:[0,2,4,12,15,16,19,22,46,103,119,121],No:[18,23,98,116,121],Not:19,OF:19,OR:12,Of:[5,9,19,20,21,23,118,119,121],On:[0,11,17,19,22,23,118,122,125],One:[12,15,17,19],Or:[19,21,63],Such:[17,19],THAT:10,THE:19,That:[21,118],The:[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,19,20,21,22,31,32,33,34,36,37,38,39,41,42,46,52,54,55,58,66,70,71,72,73,82,88,89,91,92,93,94,98,99,114,115,116,117,118,119,121,122,123,124],Their:[72,93],Then:[0,11,12,15,19,20,22,23,118,123,125],There:[11,16,17,19,20,61,118,122],These:[0,1,2,4,5,6,9,10,11,12,16,23,117,118,121],To:[4,5,11,12,15,17,19,20,22,23,59,63,80,82,118,119,121,122,123,125],Will:[0,11],With:121,__anon__:11,a00993ec6767:11,a0:16,a1:16,a2:16,a3:16,a4480f26:19,a46e51b5dce4:11,a5hrell8clv88jutjr2nih:122,aaa:19,aaaa:125,aaaab3nzac1yc2eaaaadaqabaaabaqcyamtxgt:122,aaaab:11,aaaac3nzac1lzdi1nte5aaaailny2nqtkstdxgcate6vhvm9fibud1rjcyq:119,abl:[0,2,4,12,14,19,20,23,31,33,36,37,38,39,41,42,43,58,63,80,83,88,104,111,116,117,118,121,123,125],abnorm:[11,14],abort:[11,15,19,23],about:[0,4,5,11,12,17,18,20,21,56,57,74,105,114,117,118,119,123,124],abov:[0,2,4,5,11,12,14,15,16,19,20,21,22,23,25,117,119,121,122,125],abruptli:11,absolut:20,ac777d06bec9:[12,23,117],ac:14,accept:[5,10,14,58,97,118,121,125],access:[0,1,12,14,15,17,18,19,20,21,22,23,27,28,31,33,35,45,46,52,53,56,57,63,68,69,71,80,87,89,92,105,106,114,116,117,120],accordingli:[0,19,23],accoun:91,account0:16,account0key1fil:16,account1:16,account2:16,account3:16,account:[5,15,16,17,18,21,23,25,35,46,47,48,50,57,58,63,69,80,88,99,103,105,110,116,117,118,119,120,121,123,125],account_mgmt:0,account_uid:11,accountaddpersonalaccess:[14,18,30,92,105,121,123],accountcr:[0,18,20,89,105,117,120],accountdelet:[16,18,89,105],accountdelpersonalaccess:[18,32,105],accountfreez:[18,105],accountgeneratepassword:[18,23,105],accountgrantcommand:[18,56,105,119],accountinfo:[16,18,105],accountlist:[18,105],accountlistaccess:[18,105],accountlistegresskei:[18,105],accountlistegresskeyss:82,accountlistingresskei:[18,105],accountlistpassword:[18,23,82,105],accountmaxinactivedai:[83,97],accountmfapolici:[12,97],accountmfaresetpassword:[18,105],accountmfaresettotp:[18,105],accountmodifi:[0,12,14,18,23,75,76,95,96,105],accountpiv:[0,18,105,122],accountrevokecommand:[18,105],accountsql:[11,23],accountsql_clos:23,accountunexpir:[18,105],accountunfreez:[18,105],accountunlock:[18,105],accumul:118,achiev:[12,17,114,118],acknowledg:20,acl:[1,19,20,22,23,82,111],acl_from_text:22,aclkeep:[0,11,14,18,38,42,48,56,89,118,121],acronym:57,across:23,act:17,action:[4,10,11,12,15,19,59,116,118,122],activ:[0,5,11,17,19,58,83,88,89,97,100],actor:14,actual:[9,11,15,16,17,19,20,45,56,68,69,87,116,117,118],ad:[0,5,11,12,16,19,23,27,52,63,71,80,82,92,98,111,117,118,119,121,122,123],adapt:1,add:[0,11,12,15,16,17,19,20,22,23,29,35,47,48,50,57,103,105,118,119,122,123],added_bi:122,addedbi:117,addedd:117,addit:[0,2,11,14,17,18,20,23,57,58,63,80,89,97,116,117,118,121,123],addition:[0,23,117],address:0,adetailedmessag:23,adjust:[0,19,20,22,23],admin:[0,11,16,17,18,20,21,22,23,56,58,89,118,119,120,121],admin_show_system_info:58,admin_user_ssh_key_path:15,adminaccount:11,administ:116,administr:[0,11,19,21,22,116,119],adminmainten:[18,26],adminsudo:[12,18,26],advanc:[11,12,18,20,23],advers:[19,22],advertis:[0,20],advis:[0,11,12,17,19,20,44,67,103,119,120],advisori:[14,18],aes128:5,aes256:5,affect:[14,97],aforement:14,after:[0,4,5,10,11,12,17,19,22,23,25,27,30,62,74,82,83,89,98,103,111,119,122],afterward:[0,49],again:[0,12,22,23,119,122],against:[0,15,20,121],ago:[12,89,119],agtccv:122,aim:114,aka:[11,12,58,119],alert:11,algo:[44,67,103],algorithm:[0,11,23,44,58,67,103,121,122],alia:[0,17,20,21,50,58,117,120],alias:0,aliv:[6,18,57],all:[0,2,3,4,6,7,8,9,10,11,13,14,15,16,17,18,19,20,21,22,23,27,30,31,32,33,38,46,52,53,57,58,82,89,97,98,103,111,113,114,116,117,118,119,120,121,122,123],allow:[0,11,12,14,23,24,27,28,30,32,46,58,64,74,82,83,84,97,111,112,113,116,118,119,122,123],allowedingresssshalgorithm:23,almost:[17,113],along:[0,4,12,21,37,52,64,119],alongsid:[23,27,30,82,111],alreadi:[0,1,4,12,18,19,20,21,23,98,117,118,120],alright:19,also:[0,2,4,5,11,12,14,15,16,17,18,19,20,21,22,23,33,52,64,75,76,83,98,113,116,117,118,119,122,123,125],alter:[1,22],altern:[4,17,22],although:22,altogeth:[2,3,4,6,7,8,9,10],alwai:[0,4,11,12,16,17,19,23,44,67,80,83,97,103,113,117,119,121,122],always_act:11,am:58,amaqk7t1oie0ook51wjx6j80gzf51pm00oplh4idvnnnxyn2kvknunwpocedd:122,amd64:21,among:[0,118],amount:[0,4,9,11,17,22,62,83,98,118,119],an:[0,4,5,11,12,14,15,16,17,18,19,20,22,23,29,35,43,46,47,48,57,69,83,88,90,103,105,106,111,116,117,118,119,120,121,122,123],anchor:117,ancient:[0,114],ani:[0,2,3,4,5,6,7,9,11,12,13,14,15,17,19,20,21,22,23,27,28,30,32,43,45,46,68,82,83,84,87,88,97,98,104,111,112,116,117,118,119,122,125],annoi:0,announc:115,anoth:[11,15,16,17,19,26,71,92,116,118],ansibl:[18,23,118],answer:[17,57,122],anybodi:[0,56,88],anyon:[0,14,118],anyth:[2,4,8,9,10,11,23,58,118,119,122],anywai:[11,17],anywher:[83,97],api:[12,16,18,69,114,121],app:[12,123],appart:[12,23],appear:[0,11,15],append:19,appli:[0,2,5,14,17,19,23,33,44,46,58,59,67,81,97,98,103,118,122],applic:[11,19],approach:118,apr11:19,apr:19,aqelbqadggebahcnp3k5kqabwymr9nuhkgy1dgcvhjulx2sayy2fueamuurcrrlw:122,ar:[0,1,4,5,9,10,11,12,14,15,16,18,20,23,24,54,56,58,64,65,69,71,72,73,83,86,92,93,94,98,106,115,116,117,118,119,121,122,123],arbitrari:15,architectur:[20,21],archiv:[2,7,19,121],argument:[15,22,119],aris:19,arm64:21,arm:21,armor:[19,23],aros:17,around:[11,17,23],arrai:[0,4,11,117],artefact:2,asc:22,ascii:0,ask:[0,11,12,14,19,21,22,23,77,85,97,120,122,125],asset:12,assign:[14,103],associ:[11,57,105,117,125],assum:[23,119,124],assumpt:[0,120],attach:[6,12,19,116],attack:117,attempt:[0,9,11,12,17,34,55,61,70,91,125],attent:11,attest:[64,114,122],audit:[4,11,18,19,20,88,90,110],auditd:[17,118],auditor:[4,52,88,89,90,119],auth:[0,12,19,23,97,121,125],authent:[0,11,17,18,20,23,58,72,89,93,97,114,117,121,125],authenticationmethod:[12,19],author:[0,11,18,114,118,119,121,122],authorized_kei:[14,19,21,52,64,71,92,119],auto:[11,19,20,21,45,68,83,87,119],autocomplet:[12,119],autodetect:0,autogener:19,autologin:114,autom:[20,23,117,118,122],automat:[0,11,15,17,19,23,27,30,82,98,111],autonom:118,autonomi:[114,118],av:14,avail:[0,4,10,11,12,14,17,18,20,21,22,23,56,57,83,98,117,119,121],avoid:[0,5,11,12,19,20,23,117,122],awai:[45,68,69,87],awak:119,awar:[23,122],awk:[19,117],axvlifvmps02mvm8ndjc17x3lhsv1oi:122,b:[15,50,122,123],back:[2,12,15,16,17,19,23,49,98,100,122,125],background:[1,3],backup:[1,18,20,23],backupkei:22,backward:[0,23],bad:[0,11,17,121],balanc:19,bammifl1ymljbybqsvygum9vdcbdqsbtzxjpywwgmjyznzuxmcaxdte2mdmxndaw:122,banner:0,bare:4,base64:19,base:[0,12,15,16,19,20,45,54,68,73,87,94,118],basedir:[0,15],bash:[15,16,19,116],basi:[0,14,20,116],basic:[0,3,17,18,19,22,57,114,118,121],bastion1:[0,12,19,117,121],bastion:[1,2,3,4,5,7,10,11,12,13,14,15,16,21,22,23,25,26,27,28,30,32,48,50,56,57,59,64,71,72,74,81,82,84,88,89,92,93,97,98,99,100,103,105,106,111,112,113,114,115,116,117,118,120,121,122,123,124],bastion_account:[51,121],bastion_com:11,bastion_conf:1,bastion_debian10_target:16,bastion_vers:11,bastionip:11,bastionm:58,bastionport:11,bastionsync:[10,19],bastiontest:[16,21],batch:[18,19,57],beast:[18,118],becaus:[0,2,11,17,20,23,97,113,116,118,119,122,123,125],becom:[97,118],been:[0,4,6,7,9,11,12,13,17,19,20,22,56,74,82,100,116,118,119,122,125],befor:[0,1,2,4,6,7,9,11,12,15,16,17,19,20,22,23,51,66,74,89,98,116,122,125],beforehand:23,beggin:0,begin:[119,122],behalf:11,behav:122,behavior:[0,1,5,6,12,13,14,23,97],behaviour:[0,23,97],behind:117,being:[0,4,6,10,11,12,17,19,20,21,23,82,88,111,123],belong:[30,32],below:[0,3,5,10,11,12,15,16,19,20,21,22,23,34,45,52,53,55,63,68,69,70,80,87,89,90,91,98,113,114,115,116,117,119,125],belt:116,best:19,better:[17,114,116],between:[0,5,11,15,16,17,18,19,44,46,58,67,82,103,111,114,116,117,123],bewar:[45,68,69,87,103],beyond:118,bfw6cvlajvss5dy3o6jwdmk:122,bgzccszaezmfftgwxq:122,big:[0,118],bikei:122,bin:[0,11,15,19,20,21,23,118,119],binari:[0,15,20,23],bind:5,bit:[17,22,58,118,125],bite:17,blame:[43,85,104],blank:11,blindli:[27,97,116],blob:12,block:[0,11,12,17,29,57,118],blog:[17,115,118],blue:56,bmzorlwba6l5ehwlhbh1o0u4g:23,bodi:[5,121],bofh:[58,119],bogu:23,bookworm:[20,23],bool:[3,5,8],boot:19,bot:0,both:[0,5,11,12,17,19,20,23,56,64,117,121,123],bother:17,box:[12,20,125],branch:15,brand:[20,118],breakag:23,briefli:123,broadli:0,broken:[0,11],brought:22,brows:125,bsd:[15,20,123],bssh:[0,12,23,50,117,119,121,122,123],bsshm:119,bug:[0,13,14,16,116],build:[0,15,21,23],built:[1,23],builtin:[17,18,122],bullsey:20,bunch:11,bundl:19,busi:[5,9,11,23],buster:20,button:23,bypass:[14,23,58,78,89,97],bzst1:121,bzvhsvux:121,c3rhdglvbia5ytccasiwdqyjkozihvcnaqebbqadggepadccaqocggebaliay3ez:122,c:[11,12,14,19,20,22,62,119],ca:[17,122],cach:0,call:[0,2,3,4,6,7,8,9,11,12,15,17,18,19,20,21,23,25,56,116,117,119,121,122],callabl:56,caller:[0,116],can:[0,3,4,5,10,11,12,14,15,16,18,19,20,21,22,23,34,40,43,46,49,52,53,55,56,59,63,64,65,70,71,74,80,82,83,88,89,90,91,92,93,97,98,100,103,104,110,111,113,116,117,118,119,121,122,123,125],cannot:[11,22,118],capabl:118,card:[119,122],care:20,carefulli:[17,18],carri:97,cast:11,cat:[19,23],catastroph:4,categori:[11,119],caus:[20,22],caution:65,cd:23,cento:[20,23],central:[17,120],cert:5,certif:[5,17,19,64,122],certifi:[116,122],cet:19,cf:[23,27,82,111],chacha20:5,chage:0,challeng:[0,83],chanc:[17,19],chang:[0,4,9,10,11,12,17,19,20,23,66,89,97,98,117,122,123],channel:80,charact:[0,23,45,68,83,87,119],charg:18,chase:0,cheat:[44,67,103],cheatcod:0,check:[0,2,4,5,12,15,16,18,19,21,22,23,34,57,83,90,97,109,111,113,114,116,119,121,123],check_uid_gid_collis:19,checker:20,checkout:[15,20,23],checksum:19,chef:[23,118],chgrp:19,child:5,children:5,chmod:[14,19],choic:[5,17],choos:[12,14,19,20,44,67,103,125],chosen:20,chown:14,ci:20,cidr:[27,28],clariti:[12,56],classic:[5,12,23],clean:3,cleanup:[1,23],clear:[7,117,118],cli:124,click:125,client:[0,11,15,17,18,19,121],clipboard:19,clone:[15,20],close:[0,17,23,119,125],closest:30,clush:[18,57],cluster:[10,18,23,59,74,81],cmd:[25,51],cmdline:11,cmdlist:50,cmdtype:11,code:[0,12,15,16,17,18,19,22,23,51,97,116,117,118],collect:[9,19,23],collis:19,color:[57,117],colord:19,column:[11,119],com:[12,15,17,20],come:[11,16,22,118],comma:[51,106],command:[0,4,11,12,15,16,17,18,19,20,21,23,25,30,32,34,43,45,47,49,52,55,57,59,61,63,66,68,69,70,80,81,82,83,87,89,91,97,100,104,105,110,111,116,118,119,121,122,123],comment:[11,12,19,23,27,30,82,83,106,111,117],comment_clos:11,commit:[18,19],common:[4,11,18,123],commun:116,compact:117,compani:[0,18,114,118,122],companion:125,compar:12,compat:[0,19,23,64,121],compil:20,complementari:118,complet:[4,5,16,17,18,19,20,23,30,45,68,69,87,118,119,121],complianc:20,complic:[20,118],compon:[0,19,22,118],compos:[4,118],compress:[0,4,11,23],compromis:[17,22],comput:[0,119,121],concern:23,concurr:17,condit:14,condition:12,conduct:12,conf:[1,12,14,19,20,21,23,58,82,111,121],confid:12,config:[0,1,2,3,4,6,7,8,9,10,16,19,20,23,89],configd:12,configur:[0,2,3,4,6,7,8,9,10,11,14,15,17,18,21,22,48,57,64,83,98,100,105,116,118,121,122,123],confirm:[14,43,51,77,78,85,104],confus:17,congratul:119,connect:[0,5,9,10,11,12,14,15,16,17,18,21,23,27,30,32,46,51,58,61,74,82,83,89,97,98,105,111,113,114,116,117,118,120,121,122,123,125],consequ:89,conserv:116,consid:[0,6,9,17,20,23,34,46,53,55,70,90,91,118,122],consider:23,consist:[0,15,23],consol:[11,17,19,20],constantli:116,constraint:[44,67,103],construct:[11,16],consumpt:114,contain:[5,9,11,13,19,22,23,34,53,55,70,83,90,91,117,121],container:[17,21],content:[14,63],continu:[19,22,23],contrari:122,contrib:[15,23],contribut:18,control:[11,17,19,20,116],convers:0,convert:[0,11],cool:17,cool_languag:17,copi:[15,19,20,21,82,119,125],core:[12,18,115,118],corner:23,correct:[0,16,19],correctli:[0,11,12,16,17,19,23,119,121],correl:[11,23],correspond:[0,11,19,22,23,54,73,94,118,121,125],could:[17,22,23,116,118],couldn:[11,23,119],count:62,counter:[0,89],counterpart:[72,93],coupl:11,cours:[0,5,9,17,19,20,21,23,27,113,118,119,121],cover:[19,20,82,111,118],cp:[15,118],cpu:[0,19],crash:[11,23],creat:[0,2,4,9,11,14,15,16,17,18,22,23,48,57,89,105,114,117,118,119,120,121,125],created_bi:11,creation:[0,11,20,46],creation_tim:11,creation_timestamp:11,credenti:[2,12,18,22,57,121,125],critic:0,cron:[2,3,4,6,7,8,9,11,19,20,23],crond:[2,6,7],cronjob:0,crowd:120,cryptographi:23,cryptsetup:20,ctrl:[19,119],cumbersom:12,cumul:12,curl:121,current:[0,4,11,12,15,19,23,57,121,122,123],curv:[23,125],custom:[0,21,23],cut:[17,21,117],cv25519:19,cve:[18,23],cvss:[14,23],cww6vvsfydwn01kc6ylrwm5fin:122,cycl:11,d1:122,d2bdf9b5:19,d5b1thkkgstsfzvzoopwijj86ciwpcyunfej:122,d5blcrakrt9p8mst7bhwu14ghjddhhdy4rmnxape93oxbnqijqt34ozvtklb0qoor:122,d:[0,5,11,12,15,16,18,19,20,21,22,23,97,117],da97efd1:2,dac:116,daemon:[0,5,11,12,17,19,20,22,23,121],dai:[0,2,4,9,12,17,23,83,89,97,121,122],daili:[19,20],danger:0,dangl:3,dark:20,dash:25,data:[4,10,11,17,19,22,23,52,54,61,89,117,121],databas:[11,17,18,23,116],date:[11,15,19,20,23],datetim:[11,122],dd:[22,74],de:17,deactiv:[83,98],deal:118,dear:119,deb:[20,23],debian10:21,debian11:20,debian12:[12,15],debian:[15,20,23],debug:[4,11],dec:11,decentr:120,decid:[12,17,20,122],decis:[0,117],declar:[19,105,113,116,118,123],decor:0,decoupl:114,decreas:23,decrypt:[4,19],dedic:117,dedmrmsbptsrc3t7rwoqca80iq1jpvdm5gw:122,deem:[0,23],deepli:17,defin:[0,2,4,12,16,17,97,98],del:[11,23],delai:[5,10],deleg:[18,38,114,115,118],delet:[0,2,4,7,11,16,17,19,22,40,48,65,105,118],deliveri:17,deni:[0,19,74,83,116,119,121],depend:[0,5,11,12,15,19,20,62,80,114,117,118,119,121],deploi:[1,22,23,45,68,87],deposit:[64,83,106],deprec:23,depth:19,describ:[11,118],descript:[0,11,98],design:[0,11,17,23],desir:23,desk:[19,20],desktop:17,dest:63,destin:[0,9,11],detail:[0,11,18,22,23,74,117,119,122],detain:[72,93],detect:[10,11,17,20,23],determin:0,dev:[20,58,97],develop:[15,20],devenv:15,devic:[5,17,23,45,54,68,69,73,87,94,114,118,121,122],devop:18,dgvzdgf0aw9umiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeawdhp3yui:122,dialect:17,dialog:125,did:[23,117,119],didn:[0,12,23,119],differ:[0,9,11,12,15,18,19,22,23,44,52,56,67,103,114,123],dir:4,direct:[19,106,121,123],directli:[0,2,4,6,7,9,10,11,12,16,17,20,21,23,64,65,119],directori:[0,4,5,7,9,10,11,15,19,20,23],dirti:18,disabl:[0,3,4,5,9,11,12,14,20,23,46,58,83,89,97,98,113,117,122],disallow:24,disappear:17,disconnect:[0,12,119,121],discourag:[0,15,17,20,22],discrep:[19,22],discret:12,discretionari:116,disengag:0,disk:[4,17],displai:[0,11,12,17,23,52,56,57,74,86,92,105,125],dist:[19,23],distant:4,distinct:[17,117,121,123],distribut:23,distro:[5,12,19,20,22,80],dive:119,dizzi:115,dk:119,dn:[0,18,34,55,70,91],dnssec:19,doabl:118,doc:[1,15,19],docker:[16,18],docker_build_and_run_test:15,dockerfil:[17,21],documen:12,document:[0,15,19,20,22,23,97,114,117,119,122,123,124],doe:[0,14,16,18,19,97,98,113],doesn:[0,4,11,12,16,17,19,20,23,45,68,75,76,82,87,95,96,111,116,117,118,119,121],don:[0,2,4,5,6,7,8,9,10,11,14,15,17,19,20,21,22,23,25,27,45,51,53,54,56,58,60,64,68,70,73,77,83,85,87,90,91,94,97,98,103,113,116,122,123,125],done:[0,11,12,17,19,20,22,23,34,50,55,60,63,70,80,82,91,116,117,119,121,125],doubl:[23,25,64,106],down:[17,19,22],download:[14,20,23,27,28,30,32,63,80,82,84,111,112,114,123],dqaxohbima0gcsqgsib3dqebcwuamcsxktanbgnv:122,dr:17,draw:0,drive:17,drop:[0,5,19,23,125],drugngsk:121,dry:[15,19],dss:116,dtm5hksykt18bnvfft:121,due:[11,17,20,121,123],dummi:15,dump:[52,89],duo:0,durat:[11,23,27,30,46,82,83,98,111,119,122],dure:[4,11,12,16,20,23,119],dynam:17,e192fce7553a:11,e9e4baf6873b:11,e9qkc7d6:121,e:[0,4,10,11,12,14,17,19,20,27,46,52,82,88,97,106,111,113,117,119,121],each:[0,4,10,11,12,15,16,20,21,51,74,103,117,118,121,122],earli:[11,17],eas:15,easi:[0,90,114,116,119],easier:[0,11,17,22,117],easili:[23,122],ecdh:5,ecdsa:[0,5,23,44,58,67,103,119,122],echo:[19,23,50],ed25519:[0,11,12,15,19,44,58,67,103,119,122,125],eddsa:125,edg:18,edit:[4,19],ee4c91000b75:11,effect:[0,15,19,20,22,47,97,98,118,121,122],effici:118,egress:[11,14,17,19,21,30,32,44,48,52,57,58,82,89,97,103,105,114,118,119],egress_ssh_key_algorithm:11,egress_ssh_key_encrypt:11,egress_ssh_key_s:11,ehjupeauhq7n0tjzmf1x7kelx9fzzm9heuxujvzv7xwiuga4zm05:122,either:[0,10,11,12,14,16,17,20,23,27,44,56,67,81,103,116,117,118,120,121,122,123],elev:12,elig:4,ellipt:23,els:[0,9,10,17,20,48,88,118],email:19,embed:121,emit:[11,23,122],emoticon:0,emphas:117,empti:[0,1,2,3,4,5,6,7,8,10,11,23],enabl:[0,4,11,12,14,17,18,20,23,58,80,89,97,98,116,117,121,122],enableaccountaccesslog:[11,23],enableaccountsqllog:11,enableglobalaccesslog:[11,23],enableglobalsqllog:[11,23],enablesyslog:19,enact:118,enclos:117,encod:121,encount:[11,117],encourag:[19,23],encr:19,encrypt:[1,11,18,22,23,44,67,103],encrypt_and_move_delay_dai:4,encrypt_and_move_user_logs_delay_dai:23,encrypt_and_move_user_sqlites_delay_dai:23,end:[2,11,12,19,20,22,23,118,119,122,125],endless:17,enforc:[0,14,15,23,46,89,97,98,114,116,118,122],engin:16,enhanc:0,enough:[0,4,5,14,19,23,89,123],enrol:78,ensur:[0,2,4,5,9,10,11,12,15,16,17,20,23,45,68,82,87,111,114,116,121,122,125],enter:[11,12,19,20,21,103,119,121,122,125],entir:[12,18,23,97,117],entri:[16,18,20],entropi:19,env:15,environ:[0,1,12,14,17,18,19,20,44,67,103,116,123],envvar:0,eo:19,eol:23,epvf1cvvzoeqf:23,equival:[16,17,119,121],era:115,eras:19,err:[11,15,117],err_member_cannot_be_guest:117,error:[0,11,12,15,16,20,22,23,58,80,117,119],error_cod:16,escal:0,escap:[0,116],escrow:11,especi:[11,19,119],essenc:12,establish:[0,11,14,125],etc:[0,4,5,11,12,14,15,17,18,19,20,21,22,23,27,58,82,97,111],etzzxxbvu9kibszyhvb:122,even:[0,6,10,11,12,15,17,18,19,20,22,23,53,57,83,97,116,117,118,119,122,123],event:[0,11,23,122],ever:[17,97],everi:[0,11,12,15,89,116],everybodi:[0,17,118],everyth:[2,11,19,52,89,119],everywher:[0,17,19],evolv:19,exact:[11,16],exactli:[0,12,16,46,119],exampl:[0,2,4,5,10,11,12,15,17,18,19,20,22,23,25,27,50,57,63,80,105,118,119,121,122,123],except:[0,2,11,16,52,89,122],exchang:61,exclud:[4,12,14,19,34,52,53,55,70,89,90,91],exclus:[0,116],excus:[58,119],exec:21,execut:[0,11,12,16,23,116],execv:11,exist:[0,4,11,12,14,16,18,19,20,30,32,45,68,87,90,109,117],exit:[0,5,12,16,51,57,62,117],expand:[0,11,105],expect:[0,11,12,14,15,16,17,20,23,49,64,106,125],expir:[0,3,8,12,23,27,30,58,82,83,89,97,105,111,118,122],expiri:117,explain:[0,12,16,18,19,115,120,123],explicit:[12,23,117],explicitli:[0,14,23,58,97],expos:117,express:0,extend:116,extens:[19,114],extent:0,extern:[0,2,15,19,114],extra:[52,89],extract:[118,122],extrem:[0,118],ey:11,ezb1supteecng7qdr6qvkbxov586fx:122,f0:19,f25fe71c6635:11,f2:[21,117],f4cca44a848:119,f50bffc49143c821:22,f9:122,f:[0,11,16,17,19,21,65],fa:12,facil:[0,2,3,4,6,7,8,9,10,23],fact:[0,22,113,117,121],facto:17,factor:[14,18,20,58,89],fail:[0,15,16,22,23,51,80],faillock:0,failur:[0,4,51],fall:[12,19],fallback:[19,20,45,68,87,121],fals:[0,5,11,17,23,58],falsi:0,familiar:0,fanci:17,faq:[18,20,21],fast:[11,17],faster:[23,90,119],favorit:20,fb00e1957b22:119,fd:19,featur:[0,5,11,12,14,15,16,18,20,23,61,119,122],fed:57,feed:[12,125],feel:14,fetch:[0,21,22,23],few:[0,7,11,12,15,16,23,57,118,119,122,124],ffee33abd1ba:11,fido2:[15,23],field1:[11,16],field2:[11,16],field:[11,16,19,23,117],fieldx:16,fifth:18,file:[0,2,3,5,6,7,8,9,10,12,14,15,16,18,20,21,22,50,52,57,66,71,92,114,119,123,125],filenam:[0,11,15],filer:[4,11],filesystem:[2,19,20,22,116,122],fill:[11,19],filter:[11,16],find:[11,13,16,17,23,63,79,80,122],fine:[0,17,20,23],fingerprint:[11,23,27,65,82,111,119,122],fire:12,firewal:[0,58],firmwar:122,first:[0,4,11,12,17,18,19,21,22,23,52,118,120,123,125],fit:[0,12,17,20,22,119],fix:[0,11,14,16,19,23],fjus6dgh1wdkpy4pdcvkmqrpeetb42bntsziwjygi1:121,flag:[0,12,19],flash:19,flexibl:[118,122],flow:[0,23],fly:0,fml0y7z4vgdo:122,focus:[12,18,114],fohv:122,folder:[0,1,2,15,16,19,21,23,63],follow:[0,10,11,12,14,15,16,19,20,21,22,23,58,63,80,89,117,119,121,122,123],foo:11,footprint:17,forbid:19,forbidden:58,forc:[0,12,14,15,19,23,27,58,64,82,111,114,119,121,122],force_kei:11,forcefulli:10,forcekei:117,forcepassword:117,foreground:16,forese:23,forev:0,forg:20,forget:[0,2,4,6,7,9,20,21,23,25,57,58,98,122,125],forgot:122,forgotten:[12,17],fork:14,form:[0,23,97],format:[0,2,4,5,18,22,23,58,64,82,106,111,121,122],forth:15,fortun:58,forward:[5,17,121],found:[4,11,12,14,15,16,19,20,21,23,98],fourth:18,fp:65,fpr:19,fr5lspymhz:122,frame:11,freebsd:20,freez:105,fri:[89,119],friendli:0,from:[0,2,3,4,6,7,8,9,10,11,12,14,15,16,17,18,19,20,23,25,29,35,40,48,57,58,64,71,74,82,83,92,98,105,106,111,114,116,117,118,119,121,122,123],front:[0,114],frozen:[86,89,105],fslist:19,full:[0,5,11,15,22,23,61],fulli:[11,17],functionali:12,further:[11,19],futur:[0,23,30,31,32,33,52,89,122,123],fx:122,g0fo:121,g:[0,10,11,12,19,27,82,88,111,117,121],gain:[0,71,92],garbag:[9,23],gatekeep:[0,11,14,18,38,42,48,56,89,118],gather:[11,52,89,90],gb:17,gcm:5,gen:19,gener:[0,11,12,15,18,20,44,48,57,63,67,80,103,105,117,118,121,122,125],genesi:115,geoclu:19,get:[0,1,4,5,9,11,15,17,18,19,21,22,23,40,58,65,80,82,88,99,116,118,119,121,122],gib:5,gid:[11,119],gigabyt:11,git:[18,20,23],github:[0,12,14,15,17,19,20],give:[0,11,17,19,20,23,31,66,110,117,118,123,125],given:[0,5,9,11,12,14,16,19,23,30,32,34,53,55,70,90,105,117,118,119,121],global:[4,11,14,17,18,19,23,46,83,97,98,120],globalsql:[11,23],globalsql_clos:23,gnat:19,gnupg:[19,23],go:[0,1,12,17,19,23,49,98,120,122],goal:123,goe:19,gone:118,good:[0,4,12,15,16,17,18,19,20,21,22,23,44,67,103,118,119,121],googl:[0,19,20],got:[11,18,19,23,118],govern:[1,6,9],gpg1:23,gpg:[2,4,17,18,23],grace:[1,18,98],grain:[0,20,23],grant:[0,14,17,19,20,35,43,56,63,80,105,110,116,117,118,119,121,123],great:[20,22],green:56,greet:21,grep:[19,117],greppabl:16,group:[0,2,3,17,18,20,23,31,33,50,56,57,58,63,70,80,88,89,91,97,105,113,114,116,117,119,120,123],groupaddaclkeep:[18,48],groupaddgatekeep:[18,48],groupaddguestaccess:[18,31,32,35],groupaddmemb:[18,30,35,50,123],groupaddown:[18,47,48],groupaddserv:[12,18,29,63,80,121,123],groupcreat:[18,89,105],groupdelaclkeep:[18,48],groupdelegresskei:[18,48],groupdelet:[18,43,89,105],groupdelgatekeep:[18,48],groupdelguestaccess:[18,30,35],groupdelmemb:[18,32,35],groupdelown:[18,47,48],groupdelserv:[18,29],groupdestroi:[18,48,104],groupgenerateegresskei:[18,48],groupgeneratepassword:[18,23,48,121],groupinfo:[12,18,27,40,57],grouplist:[18,57],grouplistguestaccess:[18,32,33,35],grouplistpassword:[18,23,27,57,121],grouplistserv:[12,18,30,52,57,117],groupmodifi:[12,14,18,48],grouptransmitownership:[18,48],grow:[11,23],growth:5,grp1:27,grp2:[27,89],grp4:50,gshadow:17,gsqkawcebgiealeg1jaqbgorbgeeaylecgmibaidatapbgorbgeeaylecgmjbaeb:122,gthreepw:11,guarante:[16,22,117],guess:[118,125],guest:[1,11,23,30,32,33,35,37,41,46,118],gui:[118,123,124],guid:20,guidanc:122,guidelin:[20,63,80],guybrush:12,gvf:19,gwvbcrp3ymbsw:122,gygxhes2nmzn37rll6vvpz4exm29urqu3hajyo0ha:122,gyxmyjao:121,gz:[2,19,20,22],gzip:19,h:[0,11,14],ha:[0,3,7,9,10,11,12,13,15,17,19,20,22,23,47,56,66,82,89,91,113,116,117,118,119,121,122,124,125],hack:17,hacker:20,had:[33,118,122],halt:[11,116],hand:[5,12,17,18,22,123],handi:[21,118],handl:[0,1,2,4,7,11,17,19,20,23,97,114,118,122],happen:[3,4,11,17,19,20,23,59,74,81,118,121,122,123],hard:[5,17,125],hardcod:[0,116],harden:[17,18,20],hardenedbsd:20,harder:118,hardwar:[0,15,18,20,64,98,121,122],harm:23,hash:[20,23,27,57,82,105,111,117,121],have:[0,2,3,4,6,9,10,11,12,13,14,15,16,17,19,20,21,22,27,38,46,52,53,56,57,58,59,63,74,80,81,103,105,110,116,117,118,119,120,121,122,123,124,125],haven:100,he:0,head:[20,21],header:[5,19,121],heavili:12,help2:16,help:[0,11,12,15,16,18,19,20,21,22,23,25,57,82,111,119,120],helpdesk:122,helper:[11,19,20,23,63,80,116],henc:[0,3,11,12,17,19,20,22,23,116,117,118,122,123],here:[0,10,11,12,13,16,17,18,19,20,23,58,117,118,119,120,122],herebi:12,heterogen:17,hh:74,hi:[0,11,30,32],hide:[17,70,91],hierarchi:[20,22],high:[9,10,11,18,22,121,122],higher:[0,4,46],highest:118,highli:17,highlight:[0,56],highwai:20,hint:[11,119],hit:[23,125],hmac:23,holder:[119,122],hole:118,home:[0,2,4,5,7,9,11,15,17,18,19,22,23,98,118,119,122],homedir:1,honor:14,hood:0,hook:[17,18],host:[0,2,11,12,17,19,20,21,23,27,28,30,32,51,57,61,63,74,80,82,84,97,111,112,113,119,121,123,125],host_bast:11,host_from:11,host_to:11,hostfrom:11,hostkei:19,hostkey_chang:11,hostlist:51,hostnam:[0,11,19,34,49,51,55,70,91],hostto:11,hour:[0,23,122],how:[0,2,4,10,16,18,19,22,63,80,98,118,119,122,123],howev:[0,1,11,12,17,23,64,66,104,122,123],howto:124,hqlhcx9tdgj5zhhvd:121,html:12,http:[0,1,11,12,15,17,18,20,23,57,114,117],http_proxy_port_or_zero:15,human:[0,11,12,90,98,117],hundr:121,hup:11,hypervisor:20,hzusxrx9ghm4ma0huso9f0ubiso:121,i:[0,2,4,10,11,12,14,16,18,19,20,21,46,50,52,57,58,82,97,106,111,113,118,119],icmp:62,icon:18,id:[2,4,11,14,22,40,65,74,79,119],id_backup:2,id_ed25519_agroup:11,id_ed25519_backup:4,id_master2slav:[10,19],id_rsa4096_priv:11,idea:[0,4,15,17,19,117,118,121],ident:0,identifi:119,idl:[0,5,17,19,46,58,89,97,119],idlekilltimeout:[17,46,97],idlelocktimeout:[17,46,97],ignor:[0,4,5,10,11,19,45,68,69,87,97,113,117],ijo9mqvvso6hh9kvpxguww9blpqnpchswbhsakb:122,imag:[15,21],immedi:[11,14,18,27,98,116],immun:[23,89,97],immut:[11,83,116],immutable_kei:11,impact:[9,13,23,121],imperson:[0,11,26,118],implement:[12,23,117,122],impli:[0,12,16,23],implic:17,implicit:[0,11,23,118],implicitli:[0,23],imposs:11,impract:118,impress:17,improperli:17,inact:[0,12,81,83,89,90,97,105,119],inc:11,includ:[0,5,11,12,14,17,18,19,20,22,23,34,52,53,55,70,89,90,91,117,118,119,121,122],incom:[0,118],inde:[7,19],independ:19,index:18,indic:[0,11,16,19,23,56],individu:[118,122],infinit:62,info:[0,12,16,18,21,25,46,50,52,57,89,90,108,119,121,122],inform:[0,4,10,11,15,17,18,20,21,23,57,63,74,80,90,105,110,117,119,121,122],infrastructur:[0,17,18,19,20,23,117,118,119],ingress:[11,12,17,19,23,57,58,83,89,97,105,114,121,122],ingressrequirepiv:[98,122],inherit:0,init:[5,20],initi:[12,23],inon:19,inotifi:0,input:[0,12,17,22,58,116,125],insert:[11,23],insid:[15,19],inspect:19,inspir:118,instal:[0,5,10,11,12,15,23,58,83,111,113,118,119,120],instanc:[15,19,20,22,23,57,59,74,81],instantli:118,instead:[0,4,10,11,12,16,17,19,20,23,30,31,32,46,117,119,121],instruct:[0,12,18,19],integ:[0,5,82,111],integr:[16,18,19,118],intend:117,intens:[0,23],interact:[0,11,15,17,18,19,21,23,58,60,64,65,83,86,103,106,114,117,119,125],interactivemodebydefault:23,interactivemodeproactivemfaen:12,interactivemodeproactivemfaexpir:12,interest:[11,12],interfac:11,interfer:116,intern:[0,12,17,20],interpret:0,interrupt:11,intersect:123,intertwin:17,introduc:23,introduct:[18,114],intrus:17,invalid:[16,22],invoc:0,invok:117,involv:117,io:[0,12],ip1:[64,106,122],ip2:[64,106,122],ip:[0,9,10,11,14,15,19,23,29,30,32,49,51,57,58,61,74,82,84,106,111,112,117,118,119,123,125],ip_bast:11,ip_from:11,ip_to:11,ipbt:11,ipfrom:11,iptabl:20,ipto:11,irc:19,irrelev:17,ish:52,iso:116,isol:117,issu:[11,14,17],item:[0,5,19,118],its:[0,4,5,10,11,12,14,17,19,20,22,23,46,64,74,98,113,116,117,121,122],itself:[0,17,18,19,22,97,116,118,119,121,125],j2t:122,j:17,jargon:0,jd:19,jdoe12:89,jdoe:[23,89,122],jit:[0,18,23],job:[19,20,23,63,80,121],joe:11,john:19,johndo:[0,12,82,111,117,119],joke:17,jolt:119,jq:[16,117],json:[12,18,23,52,58,82,89,90,111,116],json_end:117,json_output:117,json_start:117,jump:12,jumphost:17,jun:121,just:[0,10,11,12,16,17,19,20,22,23,27,61,63,80,97,113,118,119,120,121,122,125],keep:[0,2,5,11,15,17,19,20,23,119,121],kei:[0,1,4,5,8,10,11,12,14,15,17,18,20,21,23,27,30,32,45,48,52,54,57,58,68,73,82,83,87,89,94,97,103,105,106,111,113,114,116,117,118,119,121,123,125],kept:[6,11,23,98,121],kernel:20,kerneloop:19,kernoop:19,key1:4,key2:4,key3:4,keyagroup:11,keyboard:[0,12,17,19,58],keyfil:19,keygen:[19,122],keyid:4,keykeep:11,keylin:119,keyr:[2,4,22,23],keysomegroup:11,keystrok:[0,11],kf0xsjial4pkgvxeaqtp0:122,khm3:122,kill:[0,5,19,23,46,58],kind:17,kl5g8tr:122,knob:23,know:[0,5,12,17,19,20,22,23,45,68,69,87,113,117,120],known:[0,11,17,20,23,57,116,119,121,122],known_host:66,ko:117,ko_access_deni:117,kywypciiu7cmtlprykl5salwmucaz8dzpk5flppeqmxgqnrosse67ixiv3bnypa1:122,l3zbwzfh9mtpo4wlx29jd8ltm5sklfejtrz:23,l:[11,14,65],la:[0,64],lack:20,languag:17,larg:[11,118],last:[0,3,4,12,23,89,118,119],lastlog:19,later:[0,19,20,125],latest:[20,22,23],launch:[0,5,11,15,19,20,25,57,59,81],launch_tests_on_inst:15,layer:[4,17,20],ldap:0,lead:11,leak:0,leap:[20,23],learn:[63,80,119],least:[0,4,5,11,12,17,19,23,89,118,123],leav:[0,5,12,118,121,125],lechuck:[11,122],left:[0,2,4,12,20,21,119],legaci:114,legend:17,legit:[66,122],length:[19,23,121],less:[0,118],let:[11,12,16,21,117,119],level:[4,17,20,23,56,116,118,119,122],leverag:[17,116,117],li:118,lib:[11,15,19,20],libexec:19,librari:[5,11,17,121],lift:123,like:[0,12,15,17,18,19,23,57,116,117,118,121,125],limit:[4,5,20,46,74,82,111,118],line:[0,11,12,15,16,19,50,117,119,122],linger:1,link:[11,115,122],lint:15,linux:[15,19,20,21,23,123],list:[11,12,15,17,19,22,23,29,32,35,36,37,38,39,41,42,46,51,52,57,82,88,99,105,106,117,119,120,121],listen:[5,121],littl:118,live:[0,16,17,20],ll:[0,2,3,4,5,6,7,8,9,10,11,12,15,16,17,19,20,22,23,30,45,56,63,64,65,68,69,75,76,80,83,87,88,103,106,113,118,119,121,122,125],llmb9giamjnffr6gj7gzonik2jdltecb:121,lmbm2xikb1bsw3skjhomv30pq:122,lngt:122,load:[12,19,119,125],local6:[2,3,4,6,7,8,9,10,23],local7:0,local:[0,2,4,11,15,17,19,23,114,116],localfil:63,locat:[4,9,12,15,19,20,22,63,80,125],lock:[0,11,18,19,24,46,57,58,81,105,122],log:[5,15,17,18,114,116,119,121,122],log_request_respons:23,log_request_response_max_s:23,logarithm:11,logfil:19,logic:[12,17,116,117,118],login:[0,12,19,23,24,28,30,32,63,80,82,84,97,111,112,119,125],logkeep:[0,4,11,23],logrot:[2,4,6,7,9],longer:[0,3,6,12,23,33,39,41,42,118],look:[11,12,16,17,19,34,66,117,119,125],loopback:19,loos:17,lose:[20,122],loss:4,lot:[0,9,11,15,17,19,20,23,50,118],low:[0,4,5,17],lower:[0,46],lt:[20,23],lucki:0,luks1:20,luks2:20,luksformat:20,m2m:[12,117],m:[0,11,15,57,58],ma0gcsqgsib3dqebcwuaa4ibaqaq9o6h02krvsmbysz23r6cntn:122,machin:[0,11,15,18,19,21,22,27,28,57,70,71,91,92,113,116,118,119,121,123],magic:[0,118],mai:[0,4,7,9,11,12,14,15,16,17,19,20,22,23,33,44,64,67,103,117,118,119,122],mail:17,main:[16,18,19,20,22,49,114,116,118,122,123],mainli:[0,12,109,110,114,116],mainten:26,make:[0,17,19,20,23,90,97,119,120,121,122],man:[0,66,97,114],manag:[0,4,17,18,19,20,23,26,36,37,38,39,41,42,119,120,122],mandat:11,mandatori:[1,2,4,10,12,20,23,121,122],mani:[0,17,118],manner:22,manual:[12,18,19,23,57,81,118,121],map:[116,118],mar:19,margin:19,mark:19,mask:[23,82,84,111,112],master:[0,4,12,58,119],match:[0,11,12,15,16,19,22,34,53,55,70,90,91,113,117],matter:[5,12,17],max:[0,62,83,97],maximum:[0,5,10,20,23,89],mayb:23,md5crypt:121,mdawmfoydziwntiwnde3mdawmdawwjahmr8whqydvqqddbzzdwjpy28guelwief0:122,me:[12,58],mean:[0,2,3,4,6,7,8,9,10,11,18,20,21,23,58,80,97,113,118,121,123],meaning:[12,98],meant:[0,44,67,103],measur:[0,2,4,89,114,121],mechan:[0,17,18,23,45,68,87,117,122],megabyt:5,mem:19,member:[11,12,14,17,32,35,37,41,46,52,89,113,120,123],membership:20,memori:17,menu:[20,21,119],mere:17,merg:17,messag:[0,12,18,23,24],meta:57,metadata:[11,57,105,122],method:[12,15,19,22,118,121],mfa:[0,15,18,20,23,46,58,89,97],mfa_requir:12,mfapasswordinactivedai:12,mfapasswordmaxdai:12,mfapasswordmindai:12,mfapasswordwarndai:12,mflejiwskzbkyu5g2gg042tulnnckplmmnpnijgnd8rpnlddu:122,mfoydziwntiwnde3mdawmdawwjalmsmwiqydvqqddbpzdwjps2v5ifbjvibbdhrl:122,microsecond:0,microsoft:123,middl:[66,114],might:[0,4,11,12,13,15,16,17,18,19,20,22,23,64,114,117,118,123],miic5jccac6gawibagijakt:122,miididccagigawibagiqaajpkefbm:122,million:121,millisecond:[11,23,121],mimic:118,min:0,minimum:[0,4,6,15],minor:[11,20],minut:[12,15,17],misbehav:11,misconfigur:[11,23],mismatch:19,miss:[0,2,3,4,6,7,8,9,10,11,20,23],mistak:[22,118],mitig:23,mkdir:20,mkhash:[20,23],mm:[22,74],mobil:0,mode:[0,11,15,17,19,21,23,26,58,86,90,116,117,118,119,125],model:[18,19,118],modern:20,modif:[0,4,11,15,19,58,83],modifi:[0,4,5,11,12,14,15,16,17,20,23,48,105,119,122],modul:[0,5,15,16,17,20,23,116],modular:116,mon:[11,121],monitor:[23,49,121],monkei:11,month:[4,11,23],moot:20,more:[0,4,5,10,11,12,14,16,17,19,20,21,23,58,63,74,80,88,90,117,119,120,121,122,123,124],moreov:118,mosh:[0,58,114,119],mosh_server_network_tmout:0,mosh_server_signal_tmout:0,most:[1,16,17,22,45,46,68,69,87,115,116,117,118,121],mostli:[11,124],mount:[4,15,19,22],mountpoint:19,mous:125,move:[4,23,125],mr8whqydvqqddbzzdwjpy28guelwief0dgvzdgf0aw9umcaxdte2mdmxndawmdaw:122,msg:11,msgtype:11,msxkgtpdpvhveqnmhh4qyyryixwwatbdcgoqd:122,mtr:[18,57],much:[0,3,4,19,23,98],multi:[4,18,58,89,121],multipl:[12,15,34,53,55,70,90,91,121],must:[0,2,4,6,9,12,14,16,22,23,30,32,58,82,83,89,111,116,121,123],my:[0,18,58],mybastion4:19,mybranch:15,mygroup2:52,mygroup:[117,123],myhostnam:11,mynam:[19,119],n:[0,14,15,19,50],name:[0,4,11,12,15,16,17,19,20,21,22,23,25,30,32,34,40,43,44,46,53,55,56,70,82,83,85,88,89,90,91,94,99,103,104,106,107,108,111,117,119,121,125],navig:125,nc:[18,57],necessari:[20,118],necessarili:17,need:[0,1,2,3,4,9,10,11,12,14,15,16,17,18,19,22,23,31,45,52,54,56,63,68,69,73,80,87,88,90,94,98,110,116,118,119,120,121,122,123,125],nest:117,net:[0,27,28,47],netbsd:20,netcat:61,netconf:114,netdevic:121,netfilt:0,network:[17,19,23,27,58,82,111,114,118,121],network_cli:17,never:[0,2,4,9,12,23,98,117,118,122,125],nevertheless:15,newer:19,newli:[0,19,23,121],nexpir:19,next:[11,12,19,20,22,23,119,125],ng:[0,11,17,19,20,23],nice:[118,122],nkei:19,nname:19,nobodi:[0,17,20],node:[22,23],nois:113,nomfa:12,nomin:[11,118],non:[0,16,17,19,98,114,122],none:[0,2,4,12,46,58,65,97],nopam:12,nor:[4,6,14,17,41],normal:[0,4,11,14,16,17,19,24,118,119],notabl:20,notat:27,note:[0,2,4,6,7,9,10,11,12,16,17,19,20,21,22,23,33,34,45,46,47,49,52,53,55,56,59,61,63,64,68,69,70,74,75,76,80,81,82,87,88,90,91,95,96,98,111,113,117,119,121,122,123],noth:[0,17,23,118],notic:[23,56,117,119],now:[4,12,14,17,19,20,21,22,113,119,121,122,125],nrpe:23,ns:19,nsub:15,nsubkei:19,ntjl0d2k2q8xtwidaqaboxuwezarbgorbgeeaylecgmdbamfagqwdqyjkozihvcn:122,ntp:19,number:[0,2,4,5,6,11,12,20,23,27,30,45,62,68,82,87,89,111,118,122,125],numer:22,nunus:15,nutshel:118,nxu3bbssuqnwi2rqhcmthjcc8rjfdzpydlw1yr:122,nxvwu0db0bq9:121,o6jr8w0x:121,o:[10,11,17,122],object:15,observ:17,obvious:[0,17,19,22],occur:[11,23],ofbx:122,off:[5,17,114],offici:23,offset:[0,19],often:[11,12,17,119],ok:[11,12,16,23,117],ok_no_chang:117,okai:[4,19,22,23],old:[2,4,17,23],older:[6,19],omit:[0,2,12,23,27,28,30,32,34,53,55,56,58,70,82,84,88,90,91,99,111,112,121],onc:[7,8,12,16,19,20,22,23,45,60,63,68,69,80,87,121,125],one:[0,1,4,9,11,12,15,16,17,18,19,20,22,23,25,30,45,46,59,68,71,81,82,83,87,92,106,117,118,119,120,121,122,123],onelin:50,ones:[1,11,12,19,23,52,89,122,124],oneself:121,onli:[0,1,2,4,5,9,11,14,15,16,17,19,20,22,23,27,30,32,34,45,52,53,54,55,56,59,64,68,69,70,72,73,74,81,82,83,87,89,90,91,93,94,97,98,109,110,111,113,116,117,118,121,122],onlin:[14,19,49],onto:[22,119],ooe2zhdpabfekqu3gtsiks7yl:121,open:[0,6,17,18,19,23,56,116,125],openbsd:20,openpgp:19,opensourc:17,openssh:[0,15,17,23,123],openssl:5,opensus:[20,23],oper:[12,17,18,19,116,118,123],operation:22,opposit:[16,30,32],opt:[0,11,12,19,20,21,23],option:[11,12,15,18,19,20,23,24,25,27,28,30,32,34,49,51,52,53,55,57,64,65,70,74,83,84,86,89,90,91,97,98,103,105,106,112,113,117,121,122,123],orang:56,order:[0,5,19,22,119],org:[0,4,11,19,22,27,58,117,119,121,122,123],organ:18,origin:[11,17,22,122],ornament:11,orphan:[1,6,19],os:[15,17,19,20,22,23,58,62],osd:11,osh:[0,1,11,16,18,19,21,23,24,25,27,28,30,31,32,33,34,36,37,38,39,40,41,42,43,44,45,46,47,49,51,52,53,54,55,56,57,58,59,60,61,62,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,106,107,108,109,110,111,112,113,117,119,121,122,123],osh_onli:11,other:[1,2,4,11,12,14,15,16,17,18,19,20,22,23,30,32,38,44,67,70,88,91,97,103,106,114,116,117,118,122,123],otherwis:[0,2,4,5,11,14,16,17,19,20,22,23,46,64],otp:[19,97],our:[0,10,11,12,17,18,19,23,119,121],out:[4,5,12,19,20,23,50,52,89,117,118,122],outdir:15,outgo:106,outlin:[12,15,23,123],output:[0,2,3,4,6,7,8,9,10,11,15,16,17,19,23,34,55,57,60,70,88,90,91,105,117,121,122],outsid:[0,118],over:[0,12,18,19,20,21,23,34,46,53,55,63,70,80,90,91],overflow:[58,119],overhead:121,overlap:0,overrid:[0,11,15,17,46,64,83,97,121,122],overridden:[0,122],overview:[44,67,103,114],overwrit:[22,23,122],ovh1:119,ovh:[0,11,12,15,17,20],ovhcloud:17,ovhcom:21,own:[0,11,12,17,19,20,23,44,67,103,104,116,118,121,122],owner:[0,11,12,18,22,43,47,56,89,103,104,118,121],ownerless:118,ownership:[11,48],p9g:122,p:[0,4,10,11,16,20,21,58,117,119],pack:117,packag:[5,18,19,23,58],packet:62,page:[18,23,114,117,122],pair:[11,19,48,57,125],pam:[0,15,17,19,20,23,89,97],pam_deni:19,pam_duo:0,pam_faillock:[0,105],pam_google_authent:[0,19],pam_success:23,pam_tal:105,pam_tally2:[0,105],pamtest:[0,12,15,20],paragraph:52,param:11,paramet:[0,10,11,12,15,16,19,20,23,116,117],paramiko:17,paramount:[19,23],paranoid:116,parent:[6,11],pars:117,part:[11,12,14,17,19,23,89,97,115,118,119,121,123],parti:17,partial:[5,20],particularli:[19,117],partit:20,pass:[0,2,4,10,11,15,17,19,23,64],passauth_dis:11,passphras:[2,4,19,20,22,44,67,103,122,125],passthrough:[114,121],passwd:[17,19,22],password:[0,11,12,15,19,20,23,27,46,48,57,58,82,89,90,97,105,111,114],passwordlen:23,past:[19,22,57,119,122,125],patch:14,path:[0,2,4,6,7,9,15,20,23,116],pattern:[17,34,53,55,70,90,91],paus:[15,51],payload:18,pbzn:122,pci:116,pem:[5,64,122],peopl:[0,17,20,52,98,118,122],per:[0,2,9,11,14,17,18,56,88],perfect:17,perfectli:118,perform:[11,20],perhap:11,period:[0,8,18],perl:[11,15,18,20,116],perlcrit:15,perltidi:15,perman:119,permiss:[11,12,22,119],permit:[19,97,118],person:[0,11,14,18,23,30,32,63,70,80,89,91,97,105,113,114,119,120,123],personalaccess:23,perspect:[0,18],pertain:[31,33,52,57,117],pf:20,pgoa5h:16,pgp:19,phase:[0,11,12,17,78,114],phone:19,pick:[19,22],pid:[6,11,19],pile:[4,23],pin:[12,119,122],pinentri:19,ping:[18,57],pinpolici:122,pipe:11,piv:[0,1,15,18,20,64,89,105,114,119],piv_ii:[119,122],pki:18,pktsz:62,pl:[0,11,19,23],place:[11,20,23,122],plai:[11,119],plain:11,plan:20,playback:11,playground:18,pleas:[0,2,4,5,12,13,15,17,19,20,22,23,30,32,45,63,66,68,69,80,87,97,110,114,119,121,122,123],plenti:4,plugin:[0,11,14,19,20,21,23,25,56,63,68,69,80,87,88,97,99,116,117,120,123],pm:[11,15],point:[0,4,5,17,18,22,23],polici:[8,12,17,18,58,64,83,89,97,105,114],poly1305:5,port:[0,4,10,11,15,17,21,23,27,28,30,32,51,57,66,74,82,84,111,112,113,117,118,119,121,123,125],port_bast:11,port_from:11,port_to:11,portion:11,portto:11,posit:[0,5,46],posix:123,possibl:[0,4,5,6,11,12,15,17,18,19,20,23,38,45,52,68,74,87,89,105,114,117,122],post:[115,118,121],potenti:[0,15,17,118,121,122],power:[0,11,17,118,119],powerus:21,ppbslfq0ddbgr:121,ppc64le:21,ppid:11,ppk:125,pr:14,practic:[18,22,118],pre:[18,117],prebuild:23,precaution:116,preced:[0,19,23,34,53,55,70,90,91],precis:[0,11,12,20,23,74,118,123],precompil:20,preconfigur:16,preexist:[23,30,103,123],prefer:[15,19,21,23,121],preferredauthent:11,prefix:[0,15,19,64,82,106,111,117],prepend:[0,58,122],prequisit:19,prerequisit:[18,19,20],present:[0,4,11,12,16,17,19,22,23,30,31,32,33,83,106,113,114,118],preserv:22,press:[19,119],pretti:4,prettifi:117,prevail:46,prevent:[0,17,82,98,105,111,116],previou:[0,16,20,23,45,68,87,98,121],previous:[15,23,122,123],primari:[10,23,121],primit:116,principl:18,print:[0,11,57,90,117,121],printf:[15,19,50],prior:22,privat:[5,14,15,17,19,20,22,23,48,57,72,93,113,118,119,121,122,125],privileg:[0,5,22,116,118],pro:118,proactiv:[0,12],probabl:[0,4,9,10,17,19,121],probe:23,problem:[0,4,17,19,20,123],proce:[0,11,19,22,23],procedur:[0,10,18,19,20,22,23],proceed:20,process:[0,5,11,12,17,18,19,20,116,118,121,122],produc:[0,4,11],product:[1,11,15,18,20,21,116],profil:19,program:[0,11,17,23,117,123],prohibit:[119,121],promot:19,prompt:[12,19,20,44,64,65,67,75,76,83,103,106,121,125],propag:19,proper:[0,7,15,18,20,114,119,121,122,125],properli:[17,19,20,23,111,119,121,122],properti:11,protect:[2,4,12,19,125],protocol:[18,114,117,123],prove:[19,122],provid:[0,5,11,12,14,15,17,18,19,23,121,122],provis:[118,121],proxi:[1,11,17,18,23,57,114,119],proxycommand:18,proxyhttp_daemon:11,proxyhttp_work:11,pseudo:125,pub:19,pubkei:[12,19,23,97,114],public_kei:11,publickei:[0,11,12,19,119],publicli:23,publish:[13,19,20],pull:15,puppet:[18,23,118],purpl:56,purpos:[23,110,118],push:[0,2,10,11,14,23,119],push_opt:19,push_remot:19,put:[2,22,71,92],putti:[11,18,124],puttygen:125,pwem8r:122,pwgen:[19,20],python:[15,17],q:[10,19],qf0m:121,qo:121,qr:19,qrcode:19,queri:[5,18],quick:[18,19,44,67,103,114,122],quickli:[0,18,118],quiet:117,quit:[11,12,17,119],quot:[0,11,23,24,51,64,82,83,86,106,111],r0:16,r:[0,14,19,63,117],ram:17,ran:116,random:[17,19,125],rang:[0,82,83,111],rapidli:19,rare:[0,11],rather:11,rational:117,raw:15,rbrrgs66apiepc:121,rc1:121,rc9:119,rc:5,re:[0,1,4,9,11,12,15,16,17,18,19,20,21,22,23,24,43,44,51,59,64,67,80,81,82,83,103,106,111,113,116,117,118,119,120,123],reach:5,read:[2,4,11,12,17,18,19,20,21,45,63,68,69,80,87,116,117,122],readabl:[2,4,11,12,14,22,90,116,117],readi:[5,19,21,23,119],readlin:11,readm:23,readonli:[11,19],readonlyslavemod:19,real:[19,116],realiz:17,realli:[0,18],realm:[105,114],realmcreat:[18,105],realmdelet:[18,105],realminfo:[18,105],realmlist:[18,105],realopt:11,reaper:1,reason:[0,12,17,19,23,24,66,86,119,123],reboot:[19,22],rebuild:15,recal:119,receiv:[0,11,19],recent:[4,14,17,19,23,89],recipi:19,recommend:[18,19,23],record:[0,4,18,20,23,114,119],recurs:63,red:56,reduc:[17,20],refer:[11,12,18,23,114,122],referenc:[11,12,15,16,22],refin:[34,53,55,70,90,91],reflect:23,refus:[2,4,10],regard:[58,97],regardless:[0,5,12,17,19,22,98],regener:20,regex:[0,16,117],regist:[17,58],regul:17,regular:[19,63,80,122],regularli:20,relat:0,relax:98,releas:[14,17,20,22,23,115],relev:11,reli:[11,12,19,97,117],relianc:114,reload:12,remain:[7,11,23,119],rememb:[118,121],remot:[0,11,12,14,15,16,17,18,21,22,23,27,28,30,32,45,52,57,58,68,71,74,82,84,87,92,111,112,113,114,116,118,119,121,123],remote_account_nam:21,remote_admin_user_nam:15,remote_host:[21,121],remote_machine_host_or_ip:21,remote_port:121,remote_us:121,remote_user_nam:15,remotebackup:4,remotehostlist:19,remoteip:11,remov:[0,1,4,7,8,11,12,23,29,35,46,47,48,57,66,97,105,117],renam:20,renew:0,repeat:[11,20],repeatedli:12,replac:[0,11,20,22,23,50,56,117,122,123],replai:[57,119],repo:20,report:[13,14,60],repositori:[15,19,20],repres:[11,23,118],repudi:19,request:[0,5,11,12,14,15,23,80,121,122],requested_by_the_sword_master_of_melee_island_see_ticket_no_1337:11,requir:[0,11,14,16,17,20,23,45,46,58,68,69,75,76,87,89,95,96,97,98,119,121,122,123],requisit:19,research:[44,67,103],reset:0,resid:[12,23],resolut:0,resolv:[11,27,34,55,70,91],resort:0,resourc:19,resp:11,respect:[11,14,123,125],respons:[2,3,4,5,6,7,8,9,10,18,23,118,121],rest:[22,124],restart:[19,22,23],restor:[2,18,19,20,98,119,121,122],restrict:[0,18,19,20,43,46,56,89,104,116,119,121],result:[0,11,15,23,34,53,55,70,74,90,91],resum:[17,19,20],retcod:119,retir:23,retriev:118,returnvalu:11,rev:19,revers:[0,11,34,55,70,91],reversedn:117,revert:98,review:[1,14,18,19,23,120],revoc:19,revok:105,rid:9,right:[0,11,12,14,16,19,28,38,45,56,63,68,69,70,80,84,87,88,91,112,113,116,118,121,122,123],rm:17,rmpocaypsfrqmobfojver5ulqxyjqytrdguoquwh2na:119,robin:19,robot:[12,17,117,118,121],robust:[44,67,103],rocki:23,rockylinux:[20,23],rogu:118,role:[0,11,18,48,52,89,114,120],root:[0,2,4,5,10,11,12,14,16,17,18,22,23,27,105,118,119],root_ssh_key_path:15,rootlistingresskei:[18,105],rotat:[11,18,23],rough:18,round:19,router12:121,routin:20,row:[0,11,21,23],rpm:[20,23],rsa:[0,5,11,19,22,23,44,58,67,103,122],rsh:[4,10,19],rss:19,rsync:[0,1,10,19,23],rsyncfilt:[4,23],rsyslogd:19,rtkit:19,rule:[0,12,17,119],run:[0,2,3,6,7,8,9,11,12,18,19,20,21,22,23,27,51,56,57,63,80,116,123],runtim:0,rvzbzxiylrcswzmrurtobtonrvjtz3cj5zpjazycrjq:122,s390x:21,s:[0,4,5,11,12,14,16,17,19,20,21,22,23,29,62,63,71,80,82,83,89,91,92,93,97,98,106,116,117,118,119,120,121,122,123,125],safe:[11,19],safeti:116,sai:[0,10,17,19,119],said:[0,98,118],same:[0,11,12,14,16,17,19,20,22,23,47,56,59,82,97,111,117,118,121,123],sandbox:18,sane:[0,1,19,23],satellit:[11,18,23],save:[15,20,122,125],sbin:[0,19],sbp5jj83drrwzks57hf3q0lotbn27vm:122,sc2034:15,scale:118,scheme:114,scope:[12,19,118,122],scp:[2,14,18,19,22,23,27,28,30,32,57,80,82,84,111,112,114],scp_bastion:63,scp_script:63,scpdown:[23,27,28,30,32,63,82,84,111,112,123],scpserver:123,scpup:[23,27,28,30,32,63,82,84,111,112,123],scratch:2,screen:11,screensav:17,script:[0,2,3,4,5,6,7,8,9,10,11,15,16,17,18,19,20,22,23,63,80,116,117],se:[12,88,122],search:[18,116],sec:19,second:[0,4,5,6,10,11,12,18,19,21,23,27,30,61,62,82,83,98,111,119],secondari:[7,10,16,19],secret:[2,4,19,23],section:[5,11,12,13,15,18,19,20,21,22,23,118,119,120,123,124],secur:[0,2,4,14,15,17,18,19,20,23,114,115,118,119,121,122,123],securegroup:12,see:[0,2,4,5,8,11,12,14,15,16,17,19,20,21,22,23,25,31,33,34,52,53,55,70,75,76,82,83,90,91,95,96,97,98,113,114,117,118,119,121,122,123],seek:17,seem:[17,22,119,123],seen:[0,11,12,17,19,23,25,30,46,89,100,116],segv:11,select:[83,125],self:[0,11,23,114],self_remote_user_onli:[82,111],selfaddingresskei:[0,18,57,119,122],selfaddkei:83,selfaddpersonalaccess:[0,14,18,21,23,63,71,80,105,119,121,123],selfdelingresskei:[18,57],selfdelkei:83,selfdelpersonalaccess:[0,18,105],selfforgethostkei:[18,57],selfgenerateegresskei:[11,18,57],selfgeneratepassword:[18,23,57,121],selfgenerateproxypassword:[18,57,121],selflistaccess:[12,18,57,119],selflistegresskei:[18,21,23,50,57,80,82,111,118,119],selflistingresskei:[18,50,57,65,122],selflistpassword:[18,23,57,111,121],selflistsess:[0,4,11,18,57,79,119],selfmfaresetpassword:[18,57],selfmfaresettotp:[18,57],selfmfasetuppassword:[12,18,57],selfmfasetuptotp:[12,18,57],selfplaysess:[0,4,11,18,57,119],selinux:23,send:[0,15,19,62,98,121,122],sens:18,sensit:[0,12,17],sent:[4,19,116],separ:[2,10,11,19,25,51,106,116,118],sequenti:[12,57],seri:117,serial:122,serialno:122,seriou:[17,21],serv:15,server42:119,server:[0,3,4,5,9,11,14,15,18,19,22,23,29,31,33,35,36,39,46,52,57,58,97,105,114,116,117,120,121,123],serversid:0,servic:[5,17,20,22,121],session:[1,11,12,18,20,57,58,114,118,120,125],set:[0,2,3,4,5,6,7,8,9,10,11,12,14,16,18,19,20,22,23,24,31,36,37,38,42,45,46,47,62,68,69,75,76,83,87,89,95,96,97,98,118,120,122,125],setup:[0,14,18,19,21,22,23,57,119,121,122,123],sever:[11,12,14,15,18,20,21,23,30,57,88,116,121,122,123],sf5pdidlwsidkcv95qnwhx0:121,sftp:[14,18,22,23,27,28,30,32,57,63,82,84,111,112],sftp_bastion:80,sftp_script:80,sg8bb:121,sgid:19,sh:[1,15,16,19,20,21,23],sha256:[5,12,119,122],sha256crypt:121,sha384:5,sha512crypt:121,shadow:17,shaki:0,shall:[19,121,122],share:[11,19,23],sheet:[44,67,103],shell:[11,15,16,17,23,24,51,64,82,83,86,106,111,116,117,123],shellcheck:15,should:[0,1,2,4,5,10,11,12,14,15,16,19,20,21,22,23,27,28,45,51,56,63,68,69,72,80,87,93,116,117,118,119,121,122,123,125],shouldn:[19,116,117],show:[15,52,54,57,58,89,90,91,108,113,119,122],show_fortun:58,shown:[0,23,51,74,82,83,86,111,125],sibl:[43,74,104],side:[0,4,11,12,19,20,58,89,106,114,116,121],siem:[0,114,122],sign:[19,23,122],signal:11,signatur:18,signing_kei:19,signing_key_passphras:19,sigterm:19,sigusr1:0,silent:0,similar:[0,19,118,121],similarli:17,simpl:[0,2,16,18,23,34,50,53,55,70,90,91,117,118],simpli:[4,17,19,20,22,23,49,56,63,80],simplifi:17,simultan:17,sinc:[0,9,13,23],singl:[4,11,18,82,111],sit:118,sixth:18,size:[0,5,11,19,23,44,45,58,62,67,68,69,82,87,103,111],sk:[0,15,23],skip:[0,11,12,15,20,21,43,51,104,121],slave:[0,4,22],slesimpl:121,slot:122,slow:[34,52,55,70,89,90,91],slower:119,slt14lllvqs6ajaxb7fm4bajg:122,smartphon:12,snakeoil:5,snapd:19,snipper:12,snippet:[19,64,122],snsl:19,so:[0,7,11,12,15,17,18,19,20,22,23,52,57,93,98,116,117,118,119,121,122,123,125],soc1:116,soc2:116,softwar:[0,11,17,20,23],sole:118,some:[0,2,5,6,9,11,12,15,17,18,19,20,23,38,56,57,86,97,105,110,113,116,117,119,120,122,123,124],somebodi:[11,17,20,48,88,118,123],somebodyels:25,somegroup:11,someon:[14,118],someth:[0,11,17,19,119],sometim:[12,17,122],somewhat:17,somewher:[0,12,19,20],soon:[4,45,57,68,87,122],sorri:[0,12,123],sound:[19,118],sourc:[4,11,15,16],space:[0,2,4,10,11,19],spare:0,spars:7,spawn:[11,15,121],speak:20,spec:15,special:[0,16,119,122],specif:[0,11,12,18,25,31,33,35,52,56,63,80,88,89,98,113,116,117,118],specifi:[0,4,5,10,11,15,16,19,20,23,25,27,28,30,31,33,36,37,38,39,40,41,42,44,45,46,51,52,62,64,65,67,68,74,82,87,90,95,96,97,98,103,109,111,113,119,121,123],speed:[11,15,19,20,44,67,103,119,122],speedup:19,sphinx:15,split:[23,114,121],sqejb8y5aerdaepiiz:122,sqgv:121,sql:[0,11,23],sqlite3:116,sqlite:[0,4,18,23],sqm:122,src:63,srv123:11,srv1:[0,27],ss:[19,74],ssd:[17,125],ssh:[2,4,10,11,14,15,16,20,21,22,23,27,28,45,49,54,58,63,64,66,68,69,71,72,73,74,80,82,83,84,87,89,92,93,94,97,98,103,106,111,112,114,116,117,118,119,121,122,123,125],ssh_config:[12,16,19,20,97],ssh_key_path:15,ssh_port:15,ssha:11,sshd:[0,12,19,23,97],sshd_config:[19,20,23],sshfp:18,sshing:18,ssl:[5,19],stabl:[20,23],stack:23,staff:19,stage:12,stai:20,stan:11,stand:[17,18],standalon:0,standard:[0,2,10,16,20,22,23,114],standpoint:17,start:[0,1,2,5,6,7,10,11,15,17,19,20,23,74,117,119,122,125],stat:19,state:[19,23],statu:[0,5,18,89,97],stderr:[0,11,114],stdin:[12,17,57,64],stdout:[0,114],step:[12,15,18,19,20,51,78,120,122],still:[0,3,4,6,11,17,19,23,27,33,98,114,119,121,122],stock:23,stop:[12,19,20,22,23],storag:[4,11,20],store:[0,11,17,19,20,23,121,122],straightforward:23,strang:119,strftime:0,strict:[17,97],stricthostkeycheck:[10,97],strictli:[18,20,46,119,121],strike:118,string:[0,2,3,4,5,6,7,8,9,10,16,23,27,34,53,55,70,82,83,90,91,98,106,111,117],strip:22,strong:122,strongli:22,structur:117,stub:11,stuff:17,style:[5,123],sub:[4,15],subdir:4,subfold:23,subject:118,submit:15,subnet:0,subsect:[12,120],subsequ:[0,83],subset:[15,118],subsystem:[23,27,28,30,32,80,82,84,111,112,114,123],succe:117,succeed:[116,117],success:[0,4,17,19,117],successfulli:[11,12,19,23,119,122],suddenli:23,sudo:[0,11,25,116],sudo_us:11,sudoer:[0,20,116],suffic:23,suffici:125,suggest:19,suid:19,suitabl:88,summar:17,sundai:20,superown:[0,11,89,118,119],supersecretserv:11,supplementari:20,support:[0,5,8,15,18,19,20,22,34,45,53,54,55,58,63,68,69,70,73,80,87,90,91,94,106,114,121],suppress:97,sure:[0,12,15,19,21,22],surfac:117,suspect:13,swap:19,sxvenbvxury0v8sblehspyaxg:122,sy:19,sync:[1,4,12,23],synchron:[4,23],syncid:19,syntax:15,sysadmin:[4,18,118],syslog:[0,2,3,4,6,7,8,9,17,18,20,23,114,116],syslog_host:11,syslog_tim:11,sysret:11,system:[0,2,5,11,12,15,17,18,19,22,23,83,110,116,118,119,121,123],systemctl:[5,19,23],systemd:[5,19],sysus:11,sysv:5,syswrit:11,t:[0,2,4,5,6,7,8,9,10,11,12,14,15,16,17,18,19,20,21,22,23,25,27,45,51,53,54,56,58,60,62,64,68,70,73,75,76,77,82,83,85,87,90,91,94,95,96,97,98,100,103,111,113,116,117,118,119,121,122,123,125],tab:[12,119],tabl:[0,44,67,103],tag:[12,20,23,118],tail:[17,19,20,23],tailor:[0,19],taint:[17,116],take:[0,5,12,15,17,19,23,34,53,55,70,90,91,117],takeawai:122,taken:[12,16,20],talk:17,tamper:[19,116],tank:119,tar:[2,19,20,22],tarbal:20,target:[14,15,16,97],task:[1,2,3],tcp:57,tdy:15,team:[18,114,118],tear:17,technic:[17,18,118,123],technolog:17,tell:[0,11,12,113],telnet:[0,11,45,68,87,114],templat:[0,11,12,19,20,23],temporari:[8,18,22,31,98],temporarili:14,ter:11,term:[11,118],termcap:11,termin:[0,6,17,18,19,117,121],test1:16,test2:16,test3:16,test:[0,5,10,18,19,20,21,23,61,119,121],testbast:58,tester:16,testgroup1:89,text:[0,11,16,23,27,30,34,55,60,64,70,82,91,111,117],than:[0,4,6,10,11,12,18,19,22,23,46,47,82,111,117,118,121,122],thank:122,thei:[0,4,8,11,12,14,16,17,19,20,23,30,33,71,88,92,93,116,118,119,121,122],them:[0,2,4,11,12,14,15,19,23,56,98,100,118,122,125],themonkei:11,themself:118,themselv:[0,23,88,93,118],therefor:0,theses:23,thi:[0,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,27,28,30,31,32,33,34,36,37,38,39,41,42,43,44,45,46,47,49,52,54,55,57,59,61,62,63,64,66,67,68,69,70,71,72,74,75,76,80,81,82,83,84,87,88,89,90,91,92,93,95,96,97,98,100,103,104,105,106,111,112,113,114,116,117,118,119,120,121,122,123,124,125],thing:[0,11,16,18,118,119],think:[17,113],third:[0,18],those:[0,4,11,12,15,17,18,19,20,23,53,71,92,118,119,122],though:[4,23],thousand:[17,82,111],three:[11,118],through:[0,2,3,4,6,7,8,9,10,11,12,14,15,17,18,19,20,21,23,57,64,70,74,83,91,97,113,114,117,118,119,120,123],thu:[12,89],thumb:[0,17],ti:[71,72,92,93,123],ticket:122,tidi:15,tidycheck:15,time:[0,1,4,5,6,9,10,11,12,15,16,17,19,20,22,34,53,55,58,70,83,90,91,97,98,118,119,121,122,125],timeout:[0,16,19,46,61,62,81],timeouthandl:11,timestamp:[11,74,122],timestampend:11,timestampendusec:11,timestampusec:11,timesyncd:19,tl:[5,17],tmp:[16,22,63],todai:[58,119],togeth:23,token:[0,23,64,98,122],tolow:19,too:[0,4,19,20,23,118,121],tool:[18,20,23,57,118,122,125],top:125,topic:17,total:[19,119],totp:[0,12,15,19,20,23,46,57,58,89,97,105],touch:[4,19,20,23,122],touchpolici:122,tp:21,tq1p7zyraot4woh1zcgjnf:121,trace:11,traceabl:[5,11,18,118],tracerout:57,track:116,trade:114,traffic:[4,5],trail:2,transfer:[4,22,57],transmit:48,transpar:[11,20,23],trick:[5,116],trigger:[0,11,12],trip:121,trust:[4,14,17,19,105,114,116],trustdb:19,ttl:[3,11,23,27,30,46,62,82,83,89,98,111,122],tty:[0,6,11,18,19],tty_group:11,ttyplai:11,ttyrec:[0,2,4,9,17,18,20,23,57,114,119],ttyrecfile:11,ttyrecfilenameformat:11,ttyrecs:23,tue:121,tupl:[118,121],turn:[5,122],tutori:18,tvzf:22,twice:[11,23,24,51,82,83,86,111,125],two:[0,11,12,15,17,19,21,22,23,114,117,118,119,121,122,123],txt:50,type8:23,type9:23,type:[0,2,3,4,5,6,7,8,9,10,12,14,18,19,20,21,23,74,119,121,125],typic:0,u:[0,121],uaih09nxpbf4ejpruroi:121,ubuntu:[20,23],udw2unl:121,ui:14,uid:[0,11,83,119],uid_auto:11,ultim:[4,15,19],umask:23,unauthor:[119,121],unavoid:18,uncom:[12,19],uncondition:[12,62],unconfigur:[2,4],under:[0,11,12,15,18,19,20,21,22,23,64,82,83,106,111,116,123,125],underli:[15,23,58,110],underneath:17,understand:[11,16,17,118],undo:59,unencrypt:[2,20],unexpect:11,unexpir:105,unfreez:105,uninstal:23,uniqid:[0,11,23,122],uniqu:[11,18,119],unit:5,unix:[0,11,46,57,83,89,97,105,116],unless:[0,2,9,23,45,68,69,87],unlock:[2,4,17,18,24,57,59,105],unmodifi:12,unprivileg:[0,116],unset:[0,24,97],unsupport:[0,20],unsur:19,untar:20,until:23,untouch:23,untrust:17,unus:[15,17],unusu:11,up:[0,2,3,4,5,7,10,11,12,14,15,17,18,19,20,21,22,23,120,122],upcom:0,updat:[5,11,19,23,118],upgrad:[14,18,20],upl:0,upload:[23,27,28,30,32,63,80,82,84,111,112,114,123],upper:83,uppercas:117,uri:121,url:0,us:[0,2,3,4,5,6,7,8,9,10,11,14,16,18,19,20,22,23,27,28,30,32,34,45,46,47,49,51,52,53,55,56,57,59,61,64,66,68,70,71,72,74,79,82,83,84,87,89,90,91,92,97,98,100,103,104,106,110,111,112,114,116,118,119,120,121,122,123,124],usabl:[4,15],usag:[0,11,12,15,20,21,23,57,105,117,124],usec:[0,11],useless:[20,121],user12:25,user1:[50,58,89],user2:50,user3:50,user:[0,2,4,7,9,10,11,15,16,17,18,19,20,21,23,26,27,28,30,32,43,50,51,56,74,82,84,86,93,111,112,113,116,117,118,119,121,122,123],usercom:117,userknownhostsfil:97,usernam:20,usr:[0,11,15,19,23],usual:[0,5,11,12,15,16,17,18,19,20,22,23,80,117,119,121,122,125],utc:[12,89,119,122],utf8:19,utf:0,uz:122,v00:121,v3:[14,20,89],v6:21,v7:21,v9axndt0dnuo7adpzxa7i7xpbrkisbep7rcqxgs5cbqgcbq:122,v:[0,19,122],valid:[0,4,11,12,15,19,23,63,80,83,98,118,122,123],valu:[0,2,3,4,5,6,7,8,9,10,11,12,15,16,19,23,46,97,105],value1:[11,16],value2:16,variabl:[16,19],variant:[20,117],vault:19,vdi:20,ve:[0,10,11,12,16,17,19,22,63,80,117,118,119,121,122,125],vector:14,verbos:[88,90],veri:[5,11,17,23,82],verif:5,verifi:[0,12,15,19,20,23,66,98,119,121,122,125],version:[0,11,14,18,19,20,22,117,122,123],via:[12,14,74,118,119],view:[15,17,23,105,122],vim:[19,20],vimdiff:20,violat:0,virtual:114,vjorh7huvoi:122,vlixbqelf07mkqofdebx:122,vm:[15,123],volum:[15,17],voxms8:121,vpn:20,vsn6kpxu5jud7scnbkynh:121,vsz:19,vulner:23,w150:19,w:[0,19,61,62],wa:[0,10,11,12,17,19,22,23,28,84,89,112,117,119,122],wai:[0,4,5,10,11,12,17,18,20,21,22,23,45,61,68,69,87,90,97,118,122,123],wait:[0,4,12,49,118,119],want:[0,2,4,5,9,11,12,15,16,18,19,20,21,22,23,25,28,30,32,45,49,52,56,82,87,95,96,98,111,117,118,119,122,123],warmli:[11,19,20,44,67,103],warn:[0,17,19,20,22,23,66,89,119],wast:119,watch:[11,19],watcher:[1,4,19,23],water:119,we:[0,2,3,4,5,6,7,8,9,10,11,12,16,17,19,20,21,22,23,25,28,30,51,61,106,117,118,119,120,121,122],weak:11,websit:17,wed:[12,19,121,122],welcom:[12,119],well:[0,11,17,20,115,116,118,122],were:[0,4,11,19,22,23,81,122],weren:118,what:[0,4,5,11,12,19,20,97,113,119,121,122],when:[0,2,3,4,5,6,7,10,11,12,14,15,16,17,19,20,22,23,46,58,66,74,82,83,97,98,100,106,111,118,119,121,122,123,125],whenev:23,where:[0,2,4,6,7,9,10,11,12,14,15,16,17,19,22,23,63,80,118,119,123],wherea:23,whether:[0,5,10,11,12,16,17,19,22,23,52,57,89,90,116,117,121],which:[0,1,2,3,4,5,6,7,8,9,10,11,12,14,15,16,17,18,19,20,21,22,23,25,27,28,30,31,32,33,34,36,37,38,39,41,42,45,47,51,53,58,82,83,87,95,96,97,98,111,113,116,117,118,119,121,123,125],whichev:118,whitelist:58,who:[110,118,120],whoever:17,whohasaccessto:[18,105],whole:[18,27,59,81,118,119],whoopsi:19,whose:[11,12,23,90,118],why:[12,18,19],wide:[0,17,20,82,97,98,111,121,122],widen:117,wider:[0,82,111],widespread:124,widest_v4_prefix:[82,111],wik3vf:121,wiki:11,wildcard:[34,53,55,70,90,91,113],window:[123,125],winscp:123,wip:18,wise:[0,17],wish:[4,125],wit:117,within:[0,12,21,23,117],without:[0,2,4,6,7,9,10,11,12,14,17,18,19,20,21,23,34,46,52,53,55,56,70,88,89,90,91,111,113,114,117,118],won:[0,2,4,6,7,8,9,10,11,17,22,23,83,113,122,123],woosh:119,word:[0,4,11,16,38,70,91,118,123],work:[0,2,10,11,12,15,16,17,18,19,22,23,45,58,68,82,87,88,89,91,94,97,98,99,100,102,117,118,119,120,121,122,123],worker:11,workflow:[0,17,18,122],workload:[17,121],worst:23,worth:11,worthless:20,woscsi8hhggqxqiqedmnt6cwz83qk73:122,would:[0,4,11,12,14,17,19,20,23,82,111,117,118,119,121,122,123],wouldn:[18,116],wrapper:[17,23,123],write:[0,2,4,6,7,9,10,11,17,18,19,20],written:[0,2,4,6,7,9,10,11,17,23,50],wrong:[19,43,85,104],wsl:123,wyxpsedztxgael12ecplisyddqkt3ejfudainbpf:122,x1yfk8gah9dzanbgkqhkig9w0baqsfadah:122,x8:121,x:[15,19,20,23],xgh:122,xmys2u:23,xvzf:22,xxmcgvre6cwx7aa0hchdet0synoizotglxvxqr:122,xzvf:22,y:[0,11,19,121],ydkk8wmvlvavcbglx:23,ye:[12,17,19,52,77,97],year:[0,23],yet:[4,20,23,114,125],yield:16,ylwsjseiknzmscqcdicslrdkxpgmok8ocxu0err4yvfxiszzl32btzyld8n7i:122,ynhzjpxza4r838xkg2tfvvov:121,you:[0,1,2,3,4,5,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,27,28,30,31,32,40,43,44,45,49,51,52,53,56,57,58,59,63,64,65,67,68,69,72,75,76,80,81,82,83,84,85,86,87,88,90,95,96,98,103,104,106,111,112,113,117,118,119,120,121,122,123,125],your:[0,2,3,4,5,6,7,8,9,10,11,12,14,15,16,17,18,19,21,22,23,44,48,50,57,58,63,69,70,80,83,103,105,106,117,118,119,121,122,123,125],your_mgmt_kei:122,yourself:[11,15,17,20,21,23,43,47,64,71,72,85,104,120,121],yqflux17tuwe1jfhhax:121,yrlxzt0t7wbs3e:23,yubico:[15,20,114,122],yubikei:122,yyyi:[22,74],yyyymm:[0,11,23],z0:117,ze7px3olxdjwthsrdnzelm6avzt2kszx:121,zero:[0,5,16,46,83,97],zkw01n2kt:122,zone:19,zstd:0,zxf:20},titles:["bastion.conf","Configuration files","osh-backup-acl-keys.conf","osh-cleanup-guest-key-access.conf","osh-encrypt-rsync.conf","osh-http-proxy.conf","osh-lingering-sessions-reaper.conf","osh-orphaned-homedir.conf","osh-piv-grace-reaper.conf","osh-remove-empty-folders.conf","osh-sync-watcher.sh","Logs","Multi-Factor Authentication","Security Advisories","CVE-2023-45140","Environment setup","Writing tests","FAQ","Welcome to The Bastion documentation!","Advanced Installation","Basic Installation","Sandbox using Docker","Restoring from backup","Upgrading","adminMaintenance","adminSudo","admin plugins","groupAddServer","groupDelServer","group-aclkeeper plugins","groupAddGuestAccess","groupAddMember","groupDelGuestAccess","groupDelMember","groupListGuestAccesses","group-gatekeeper plugins","groupAddAclkeeper","groupAddGatekeeper","groupAddOwner","groupDelAclkeeper","groupDelEgressKey","groupDelGatekeeper","groupDelOwner","groupDestroy","groupGenerateEgressKey","groupGeneratePassword","groupModify","groupTransmitOwnership","group-owner plugins","alive","batch","clush","groupInfo","groupList","groupListPasswords","groupListServers","help","open plugins","info","lock","mtr","nc","ping","scp","selfAddIngressKey","selfDelIngressKey","selfForgetHostKey","selfGenerateEgressKey","selfGeneratePassword","selfGenerateProxyPassword","selfListAccesses","selfListEgressKeys","selfListIngressKeys","selfListPasswords","selfListSessions","selfMFAResetPassword","selfMFAResetTOTP","selfMFASetupPassword","selfMFASetupTOTP","selfPlaySession","sftp","unlock","accountAddPersonalAccess","accountCreate","accountDelPersonalAccess","accountDelete","accountFreeze","accountGeneratePassword","accountGrantCommand","accountInfo","accountList","accountListAccesses","accountListEgressKeys","accountListIngressKeys","accountListPasswords","accountMFAResetPassword","accountMFAResetTOTP","accountModify","accountPIV","accountRevokeCommand","accountUnexpire","accountUnfreeze","accountUnlock","groupCreate","groupDelete","restricted plugins","realmCreate","realmDelete","realmInfo","realmList","rootListIngressKeys","selfAddPersonalAccess","selfDelPersonalAccess","whoHasAccessTo","Features","Principles","Security","JSON API","Access management","First steps","The basics","HTTPS Proxy","PIV keys support","SFTP &amp; SCP support","Specific SSH clients tutorials","Using PuTTY with The Bastion"],titleterms:{"0":20,"00":23,"01":23,"02":23,"03":23,"04":23,"05":23,"06":23,"07":23,"08":23,"09":23,"1":[20,123],"10":23,"11":23,"12":23,"13":23,"14":23,"140":18,"15":23,"16":23,"17":23,"18":23,"19":23,"2":[20,123],"20":23,"2020":23,"2021":23,"2022":23,"2023":[14,23],"2024":23,"21":23,"22":23,"23":23,"25":23,"27":23,"28":23,"2fa":19,"3":20,"30":23,"4":20,"45140":14,"5":20,"6":20,"7":20,"8":20,"9":20,"boolean":23,"import":[19,22],"new":[44,45,64,67,68,69,83,87,106],"public":[44,64,65,67,71,72,92,93,110],"try":121,And:118,For:121,IT:118,On:12,The:[17,18,23,120,125],about:[52,58,89,108],access:[3,11,30,32,34,70,77,78,82,84,88,91,99,111,112,113,118,119,121,123],account:[0,11,12,14,19,20,22,30,31,32,33,34,36,37,38,39,41,42,64,65,66,67,68,71,72,73,74,75,76,77,78,82,83,84,85,86,87,89,90,91,92,93,94,95,96,97,98,100,101,102,111,112,113,122],accountaddpersonalaccess:82,accountcr:83,accountcreatedefaultpersonalaccess:0,accountcreatesupplementarygroup:0,accountdelet:85,accountdelpersonalaccess:84,accountexpiredmessag:0,accountexternalvalidationdenyonfailur:0,accountexternalvalidationprogram:0,accountfreez:86,accountgeneratepassword:87,accountgrantcommand:88,accountinfo:89,accountlist:90,accountlistaccess:91,accountlistegresskei:92,accountlistingresskei:93,accountlistpassword:94,accountmaxinactivedai:0,accountmfapolici:0,accountmfaresetpassword:95,accountmfaresettotp:96,accountmodifi:97,accountpiv:98,accountrevokecommand:99,accountuidmax:0,accountuidmin:0,accountunexpir:100,accountunfreez:101,accountunlock:102,acl:[2,11],aclkeep:[29,36,39],acronym:56,activ:[2,3,6,7,8,9],add:[27,30,31,36,37,38,64,82,111],addit:[12,77,78],admin:[19,26],adminaccount:0,administr:18,adminmainten:24,adminsudo:25,advanc:19,advisori:13,alia:119,aliv:49,all:[12,59,81],allow:19,allowedegresssshalgorithm:0,allowedingresssshalgorithm:0,allowednetwork:0,alreadi:17,alwaysactiveaccount:0,an:[27,28,30,31,32,33,34,36,37,38,39,41,42,65,77,78,82,84,85,86,87,89,92,93,94,95,96,97,98,100,102],anoth:[18,25],ansibl:17,answer:49,api:117,ar:[17,19,22],archiv:22,ask:118,associ:[73,94],audit:116,authent:[12,19],autom:12,avail:[15,19,53],back:22,backup:[2,19,22],base:14,basi:12,basic:[20,52,120,123],bastion:[0,17,18,19,20,24,40,53,58,62,63,66,67,69,80,83,85,90,91,107,108,109,110,119,125],bastioncommand:0,bastionnam:0,batch:[12,50],been:23,behavior:9,block:[27,28,55],bypass:12,can:17,central:118,charact:18,check:[20,61],cipher:5,cleanup:3,client:124,close:11,clush:51,cluster:19,code:[11,20],color:56,command:[50,51,88,99,117],commit:15,common:17,conf:[0,2,3,4,5,6,7,8,9],configur:[1,5,12,19,20,23,46,58,76,82,96,97,111],connect:[19,20,86,110,119],contain:16,content:[11,12,15,16,117,121,122,123],core:116,creat:[19,20,44,67,83,103,106],credenti:[77,78],crowd:118,current:[59,81],cve:[13,14],daemon:10,daystokeep:2,debug:0,decentr:118,declar:[106,121],decrypt:22,defaultaccountegresskeyalgorithm:0,defaultaccountegresskeys:0,defaultlogin:0,delet:[43,85,104,107],destdir:2,destin:4,detail:[12,14],develop:18,die:11,displai:[58,89,108],displaylastlogin:0,dn:19,dnssupportlevel:0,docker:[15,17,21],document:18,documentationurl:0,doe:17,ed25519:23,egress:[0,40,45,54,68,71,73,87,92,94,121],egresskeysfrom:0,els:47,empti:9,enabl:[2,3,5,6,7,8,9,10,19],enableaccountaccesslog:0,enableaccountsqllog:0,enableglobalaccesslog:0,enableglobalsqllog:0,enablesyslog:0,encrypt:[2,4,19,20],encrypt_and_move_to_directori:4,encrypt_and_move_ttyrec_delay_dai:4,encrypt_and_move_user_logs_delay_dai:4,encrypt_and_move_user_sqlites_delay_dai:4,enhanc:23,ensur:[19,22],environ:15,error:123,error_cod:117,error_messag:117,even:56,exactli:18,exampl:[16,52,58,82,89,111,117],exist:17,exit:49,expand:91,expir:100,explan:12,extract:22,factor:12,fanci:0,faq:17,featur:114,fed:50,few:74,file:[1,4,11,19,23,63,80],first:[20,119,121],flavor:12,folder:9,forbiddennetwork:0,forget:66,format:[11,117],freez:86,from:[22,28,32,33,39,41,42,62,63,65,66,80,84,85,86,112],frozen:101,gatekeep:[35,37,41],gatewai:18,gener:[19,23,45,68,69,87],get:20,gid:[19,22],git:15,given:[91,113],global:[0,118,122],good:117,got:20,gpg:[19,22],gpgkei:2,grace:[8,122],grant:[34,88],greppabl:117,group:[11,12,14,19,22,27,28,29,30,32,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,52,53,54,55,103,104,118,121],groupaddaclkeep:36,groupaddgatekeep:37,groupaddguestaccess:30,groupaddmemb:31,groupaddown:38,groupaddserv:27,groupcreat:103,groupdelaclkeep:39,groupdelegresskei:40,groupdelet:104,groupdelgatekeep:41,groupdelguestaccess:32,groupdelmemb:33,groupdelown:42,groupdelserv:28,groupdestroi:43,groupgenerateegresskei:44,groupgeneratepassword:45,groupinfo:52,grouplist:53,grouplistguestaccess:34,grouplistpassword:54,grouplistserv:55,groupmodifi:46,grouptransmitownership:47,guest:[3,34],harden:19,hardwar:17,hash:[54,73,94],have:[23,70,113],help:[56,118],high:19,home:20,homedir:7,hook:15,host:[49,60,62,66],how:[12,14,17],http:[5,69,121],i:[17,56],idlekilltimeout:0,idlelocktimeout:0,immedi:12,impact:14,imperson:25,inact:100,indic:18,info:[11,58],inform:[12,52,58,89,108],ingress:[0,64,65,69,72,93,98],ingresskeysfrom:0,ingresskeysfromallowoverrid:0,ingressrequirepiv:0,ingresstoegressrul:0,insecur:5,instal:[17,18,19,20,22],instanc:58,instruct:23,integr:15,interact:12,interactivemodeallow:0,interactivemodebydefault:0,interactivemodeproactivemfaen:0,interactivemodeproactivemfaexpir:0,interactivemodetimeout:0,introduct:[12,117,121,122,123],ip:[27,28,55],ish:18,jit:[12,14],json:[16,117],jumphost:18,just:18,kei:[2,3,19,22,40,44,64,65,66,67,71,72,92,93,98,110,122],keyboardinteractiveallow:0,known:66,launch:[16,51],like:51,linger:6,list:[0,2,3,4,5,6,7,8,9,10,13,27,28,31,33,34,53,54,55,70,71,72,73,74,90,91,92,93,94,109,110,113,118],locat:11,lock:[17,59,102],log:[0,2,3,4,6,7,8,9,10,11,19,23],log_facil:[2,6,7,9],log_request_respons:5,log_request_response_max_s:5,logdir:10,logfil:[2,4,6,7,9],m:56,machin:[20,51],main:[0,1,6,23],mainten:24,manag:[24,118],manual:[20,59],master:19,max_ag:6,max_serv:5,max_spare_serv:5,maximumegressrsakeys:0,maximumingressrsakeys:0,me:18,mean:17,member:[31,33,118],membership:11,messag:[11,123],meta:56,metadata:[54,73,94],mfa:[12,14],mfapasswordinactivedai:0,mfapasswordmaxdai:0,mfapasswordmindai:0,mfapasswordwarndai:0,mfapostcommand:0,min_serv:5,min_spare_serv:5,minimumegressrsakeys:0,minimumingressrsakeys:0,mitig:14,mode:[12,24],model:123,modifi:[46,97,98],more:[18,118],moshallow:0,moshcommandlin:0,moshtimeoutnetwork:0,moshtimeoutsign:0,mtime_dai:9,mtr:60,multi:12,my:17,nc:61,need:20,network:0,nocontain:16,now:23,ok:18,onli:12,open:[11,57,61],oper:20,option:[0,2,3,4,5,6,7,8,9,10,17,58,82,111],orphan:7,osh:[2,3,4,5,6,7,8,9,10,12,17,50],other:0,our:20,output:[52,58,89],over:17,owner:[38,42,48],ownership:47,packag:20,pair:[44,67],pam:12,pam_faillock:102,pam_tal:102,pam_tally2:102,password:[45,54,68,69,73,75,77,87,94,95,121],passwordallow:0,past:[74,79],payload:117,per:[12,122],period:122,perl:17,person:[82,84,111,112,118,121],pertain:55,ping:[49,62],piv:[8,98,122],pki:17,plgfail:16,plugin:[12,18,26,29,35,48,57,58,82,105,111,119],polici:[0,2,98,122],port:[5,61],possibl:98,practic:117,pre:15,prerequisit:[22,123],present:18,pretti:117,prevent:86,principl:[115,116],print:52,privat:[44,67],product:[17,22],proper:[12,23],proxi:[5,69,121],proxycommand:17,puppet:20,push:[4,19],push_opt:2,push_remot:2,putti:125,queri:121,readonlyslavemod:0,realli:17,realm:[106,107,108,109],realmcreat:106,realmdelet:107,realminfo:108,realmlist:109,reaper:[6,8],recipi:4,recommend:17,record:[11,19],refer:[0,2,3,4,5,6,7,8,9,10,16],relayhost:18,remot:[2,4,10,19,51,61,62,63,80],remotecommandescapebydefault:0,remotehostlist:10,remoteus:10,remov:[9,28,32,33,39,40,41,42,65,75,76,84,95,96,112],replai:79,reproduc:14,requir:12,restor:22,restrict:[88,99,105],retvalshouldb:16,review:[20,119],revok:99,role:[36,37,38,39,41,42,118],root:[19,20,110],rootlistingresskei:110,rotat:19,rshcmd:10,rsync:4,rsync_delay_before_remove_dai:4,rsync_destin:4,rsync_rsh:4,run:[15,16,17,50,60,121],s:[18,27,28],sandbox:21,satellit:1,scp:[63,123],script:1,secur:[11,13,116],selfaddingresskei:64,selfaddpersonalaccess:111,selfdelingresskei:65,selfdelpersonalaccess:112,selfforgethostkei:66,selfgenerateegresskei:67,selfgeneratepassword:68,selfgenerateproxypassword:69,selflistaccess:70,selflistegresskei:71,selflistingresskei:72,selflistpassword:73,selflistsess:74,selfmfaresetpassword:75,selfmfaresettotp:76,selfmfasetuppassword:77,selfmfasetuptotp:78,selfplaysess:79,sens:17,sequenti:51,server:[12,17,20,27,28,30,32,34,55,63,70,80,82,84,111,112,113,118,119],session:[0,6,17,59,74,79,81,119],set:[119,121],setup:[10,12,15,20,77,78],sever:51,sftp:[80,123],sh:10,show:70,sign:[2,4],signatur:19,signing_kei:[2,4],signing_key_passphras:[2,4],slave:19,snippet:12,so:56,some:[52,58,89,118],somebodi:47,soon:49,specif:[17,23,30,32,34,124],sqlite:11,ssh:[0,12,17,18,19,124],sshclientdebuglevel:0,sshclienthasoption:0,sshd_config:12,sshfp:19,ssl_certif:5,ssl_kei:5,stdin:50,step:[22,119],subset:12,success:16,summari:14,superowneraccount:0,support:[12,23,122,123],sync:[10,19,22],synchron:[10,19],syntax:16,syslog:[10,11,19],syslog_facil:[3,4,8],syslogdescript:0,syslogfacil:0,system:20,tabl:18,tcp:61,tell:18,telnetallow:0,temporari:122,termin:11,test:[15,16],thi:[53,56,58,110],through:[50,63,80,121],timelin:14,timeout:[5,10],tool:[15,60],totp:[76,78,96],totpprovid:0,tracerout:60,transfer:[63,80],transmit:47,trust:106,ttyrec:[11,19,79],ttyrecadditionalparamet:0,ttyrecfilenameformat:0,ttyrecgroupidoffset:0,ttyrecstealthstdoutpattern:0,tutori:124,type:11,uid:[19,22],under:17,unexpir:100,unfreez:101,unix:[75,77,95],unlock:[81,102],up:[119,121],upgrad:23,us:[12,15,17,21,63,69,80,117,125],usag:[18,24,25,27,28,30,31,32,33,34,36,37,38,39,40,41,42,43,44,45,46,47,49,50,51,52,53,54,55,56,58,59,60,61,62,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,106,107,108,109,110,111,112,113,123],user:[12,25],v3:23,valid:16,valu:[98,117],verbos:4,verifi:16,version:23,view:91,wait:18,warn:11,warnbeforekillsecond:0,warnbeforelocksecond:0,watcher:10,welcom:18,what:[17,18],whether:61,whohasaccessto:113,why:17,without:[15,122],work:20,workflow:[12,121],write:16,yet:18,you:70,your:[20,47,59,64,65,66,67,68,71,72,73,74,75,76,77,78,81,111,112],yourself:118}})
\ No newline at end of file
diff --git a/using/api.html b/using/api.html
new file mode 100644
index 000000000..8b5ab7949
--- /dev/null
+++ b/using/api.html
@@ -0,0 +1,417 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>JSON API &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="Specific SSH clients tutorials" href="specific_ssh_clients_tutorials/index.html" />
+    <link rel="prev" title="HTTPS Proxy" href="http_proxy.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">JSON API</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#examples">Examples</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#using-json-pretty">Using --json-pretty</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#using-json">Using --json</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#using-json-greppable">Using --json-greppable</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#json-payload-format">JSON payload format</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#command">command</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#error-code">error_code</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#error-message">error_message</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#value">value</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="#good-practices">Good practices</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>JSON API</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/using/api.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="json-api">
+<h1><a class="toc-backref" href="#id1">JSON API</a><a class="headerlink" href="#json-api" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#json-api" id="id1">JSON API</a></p>
+<ul>
+<li><p><a class="reference internal" href="#introduction" id="id2">Introduction</a></p></li>
+<li><p><a class="reference internal" href="#examples" id="id3">Examples</a></p>
+<ul>
+<li><p><a class="reference internal" href="#using-json-pretty" id="id4">Using --json-pretty</a></p></li>
+<li><p><a class="reference internal" href="#using-json" id="id5">Using --json</a></p></li>
+<li><p><a class="reference internal" href="#using-json-greppable" id="id6">Using --json-greppable</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#json-payload-format" id="id7">JSON payload format</a></p>
+<ul>
+<li><p><a class="reference internal" href="#command" id="id8">command</a></p></li>
+<li><p><a class="reference internal" href="#error-code" id="id9">error_code</a></p></li>
+<li><p><a class="reference internal" href="#error-message" id="id10">error_message</a></p></li>
+<li><p><a class="reference internal" href="#value" id="id11">value</a></p></li>
+</ul>
+</li>
+<li><p><a class="reference internal" href="#good-practices" id="id12">Good practices</a></p></li>
+</ul>
+</li>
+</ul>
+</div>
+<section id="introduction">
+<h2><a class="toc-backref" href="#id2">Introduction</a><a class="headerlink" href="#introduction" title="Permalink to this headline"></a></h2>
+<p>The Bastion has a JSON API that can be used to interact with <a class="reference internal" href="../index.html#plugins"><span class="std std-ref">Plugins</span></a>.</p>
+<p>Instead of exposing a specific HTTPS port for this API, The Bastion leverages its already exposed protocol, SSH,
+to expose its API through it. The rationale is:</p>
+<ul class="simple">
+<li><p>Avoid exposing a new port and a new protocol (HTTPS) to avoid widening the attack surface</p></li>
+<li><p>Leverage the pre-existing authentication and user isolation mechanisms implemented by The Bastion behind SSH</p></li>
+</ul>
+<p>This API is implemented for all <a class="reference internal" href="../index.html#plugins"><span class="std std-ref">plugins</span></a>, and can be enabled by the <code class="docutils literal notranslate"><span class="pre">--json*</span></code> series of options.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>Within this page, the <code class="docutils literal notranslate"><span class="pre">bssh</span></code> bastion alias we usually use through the documentation is replaced by
+explicit <code class="docutils literal notranslate"><span class="pre">ssh</span></code> commands, to emphasize the fact that as we're doing M2M calls,
+there would be no terminal involved, hence we shouldn't use the <code class="docutils literal notranslate"><span class="pre">-t</span></code> SSH option to connect to the bastion
+(as is the case with the <code class="docutils literal notranslate"><span class="pre">bssh</span></code> alias).</p>
+</div>
+<p>Adding either <code class="docutils literal notranslate"><span class="pre">--json</span></code>, <code class="docutils literal notranslate"><span class="pre">--json-pretty</span></code> or <code class="docutils literal notranslate"><span class="pre">--json-greppable</span></code> to your <code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands enable
+the JSON API output. Here is an example of each one below.</p>
+</section>
+<section id="examples">
+<h2><a class="toc-backref" href="#id3">Examples</a><a class="headerlink" href="#examples" title="Permalink to this headline"></a></h2>
+<section id="using-json-pretty">
+<h3><a class="toc-backref" href="#id4">Using --json-pretty</a><a class="headerlink" href="#using-json-pretty" title="Permalink to this headline"></a></h3>
+<p>Let's start with <code class="docutils literal notranslate"><span class="pre">--json-pretty</span></code>:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json-pretty
+</span>╭──ac777d06bec9───────────────────────────────────────────the-bastion-3.12.00───
+│ ▶ list of servers pertaining to the group
+├───────────────────────────────────────────────────────────────────────────────
+│        IP PORT  USER      ACCESS-BY ADDED-BY   ADDED-AT
+│ --------- ---- ----- -------------- -------- ----------
+│ <span class="m">127</span>.1.2.3   <span class="m">22</span> <span class="o">(</span>any<span class="o">)</span> mygroup<span class="o">(</span>group<span class="o">)</span>  johndoe <span class="m">2023</span>-07-31
+│
+│ <span class="m">1</span> accesses listed
+
+JSON_START
+<span class="o">{</span>
+   <span class="s2">&quot;command&quot;</span> : <span class="s2">&quot;groupListServers&quot;</span>,
+   <span class="s2">&quot;value&quot;</span> : <span class="o">[</span>
+      <span class="o">{</span>
+         <span class="s2">&quot;port&quot;</span> : <span class="s2">&quot;22&quot;</span>,
+         <span class="s2">&quot;expiry&quot;</span> : null,
+         <span class="s2">&quot;forcePassword&quot;</span> : null,
+         <span class="s2">&quot;forceKey&quot;</span> : null,
+         <span class="s2">&quot;addedBy&quot;</span> : <span class="s2">&quot;johndoe&quot;</span>,
+         <span class="s2">&quot;userComment&quot;</span> : null,
+         <span class="s2">&quot;comment&quot;</span> : null,
+         <span class="s2">&quot;user&quot;</span> : null,
+         <span class="s2">&quot;ip&quot;</span> : <span class="s2">&quot;127.1.2.3&quot;</span>,
+         <span class="s2">&quot;addedDate&quot;</span> : <span class="s2">&quot;2023-07-31 08:56:05&quot;</span>,
+         <span class="s2">&quot;reverseDns&quot;</span> : null
+      <span class="o">}</span>
+   <span class="o">]</span>,
+   <span class="s2">&quot;error_code&quot;</span> : <span class="s2">&quot;OK&quot;</span>,
+   <span class="s2">&quot;error_message&quot;</span> : <span class="s2">&quot;OK&quot;</span>
+<span class="o">}</span>
+
+JSON_END
+╰─────────────────────────────────────────────────────────&lt;/groupListServers&gt;───
+</pre></div>
+</div>
+<p>As you see, adding <code class="docutils literal notranslate"><span class="pre">--json-pretty</span></code> to the command enables output of additional text that can be parsed as JSON.
+This option is the most human-readable one, and encloses the JSON output between two anchors, namely
+<code class="docutils literal notranslate"><span class="pre">JSON_START</span></code> and <code class="docutils literal notranslate"><span class="pre">JSON_END</span></code>. All the text output out of these anchors can be ignored for the JSON API parsing.</p>
+<p>Here is an example of parsing using simple shell commands:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json-pretty --quiet <span class="p">|</span> <span class="se">\</span>
+</span><span class="hll">  awk <span class="s1">&#39;/^JSON_END\r?$/ {if(P==1){exit}} { if(P==1){print} } /^JSON_START\r?$/ {P=1}&#39;</span> <span class="p">|</span> jq .
+</span><span class="o">{</span>
+  <span class="s2">&quot;error_code&quot;</span>: <span class="s2">&quot;OK&quot;</span>,
+  <span class="s2">&quot;error_message&quot;</span>: <span class="s2">&quot;OK&quot;</span>,
+  <span class="s2">&quot;value&quot;</span>: <span class="o">[</span>
+    <span class="o">{</span>
+      <span class="s2">&quot;userComment&quot;</span>: null,
+      <span class="s2">&quot;reverseDns&quot;</span>: null,
+      <span class="s2">&quot;expiry&quot;</span>: null,
+      <span class="s2">&quot;user&quot;</span>: null,
+      <span class="s2">&quot;forceKey&quot;</span>: null,
+      <span class="s2">&quot;addedDate&quot;</span>: <span class="s2">&quot;2023-07-31 08:56:05&quot;</span>,
+      <span class="s2">&quot;port&quot;</span>: <span class="s2">&quot;22&quot;</span>,
+      <span class="s2">&quot;addedBy&quot;</span>: <span class="s2">&quot;johndoe&quot;</span>,
+      <span class="s2">&quot;ip&quot;</span>: <span class="s2">&quot;127.1.2.3&quot;</span>,
+      <span class="s2">&quot;forcePassword&quot;</span>: null,
+      <span class="s2">&quot;comment&quot;</span>: null
+    <span class="o">}</span>
+  <span class="o">]</span>,
+  <span class="s2">&quot;command&quot;</span>: <span class="s2">&quot;groupListServers&quot;</span>
+<span class="o">}</span>
+</pre></div>
+</div>
+<p>Note that we use <code class="docutils literal notranslate"><span class="pre">--quiet</span></code>, which removes some text that is only useful to humans, and it also disables colors
+in the output. In any case, the JSON API output between the anchors never has colors enabled.</p>
+</section>
+<section id="using-json">
+<h3><a class="toc-backref" href="#id5">Using --json</a><a class="headerlink" href="#using-json" title="Permalink to this headline"></a></h3>
+<p>This option uses the same anchors than <code class="docutils literal notranslate"><span class="pre">--json-pretty</span></code>, but doesn't prettify the JSON, so the output
+is more compact:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json
+</span>---ac777d06bec9-------------------------------------------the-bastion-3.12.00---
+<span class="o">=</span>&gt; list of servers pertaining to the group
+--------------------------------------------------------------------------------
+~        IP PORT  USER          ACCESS-BY ADDED-BY   ADDED-AT
+~ --------- ---- ----- ------------------ -------- ----------
+~ <span class="m">127</span>.1.2.3   <span class="m">22</span> <span class="o">(</span>any<span class="o">)</span>     mygroup<span class="o">(</span>group<span class="o">)</span>  johndoe <span class="m">2023</span>-07-31
+~
+~ <span class="m">1</span> accesses listed
+
+JSON_START
+<span class="o">{</span><span class="s2">&quot;error_code&quot;</span>:<span class="s2">&quot;OK&quot;</span>,<span class="s2">&quot;error_message&quot;</span>:<span class="s2">&quot;OK&quot;</span>,<span class="s2">&quot;value&quot;</span>:<span class="o">[{</span><span class="s2">&quot;forcePassword&quot;</span>:null,<span class="s2">&quot;expiry&quot;</span>:null,<span class="s2">&quot;port&quot;</span>:<span class="s2">&quot;22&quot;</span>,<span class="s2">&quot;addedBy&quot;</span>:<span class="s2">&quot;johndoe&quot;</span>,<span class="s2">&quot;ip&quot;</span>:<span class="s2">&quot;127.1.2.3&quot;</span>,<span class="s2">&quot;userComment&quot;</span>:null,<span class="s2">&quot;addedDate&quot;</span>:<span class="s2">&quot;2023-07-31 08:56:05&quot;</span>,<span class="s2">&quot;user&quot;</span>:null,<span class="s2">&quot;reverseDns&quot;</span>:null,<span class="s2">&quot;comment&quot;</span>:null,<span class="s2">&quot;forceKey&quot;</span>:null<span class="o">}]</span>,<span class="s2">&quot;command&quot;</span>:<span class="s2">&quot;groupListServers&quot;</span><span class="o">}</span>
+JSON_END
+</pre></div>
+</div>
+<p>As the anchors are the same, the parsing can be done with the same logic as above:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json --quiet <span class="p">|</span> <span class="se">\</span>
+</span><span class="hll">  awk <span class="s1">&#39;/^JSON_END\r?$/ {if(P==1){exit}} { if(P==1){print} } /^JSON_START\r?$/ {P=1}&#39;</span> <span class="p">|</span> jq .
+</span><span class="o">{</span>
+  <span class="s2">&quot;error_code&quot;</span>: <span class="s2">&quot;OK&quot;</span>,
+  <span class="s2">&quot;error_message&quot;</span>: <span class="s2">&quot;OK&quot;</span>,
+  <span class="s2">&quot;value&quot;</span>: <span class="o">[</span>
+    <span class="o">{</span>
+      <span class="s2">&quot;userComment&quot;</span>: null,
+      <span class="s2">&quot;reverseDns&quot;</span>: null,
+      <span class="s2">&quot;expiry&quot;</span>: null,
+      <span class="s2">&quot;user&quot;</span>: null,
+      <span class="s2">&quot;forceKey&quot;</span>: null,
+      <span class="s2">&quot;addedDate&quot;</span>: <span class="s2">&quot;2023-07-31 08:56:05&quot;</span>,
+      <span class="s2">&quot;port&quot;</span>: <span class="s2">&quot;22&quot;</span>,
+      <span class="s2">&quot;addedBy&quot;</span>: <span class="s2">&quot;johndoe&quot;</span>,
+      <span class="s2">&quot;ip&quot;</span>: <span class="s2">&quot;127.1.2.3&quot;</span>,
+      <span class="s2">&quot;forcePassword&quot;</span>: null,
+      <span class="s2">&quot;comment&quot;</span>: null
+    <span class="o">}</span>
+  <span class="o">]</span>,
+  <span class="s2">&quot;command&quot;</span>: <span class="s2">&quot;groupListServers&quot;</span>
+<span class="o">}</span>
+</pre></div>
+</div>
+</section>
+<section id="using-json-greppable">
+<h3><a class="toc-backref" href="#id6">Using --json-greppable</a><a class="headerlink" href="#using-json-greppable" title="Permalink to this headline"></a></h3>
+<p>This is a variant of the <code class="docutils literal notranslate"><span class="pre">--json</span></code> option, but instead of relying on <code class="docutils literal notranslate"><span class="pre">JSON_START</span></code> and <code class="docutils literal notranslate"><span class="pre">JSON_END</span></code> anchors,
+which works for both <code class="docutils literal notranslate"><span class="pre">--json</span></code> and <code class="docutils literal notranslate"><span class="pre">--json-pretty</span></code> modes, here the JSON output is packed on one line,
+starting with the <code class="docutils literal notranslate"><span class="pre">JSON_OUTPUT=</span></code> anchor.
+You may use the option that is the easier for you to parse in your script or calling program.</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json--greppable
+</span>---ac777d06bec9-------------------------------------------the-bastion-3.12.00---
+<span class="o">=</span>&gt; list of servers pertaining to the group
+--------------------------------------------------------------------------------
+~        IP PORT  USER          ACCESS-BY ADDED-BY   ADDED-AT
+~ --------- ---- ----- ------------------ -------- ----------
+~ <span class="m">127</span>.1.2.3   <span class="m">22</span> <span class="o">(</span>any<span class="o">)</span>     mygroup<span class="o">(</span>group<span class="o">)</span>  johndoe <span class="m">2023</span>-07-31
+~
+~ <span class="m">1</span> accesses listed
+
+<span class="nv">JSON_OUTPUT</span><span class="o">={</span><span class="s2">&quot;error_code&quot;</span>:<span class="s2">&quot;OK&quot;</span>,<span class="s2">&quot;command&quot;</span>:<span class="s2">&quot;groupListServers&quot;</span>,<span class="s2">&quot;error_message&quot;</span>:<span class="s2">&quot;OK&quot;</span>,<span class="s2">&quot;value&quot;</span>:<span class="o">[{</span><span class="s2">&quot;reverseDns&quot;</span>:null,<span class="s2">&quot;userComment&quot;</span>:null,<span class="s2">&quot;user&quot;</span>:null,<span class="s2">&quot;forceKey&quot;</span>:null,<span class="s2">&quot;port&quot;</span>:<span class="s2">&quot;22&quot;</span>,<span class="s2">&quot;addedDate&quot;</span>:<span class="s2">&quot;2023-07-31 08:56:05&quot;</span>,<span class="s2">&quot;expiry&quot;</span>:null,<span class="s2">&quot;addedBy&quot;</span>:<span class="s2">&quot;johndoe&quot;</span>,<span class="s2">&quot;ip&quot;</span>:<span class="s2">&quot;127.1.2.3&quot;</span>,<span class="s2">&quot;comment&quot;</span>:null,<span class="s2">&quot;forcePassword&quot;</span>:null<span class="o">}]}</span>
+----------------------------------------------------------&lt;/groupListServers&gt;---
+</pre></div>
+</div>
+<p>Here is an example of parsing using simple shell commands:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">ssh robot-group@bastion1.example.org -- --osh groupListServers --group mygroup --json-greppable --quiet <span class="p">|</span> <span class="se">\</span>
+</span><span class="hll">  grep ^JSON_OUTPUT<span class="o">=</span> <span class="p">|</span> cut -d<span class="o">=</span> -f2- <span class="p">|</span> jq .
+</span><span class="o">{</span>
+  <span class="s2">&quot;error_code&quot;</span>: <span class="s2">&quot;OK&quot;</span>,
+  <span class="s2">&quot;error_message&quot;</span>: <span class="s2">&quot;OK&quot;</span>,
+  <span class="s2">&quot;value&quot;</span>: <span class="o">[</span>
+    <span class="o">{</span>
+      <span class="s2">&quot;userComment&quot;</span>: null,
+      <span class="s2">&quot;reverseDns&quot;</span>: null,
+      <span class="s2">&quot;expiry&quot;</span>: null,
+      <span class="s2">&quot;user&quot;</span>: null,
+      <span class="s2">&quot;forceKey&quot;</span>: null,
+      <span class="s2">&quot;addedDate&quot;</span>: <span class="s2">&quot;2023-07-31 08:56:05&quot;</span>,
+      <span class="s2">&quot;port&quot;</span>: <span class="s2">&quot;22&quot;</span>,
+      <span class="s2">&quot;addedBy&quot;</span>: <span class="s2">&quot;johndoe&quot;</span>,
+      <span class="s2">&quot;ip&quot;</span>: <span class="s2">&quot;127.1.2.3&quot;</span>,
+      <span class="s2">&quot;forcePassword&quot;</span>: null,
+      <span class="s2">&quot;comment&quot;</span>: null
+    <span class="o">}</span>
+  <span class="o">]</span>,
+  <span class="s2">&quot;command&quot;</span>: <span class="s2">&quot;groupListServers&quot;</span>
+<span class="o">}</span>
+</pre></div>
+</div>
+</section>
+</section>
+<section id="json-payload-format">
+<h2><a class="toc-backref" href="#id7">JSON payload format</a><a class="headerlink" href="#json-payload-format" title="Permalink to this headline"></a></h2>
+<p>The JSON payload is always a hash with 4 keys: <code class="docutils literal notranslate"><span class="pre">error_code</span></code>, <code class="docutils literal notranslate"><span class="pre">error_message</span></code>, <code class="docutils literal notranslate"><span class="pre">value</span></code> and <code class="docutils literal notranslate"><span class="pre">command</span></code>,
+as you may have witnessed from the examples above.</p>
+<p>These keys are detailed below.</p>
+<section id="command">
+<h3><a class="toc-backref" href="#id8">command</a><a class="headerlink" href="#command" title="Permalink to this headline"></a></h3>
+<p>The associated value is a string, containing the name of the command (plugin) that generated this output.</p>
+</section>
+<section id="error-code">
+<h3><a class="toc-backref" href="#id9">error_code</a><a class="headerlink" href="#error-code" title="Permalink to this headline"></a></h3>
+<p>The associated value is an always-uppercase string. You should look at the prefix of this string to know
+whether the command was a success or not. The value is never <code class="docutils literal notranslate"><span class="pre">null</span></code> and always matches the following regex:
+<code class="docutils literal notranslate"><span class="pre">^(OK|KO|ERR)[A-Z0-9_]*$</span></code>. The possible prefixes are either:</p>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">OK</span></code>: the command has succeeded</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">KO</span></code>: the command did not succeed</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">ERR</span></code>: the command encountered an error, more information should be available in the <code class="docutils literal notranslate"><span class="pre">error_message</span></code> field,
+the <code class="docutils literal notranslate"><span class="pre">value</span></code> field will most likely be <code class="docutils literal notranslate"><span class="pre">null</span></code></p></li>
+</ul>
+<p>Examples of such values include: <code class="docutils literal notranslate"><span class="pre">KO_ACCESS_DENIED</span></code>, <code class="docutils literal notranslate"><span class="pre">OK</span></code>, <code class="docutils literal notranslate"><span class="pre">OK_NO_CHANGE</span></code>, <code class="docutils literal notranslate"><span class="pre">ERR_MEMBER_CANNOT_BE_GUEST</span></code>.</p>
+<p>You should rely on these error codes in the code using The Bastion's API to take decisions.</p>
+</section>
+<section id="error-message">
+<h3><a class="toc-backref" href="#id10">error_message</a><a class="headerlink" href="#error-message" title="Permalink to this headline"></a></h3>
+<p>The associated value is a string, intended for human reading. It gives more details about the returned <code class="docutils literal notranslate"><span class="pre">error_code</span></code>,
+but is not intended to be parsed by your code, as it may change without notice from version to version. If there is no
+specific <code class="docutils literal notranslate"><span class="pre">error_message</span></code> for a given case, the value will be the same than the one for <code class="docutils literal notranslate"><span class="pre">error_code</span></code>, hence this
+field is guaranteed to always exist and never be <code class="docutils literal notranslate"><span class="pre">null</span></code>.</p>
+</section>
+<section id="value">
+<h3><a class="toc-backref" href="#id11">value</a><a class="headerlink" href="#value" title="Permalink to this headline"></a></h3>
+<p>The data associated to the key <code class="docutils literal notranslate"><span class="pre">value</span></code> is entirely dependent on <code class="docutils literal notranslate"><span class="pre">command</span></code>, and can be a nested structure of
+hashes and/or arrays. This is the actual data payload returned by the command you've invoked. Note that <code class="docutils literal notranslate"><span class="pre">value</span></code>
+can also be <code class="docutils literal notranslate"><span class="pre">null</span></code>, particularly if the <code class="docutils literal notranslate"><span class="pre">error_code</span></code> doesn't start with the <code class="docutils literal notranslate"><span class="pre">OK</span></code> prefix.</p>
+</section>
+</section>
+<section id="good-practices">
+<h2><a class="toc-backref" href="#id12">Good practices</a><a class="headerlink" href="#good-practices" title="Permalink to this headline"></a></h2>
+<p>If you're intending interaction with The Bastion API, it's a good idea to have accounts dedicated to this, to have
+a clear distinction between human SSH usage and automated API calls. Additionally, if your automation will only
+use such accounts to call plugins (<code class="docutils literal notranslate"><span class="pre">--osh</span></code> commands), you might want to create such accounts with the <code class="docutils literal notranslate"><span class="pre">--osh-only</span></code>
+parameter to <code class="docutils literal notranslate"><span class="pre">accountCreate</span></code>, this guarantees that such accounts will never be able to use The Bastion to connect
+to other infrastructures (e.g. using SSH) even if granted to.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="http_proxy.html" class="btn btn-neutral float-left" title="HTTPS Proxy" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="specific_ssh_clients_tutorials/index.html" class="btn btn-neutral float-right" title="Specific SSH clients tutorials" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/basics/access_management.html b/using/basics/access_management.html
new file mode 100644
index 000000000..0943ae06b
--- /dev/null
+++ b/using/basics/access_management.html
@@ -0,0 +1,282 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Access management &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="PIV keys support" href="../piv.html" />
+    <link rel="prev" title="First steps" href="first_steps.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">The basics</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="first_steps.html">First steps</a></li>
+<li class="toctree-l2 current"><a class="current reference internal" href="#">Access management</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#personal-accesses">Personal Accesses</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#decentralized-help-yourself">Decentralized (help yourself)</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#centralized-ask-the-it-crowd">Centralized (ask the IT crowd)</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="#group-accesses">Group Accesses</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#servers-list">Servers list</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#members-list">Members list</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#and-some-more">And some more</a></li>
+</ul>
+</li>
+<li class="toctree-l3"><a class="reference internal" href="#global-roles">Global roles</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">The basics</a> &raquo;</li>
+      <li>Access management</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/using/basics/access_management.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="access-management">
+<h1>Access management<a class="headerlink" href="#access-management" title="Permalink to this headline"></a></h1>
+<p>There are two ways of managing authorizations on The Bastion, it is extremely important
+to understand those two ways because they're complementary.</p>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This section is largely inspired from the <a class="reference external" href="https://blog.ovhcloud.com/the-ovhcloud-ssh-bastion-part-2-delegation-dizziness/">blog post about the subject</a></p>
+</div>
+<p>The main idea is that delegation is at the core of the system: everybody has their own set of responsibilities,
+and potential actions, without having to ask the bastion admin.</p>
+<section id="personal-accesses">
+<span id="accessmanagementpersonalaccesses"></span><h2>Personal Accesses<a class="headerlink" href="#personal-accesses" title="Permalink to this headline"></a></h2>
+<p>On the bastion, each account has (at least) one set of <strong>personal egress keys</strong>.
+These beasts are generated when the account is first created.
+The personal egress <strong>private key</strong> sits in the bastion account home.
+The account user has no way to see it, or export it out of the bastion,
+but they can use it through the bastion's code logic.
+The user can retrieve the corresponding <strong>public key</strong> at any time, using the <a class="reference internal" href="../../plugins/open/selfListEgressKeys.html"><span class="doc">selfListEgressKeys</span></a>
+command, and install it – or get it installed – on the remote servers they needs to access.
+Depending on your use case – and the level of autonomy you want to give to the teams – there are
+two ways of managing these personal accesses.</p>
+<section id="decentralized-help-yourself">
+<h3>Decentralized (help yourself)<a class="headerlink" href="#decentralized-help-yourself" title="Permalink to this headline"></a></h3>
+<p>The first way mimics how you would manage accesses if you weren't using an SSH bastion at all.
+This is a perfectly valid way to handle accesses on a simple level, without too many users and a limited
+number of machines. This allows anyone to grant themselves personal accesses on the bastion,
+without having to ask anyone else to do it. It sounds like a security hole, but it's not.
+If someone adds themself a personal access to the remote server, it will only work if their
+personal egress public key has already been installed on the remote server.
+In other words, they either already had access to the remote server to do this – using means other than the bastion –
+or somebody who had access to the remote server accepted the addition of their key.
+Either way, they cannot magically grant themselves personal access without
+the admins of the remote server first permitting their key.</p>
+</section>
+<section id="centralized-ask-the-it-crowd">
+<h3>Centralized (ask the IT crowd)<a class="headerlink" href="#centralized-ask-the-it-crowd" title="Permalink to this headline"></a></h3>
+<p>Another way to handle this can be to grant a limited number of people, such as security teams,
+the right to add personal accesses to others. This way people are less autonomous, but it might be useful
+if adding accesses has to be enacted via normalized processes. It also has some nice effects: as a sysadmin,
+one of the pros is that you can create 3 separate accounts on the remote machine, and map them to each bastion account
+you're adding. This is a good method for achieving <strong>end-to-end traceability</strong>; including on the remote server;
+where you might want to install <strong>auditd</strong> or similar tools.
+It's also doable in the help yourself mode, but it may be harder to enforce.</p>
+<p>To be clear, this access model doesn't scale so efficiently when we're dealing with whole teams,
+or big infrastructures – this is where group-based access comes handy.</p>
+</section>
+</section>
+<section id="group-accesses">
+<span id="accessmanagementgroupaccesses"></span><h2>Group Accesses<a class="headerlink" href="#group-accesses" title="Permalink to this headline"></a></h2>
+<a class="reference internal image-reference" href="../../_images/groups.png"><img alt="../../_images/groups.png" src="../../_images/groups.png" style="width: 400px;" /></a>
+<p>A group has three components:</p>
+<ul class="simple">
+<li><p>A list of members (accounts, representing individual people)</p></li>
+<li><p>At least one set of group egress keys</p></li>
+<li><p>A list of servers (or more precisely IPs)</p></li>
+</ul>
+<section id="servers-list">
+<h3>Servers list<a class="headerlink" href="#servers-list" title="Permalink to this headline"></a></h3>
+<p>The servers list is actually a list of IPs, or IP blocks. They map to your servers, network devices,
+or anything else with SSH capability that has an IP (on which the egress group key has been installed).
+Technically, this list is actually composed of 3-tuple items: remote user, remote IP (or IP block), remote port.
+That which applies to the personal accesses, also applies here: adding a server to the list doesn't magically
+give access to it, it is first necessary to install the <strong>egress group public key</strong>.
+Of course, managing the installation of these keys manually quickly becomes impractical,
+but you can consider these part of the configuration of the servers, hence they should be managed with whichever
+centralized configuration system you already use (Puppet, Chef, Ansible, /bin/cp… wait, no, strike this last one).</p>
+</section>
+<section id="members-list">
+<h3>Members list<a class="headerlink" href="#members-list" title="Permalink to this headline"></a></h3>
+<p>The members are people who can connect to any server listed in the group server list.
+They'll be using the <strong>private egress group key</strong> they have access to, as members of said group.
+Of course, they have no way to extract this private key for their own use outside of the bastion,
+they can only use it through the bastion's code logic.</p>
+<p>Got a new team member? Just add them as a member of your group, and they instantly get access to all the group servers.
+Somebody leaves the company? Just delete their account on the bastion, and all the accesses are instantly gone.
+This is the case because all your servers should have incoming SSH sessions limited to your bastions.
+This way, any rogue SSH key that would have been added, is no longer of any use.</p>
+</section>
+<section id="and-some-more">
+<span id="accessmanagementgrouproles"></span><h3>And some more<a class="headerlink" href="#and-some-more" title="Permalink to this headline"></a></h3>
+<p>We've covered the basics of the group-based approach, but as we need a lot of flexibility and delegation,
+there is a little more to cover. Remember when I said a group had 3 components? Well, I lied.
+A group has more than just members. Additional group roles include:</p>
+<ul class="simple">
+<li><p>Guests</p></li>
+<li><p>Gatekeepers</p></li>
+<li><p>Aclkeepers</p></li>
+<li><p>Owners</p></li>
+</ul>
+<p>All of these are lists of accounts that have a specific role in the group.</p>
+<img alt="../../_images/group_roles.png" src="../../_images/group_roles.png" />
+<p>First, <strong>guests</strong>. These are a bit like members, but with less privileges: they can connect to remote machines
+using the group key, but not to all the machines of the group, only to a subset.
+This is useful when somebody outside of the team needs a specific access to a specific server,
+potentially for a limited amount of time (as such accesses can be set to expire).</p>
+<p>Then, <strong>gatekeepers</strong>. Those guys manage the list of members and guests of the group.
+In other terms, they have the right to give the right to get access. Nothing too complicated here.
+Then, there are the <strong>aclkeepers</strong>. As you may have guessed, they manage the list of servers that are
+part of the group. If you happen to have some automation managing the provisioning of servers of your infrastructure,
+this role could be granted to a robot account whose sole purpose would be to update the servers list on the bastion,
+in a completely integrated way with your provisioning.
+You can even tag such accounts so that they'll never be able to use SSH through the bastion,
+even if somebody grants them by mistake!</p>
+<p>Last but not least, the <strong>owners</strong> have the highest privilege level on the group, which means they can manage
+the gatekeepers, aclkeepers and owners lists. They are permitted to give the right to give the right to get access.
+Moreover, users can accumulate these roles, which means some accounts may be a member
+and a gatekeeper at the same time, for example.</p>
+</section>
+</section>
+<section id="global-roles">
+<h2>Global roles<a class="headerlink" href="#global-roles" title="Permalink to this headline"></a></h2>
+<p>Beyond the roles we have just described – which are all scoped to a group – there are two additional roles,
+which are scoped to the whole bastion: the <strong>superowner</strong> and the <strong>bastion admin</strong>.</p>
+<p>In a nutshell, a <strong>superowner</strong> is the implicit owner of all groups present on the bastion.
+This comes in handy if the group becomes ownerless, as superowners are able to nominate a brand new owner.</p>
+<p>The most powerful role is the <strong>bastion admin</strong>. This role should only be given to a few individuals,
+as they can impersonate anyone, and in practice should not be given to somebody who is not already root
+on the bastion's operating system itself. Among other things, they manage the configuration of the bastion,
+where the superowners are declared.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="first_steps.html" class="btn btn-neutral float-left" title="First steps" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../piv.html" class="btn btn-neutral float-right" title="PIV keys support" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/basics/first_steps.html b/using/basics/first_steps.html
new file mode 100644
index 000000000..94618322f
--- /dev/null
+++ b/using/basics/first_steps.html
@@ -0,0 +1,372 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>First steps &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="Access management" href="access_management.html" />
+    <link rel="prev" title="The basics" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">The basics</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">First steps</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#bastion-alias">Bastion alias</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#plugins">Plugins</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#setting-up-access-to-a-server">Setting up access to a server</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#connecting-to-a-server-and-reviewing-the-session">Connecting to a server and reviewing the session</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="access_management.html">Access management</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">The basics</a> &raquo;</li>
+      <li>First steps</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/using/basics/first_steps.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="first-steps">
+<h1>First steps<a class="headerlink" href="#first-steps" title="Permalink to this headline"></a></h1>
+<section id="bastion-alias">
+<h2>Bastion alias<a class="headerlink" href="#bastion-alias" title="Permalink to this headline"></a></h2>
+<p>You should setup a <em>bastion alias</em> to make it easy to connect to the bastion.
+An example of the proper alias to use for your account is given to the bastion administrator
+when they creates your account, and is usually something along the lines of:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="nb">alias</span> <span class="nv">bssh</span><span class="o">=</span><span class="s1">&#39;ssh -t myname@the-bastion.example.org --&#39;</span>
+</span></pre></div>
+</div>
+<p>Of course, you can modify it as you see fit, for example adding the <code class="docutils literal notranslate"><span class="pre">-i</span></code> argument to specify the private SSH key
+to use to connect to the bastion. You can use any name as the alias,
+but it's advised to keep it short, as you'll use it quite often.</p>
+<p>For the remaining of this documentation, we'll assume your bastion alias is <code class="docutils literal notranslate"><span class="pre">bssh</span></code>.</p>
+<p>You can do two categories of things on the bastion:</p>
+<ul class="simple">
+<li><p>Connect to infrastructures through it</p></li>
+<li><p>Interact with the bastion itself, for example to manage your account, and/or groups,
+through so-called <strong>PLUGINS</strong> aka <em>osh commands</em></p></li>
+</ul>
+</section>
+<section id="plugins">
+<h2>Plugins<a class="headerlink" href="#plugins" title="Permalink to this headline"></a></h2>
+<p>We'll start by using the <code class="docutils literal notranslate"><span class="pre">info</span></code> plugin, to verify that your bastion access works correctly:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh info
+</span>*------------------------------------------------------------------------------*
+<span class="p">|</span>THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.<span class="p">|</span>
+<span class="p">|</span>ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        <span class="p">|</span>
+*------------------------------------------------------------------------------*
+Enter PIN <span class="k">for</span> <span class="s1">&#39;PIV Card Holder pin (PIV_II)&#39;</span>:
+---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+<span class="o">=</span>&gt; information
+--------------------------------------------------------------------------------
+~ You are johndoe
+~ You are a bastion auditor!
+~ Look at you, you are a bastion superowner!
+~ Woosh, you are even a bastion admin!
+~
+~ Your <span class="nb">alias</span> to connect to this bastion is:
+~ <span class="nb">alias</span> <span class="nv">bssh</span><span class="o">=</span><span class="s1">&#39;ssh johndoe@the-bastion.example.org -p 22 -t -- &#39;</span>
+~ Your <span class="nb">alias</span> to connect to this bastion with MOSH is:
+~ <span class="nb">alias</span> <span class="nv">bsshm</span><span class="o">=</span><span class="s1">&#39;mosh --ssh=&quot;ssh -p 22 -t&quot; johndoe@the-bastion.example.org -- &#39;</span>
+~
+~ <span class="o">[</span>...<span class="o">]</span>
+~
+~ Here is your excuse <span class="k">for</span> anything not working today:
+~ BOFH excuse <span class="c1">#46:</span>
+~ waste water tank overflowed onto computer
+----------------------------------------------------------------------&lt;/info&gt;---
+Connection to the-bastion.example.org closed.
+</pre></div>
+</div>
+<p>Congratulations, you've just used your first command on the bastion!</p>
+<p>You can get a list of all the plugins you can use by saying:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh <span class="nb">help</span>
+</span></pre></div>
+</div>
+<p>The list will depend on your access level on the bastion, as some commands are restricted.
+You can have more information about any command by using <code class="docutils literal notranslate"><span class="pre">--help</span></code> with it:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh selfAddIngressKey --help
+</span></pre></div>
+</div>
+<p>See the <strong>PLUGINS</strong> section on the left menu, for more information about the plugins.</p>
+<p>Instead of using <code class="docutils literal notranslate"><span class="pre">--osh</span></code> to call plugins, you can enter the special <em>interactive mode</em>, by saying:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh -i
+</span></pre></div>
+</div>
+<p>In this mode, you can directly enter commands, and also use auto-completion features with the <code class="docutils literal notranslate"><span class="pre">&lt;TAB&gt;</span></code> key.
+You can start by just typing <code class="docutils literal notranslate"><span class="pre">help</span></code>, which is the equivalent of saying <code class="docutils literal notranslate"><span class="pre">bssh</span> <span class="pre">--osh</span> <span class="pre">help</span></code>.
+For security reasons, the interactive mode will disconnect you after a given amount of idle-time.</p>
+</section>
+<section id="setting-up-access-to-a-server">
+<h2>Setting up access to a server<a class="headerlink" href="#setting-up-access-to-a-server" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>This section assumes that you've just set up your bastion and your account is the one that has been created
+on installation, with all the super-powers included, especially access to the restricted
+<a class="reference internal" href="../../plugins/restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a> command that we'll use below.
+If this is not the case, you'll need first to have a bastion admin grant you this command
+through <a class="reference internal" href="../../plugins/restricted/accountGrantCommand.html"><span class="doc">accountGrantCommand</span></a></p>
+</div>
+<p>Let's say that you have a server you want to secure access to, using the bastion.
+We'll call it <em>server42.example.org</em>, with IP 198.51.100.42.
+To do this, we'll use the <a class="reference internal" href="../../plugins/restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a> command.</p>
+<p>We can use the interactive mode to get the auto-completion features:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh -i
+</span>Enter PIN <span class="k">for</span> <span class="s1">&#39;PIV Card Holder pin (PIV_II)&#39;</span>:
+
+Welcome to bssh interactive mode, <span class="nb">type</span> <span class="sb">`</span>help<span class="s1">&#39; for available commands.</span>
+<span class="s1">You can use &lt;tab&gt; and &lt;tab&gt;&lt;tab&gt; for autocompletion.</span>
+<span class="s1">You&#39;</span>ll be disconnected after <span class="m">60</span> seconds of inactivity.
+Loading... <span class="m">88</span> commands and <span class="m">341</span> autocompletion rules loaded.
+
+bssh<span class="o">(</span>master<span class="o">)</span>&gt;
+</pre></div>
+</div>
+<p>You can enter the first few characters of the command, then use <code class="docutils literal notranslate"><span class="pre">&lt;TAB&gt;</span></code> to help you complete it,
+then use <code class="docutils literal notranslate"><span class="pre">&lt;TAB&gt;</span></code> again to show you the required arguments. The complete command would be as follows:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh(master)&gt; selfAddPersonalAccess --host 198.51.100.42 --port 22 --user root
+</span>---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+=&gt; adding private access to a server on your account
+--------------------------------------------------------------------------------
+~ Testing connection to root@198.51.100.42, please wait...
+Warning: Permanently added &#39;198.51.100.42&#39; (ECDSA) to the list of known hosts.
+root@198.51.100.42: Permission denied (publickey).
+~ Note: if you still want to add this access even if it doesn&#39;t work, use --force
+~ Couldn&#39;t connect to root@198.51.100.42 (ssh returned error 255). Hint: did you add the proper public key to the remote&#39;s authorized_keys?
+-----------------------------------------------------&lt;/selfAddPersonalAccess&gt;---
+bssh(master)&gt;
+</pre></div>
+</div>
+<p>You'll notice that it didn't work. This is because first, you need to add your <em>personal egress key</em> to the
+remote machine's <em>authorized_keys</em> file. If this seems strange, here is
+<a class="reference internal" href="../../presentation/principles.html"><span class="doc">how it works</span></a>.
+To get your <em>personal egress key</em>, you can use this command:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh<span class="o">(</span>master<span class="o">)</span>&gt; selfListEgressKeys
+</span>---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+<span class="o">=</span>&gt; the public part of your personal bastion key
+--------------------------------------------------------------------------------
+~ You can copy one of those keys to a remote machine to get access to it through your account
+~ on this bastion, <span class="k">if</span> it is listed <span class="k">in</span> your private access list <span class="o">(</span>check selfListAccesses<span class="o">)</span>
+~
+~ Always include the <span class="nv">from</span><span class="o">=</span><span class="s2">&quot;198.51.100.1/32&quot;</span> part when copying the key to a server!
+~
+~ fingerprint: SHA256:rMpoCaYPSfRqmOBFOJvEr5uLqxYjqYtRDgUoqUwH2nA <span class="o">(</span>ED25519-256<span class="o">)</span> <span class="o">[</span><span class="m">2019</span>/07/11<span class="o">]</span>
+~ keyline follows, please copy the *whole* line:
+<span class="nv">from</span><span class="o">=</span><span class="s2">&quot;198.51.100.1/32&quot;</span> ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILnY2NQTKsTDxgcaTE6vHVm9FIbud1rJcYQ/4xUyr+DK johndoe@bssh:1562861572
+--------------------------------------------------------&lt;/selfListEgressKeys&gt;---
+</pre></div>
+</div>
+<p>Now that you have it, you can push this public key (the line starting with the <em>from=</em>) to the remote server's
+root authorized_keys, i.e. <code class="docutils literal notranslate"><span class="pre">/root/.ssh/authorized_keys</span></code>. Now, you can add your access properly:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh<span class="o">(</span>master<span class="o">)</span>&gt; selfAddPersonalAccess --host <span class="m">198</span>.51.100.42 --port <span class="m">22</span> --user root
+</span>---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+<span class="o">=</span>&gt; adding private access to a server on your account
+--------------------------------------------------------------------------------
+~ Testing connection to root@198.51.100.42, please wait...
+Warning: Permanently added <span class="s1">&#39;198.51.100.42&#39;</span> <span class="o">(</span>ECDSA<span class="o">)</span> to the list of known hosts.
+~ Access to root@198.51.100.42:22 successfully added
+-----------------------------------------------------&lt;/selfAddPersonalAccess&gt;---
+bssh<span class="o">(</span>master<span class="o">)</span>&gt;
+</pre></div>
+</div>
+<p>All seems in order! Can we see this access we just created?</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh<span class="o">(</span>master<span class="o">)</span>&gt; selfListAccesses
+</span>---the-bastion.example.org----------------------------the-bastion-2.99.99-rc9---
+<span class="o">=</span>&gt; your access list
+--------------------------------------------------------------------------------
+~ Dear johndoe, you have access to the following servers:
+~ IP               PORT     USER    ACCESS-BY   ADDED-BY      ADDED-AT
+~ <span class="m">198</span>.51.100.42      <span class="m">22</span>     root    personal     johndoe    <span class="m">2020</span>-05-01
+-----------------------------------------------------&lt;/selfListAccesses&gt;---
+bssh<span class="o">(</span>master<span class="o">)</span>&gt;
+</pre></div>
+</div>
+</section>
+<section id="connecting-to-a-server-and-reviewing-the-session">
+<h2>Connecting to a server and reviewing the session<a class="headerlink" href="#connecting-to-a-server-and-reviewing-the-session" title="Permalink to this headline"></a></h2>
+<p>Good! Let's try to connect now!</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh<span class="o">(</span>master<span class="o">)</span>&gt; ssh root@198.51.100.42
+</span>~ Welcome to the-bastion, johndoe, your last login was <span class="m">00</span>:13:37 ago <span class="o">(</span>Fri <span class="m">2020</span>-08-28 <span class="m">13</span>:07:43 UTC<span class="o">)</span> from <span class="m">192</span>.0.2.11<span class="o">(</span>proxy-11.example.org<span class="o">)</span>
+
+proxy-11.example.org:40610 <span class="o">=</span>&gt; johndoe@the-bastion.example.org:22 <span class="o">=</span>&gt; root@server42.example.org:22 ...
+ allowed ... log on<span class="o">(</span>/home/johndoe/ttyrec/198.51.100.42/2020-08-28.13-07-45.497020.fb00e1957b22.johndoe.root.198.51.100.42.22.ttyrec<span class="o">)</span>
+
+ will try the following accesses you have:
+  - personal access with ED25519-256 key SHA256:rMpoCaYPSfRqmOBFOJvEr5uLqxYjqYtRDgUoqUwH2nA <span class="o">[</span><span class="m">2019</span>/07/11<span class="o">]</span>
+
+Connecting...
+
+root@server42:~# id
+<span class="nv">uid</span><span class="o">=</span><span class="m">0</span><span class="o">(</span>root<span class="o">)</span> <span class="nv">gid</span><span class="o">=</span><span class="m">0</span><span class="o">(</span>root<span class="o">)</span> <span class="nv">groups</span><span class="o">=</span><span class="m">0</span><span class="o">(</span>root<span class="o">)</span>,2<span class="o">(</span>bin<span class="o">)</span>
+root@server42:~#
+</pre></div>
+</div>
+<p>We're now connected to server42, and can do our work as usual. Note that to connect to server42, one can directly use:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh root@198.51.100.42
+</span></pre></div>
+</div>
+<p>Where <code class="docutils literal notranslate"><span class="pre">bssh</span></code> is the bastion alias we've just set up above, no need to enter interactive mode first of course.</p>
+<p>When we're done with server42, let's see if everything was correctly recorded:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh<span class="o">(</span>master<span class="o">)</span>&gt; selfListSessions --type ssh --detailed
+</span>---the-bastion.example.org---------------------the-bastion-2.99.99-rc9.2-ovh1---
+<span class="o">=</span>&gt; your past sessions list
+--------------------------------------------------------------------------------
+~ The list of your <span class="m">100</span> past sessions follows:
+~
+f4cca44a848e <span class="o">[</span><span class="m">2020</span>/08/26@09:28:57 - <span class="m">2020</span>/08/26@09:29:57 <span class="o">(</span>         <span class="m">60</span>.0<span class="o">)]</span> <span class="nb">type</span> ssh from <span class="m">192</span>.0.2.11:33450<span class="o">(</span>proxy-11.example.org<span class="o">)</span> via johndoe@198.51.100.1:22 to root@198.51.100.42:22<span class="o">(</span>server42.example.org<span class="o">)</span> returned <span class="m">0</span>
+----------------------------------------------------------&lt;/selfListSessions&gt;---
+</pre></div>
+</div>
+<p>The first column is the unique identifier of the connection (or osh command).
+Let's see what we did exactly during this session:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh(master)&gt; selfPlaySession --id f4cca44a848e
+</span>---the-bastion.example.org---------------------the-bastion-2.99.99-rc9.2-ovh1---
+=&gt; replay a past session
+--------------------------------------------------------------------------------
+~       ID: f4cca44a848e
+~  Started: 2020/08/26 09:28:57
+~    Ended: 2020/08/26 09:29:57
+~ Duration: 0d+00:01:00.382820
+~     Type: ssh
+~     From: 192.0.2.11:33450 (proxy-11.example.org)
+~      Via: johndoe@198.51.100.1:22
+~       To: root@198.51.100.42:22 (server42.example.org)
+~  RetCode: 0
+~
+~ Press &#39;+&#39; to play faster
+~ Press &#39;-&#39; to play slower
+~ Press &#39;1&#39; to restore normal playing speed
+~
+~ When you&#39;re ready to replay session 9f352fd4b85c, press ENTER.
+~ Starting from the next line, the Total Recall begins. Press CTRL+C to jolt awake.
+</pre></div>
+</div>
+<p>Now that you've connected to your first server, using a personal access,
+you may want to learn more about the <a class="reference internal" href="access_management.html"><span class="doc">Access management</span></a>, or directly dive into the <strong>PLUGINS</strong> on the left menu.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="The basics" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="access_management.html" class="btn btn-neutral float-right" title="Access management" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/basics/index.html b/using/basics/index.html
new file mode 100644
index 000000000..7e9bc9a19
--- /dev/null
+++ b/using/basics/index.html
@@ -0,0 +1,182 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>The basics &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="First steps" href="first_steps.html" />
+    <link rel="prev" title="Restoring from backup" href="../../installation/restoring_from_backup.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">The basics</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="first_steps.html">First steps</a></li>
+<li class="toctree-l2"><a class="reference internal" href="access_management.html">Access management</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>The basics</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/using/basics/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="the-basics">
+<h1>The basics<a class="headerlink" href="#the-basics" title="Permalink to this headline"></a></h1>
+<p>This section explains the basics you need to know to work with the bastion.
+It's advised to go through all the subsections.</p>
+<p>We make the assumption here that you already have a bastion account:</p>
+<ul class="simple">
+<li><p>either you're one of the admins who just <a class="reference internal" href="../../installation/basic.html"><span class="doc">installed</span></a> it, or</p></li>
+<li><p>one of the admins created an account for you, using <a class="reference internal" href="../../plugins/restricted/accountCreate.html"><span class="doc">accountCreate</span></a></p></li>
+</ul>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="first_steps.html">First steps</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="first_steps.html#bastion-alias">Bastion alias</a></li>
+<li class="toctree-l2"><a class="reference internal" href="first_steps.html#plugins">Plugins</a></li>
+<li class="toctree-l2"><a class="reference internal" href="first_steps.html#setting-up-access-to-a-server">Setting up access to a server</a></li>
+<li class="toctree-l2"><a class="reference internal" href="first_steps.html#connecting-to-a-server-and-reviewing-the-session">Connecting to a server and reviewing the session</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="access_management.html">Access management</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="access_management.html#personal-accesses">Personal Accesses</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="access_management.html#decentralized-help-yourself">Decentralized (help yourself)</a></li>
+<li class="toctree-l3"><a class="reference internal" href="access_management.html#centralized-ask-the-it-crowd">Centralized (ask the IT crowd)</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="access_management.html#group-accesses">Group Accesses</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="access_management.html#servers-list">Servers list</a></li>
+<li class="toctree-l3"><a class="reference internal" href="access_management.html#members-list">Members list</a></li>
+<li class="toctree-l3"><a class="reference internal" href="access_management.html#and-some-more">And some more</a></li>
+</ul>
+</li>
+<li class="toctree-l2"><a class="reference internal" href="access_management.html#global-roles">Global roles</a></li>
+</ul>
+</li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../../installation/restoring_from_backup.html" class="btn btn-neutral float-left" title="Restoring from backup" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="first_steps.html" class="btn btn-neutral float-right" title="First steps" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/http_proxy.html b/using/http_proxy.html
new file mode 100644
index 000000000..2d30fcb51
--- /dev/null
+++ b/using/http_proxy.html
@@ -0,0 +1,380 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>HTTPS Proxy &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="JSON API" href="api.html" />
+    <link rel="prev" title="SFTP &amp; SCP support" href="sftp_scp.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">HTTPS Proxy</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#query-workflow">Query workflow</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#setting-up-the-https-proxy">Setting up the HTTPS Proxy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#running-a-query-through-the-proxy">Running a query through the proxy</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#first-try">First try</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#access-declaration">Access declaration</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#egress-password">Egress password</a><ul>
+<li class="toctree-l4"><a class="reference internal" href="#for-personal-accesses">For personal accesses</a></li>
+<li class="toctree-l4"><a class="reference internal" href="#for-group-accesses">For group accesses</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>HTTPS Proxy</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/using/http_proxy.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="https-proxy">
+<h1><a class="toc-backref" href="#id1">HTTPS Proxy</a><a class="headerlink" href="#https-proxy" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#https-proxy" id="id1">HTTPS Proxy</a></p>
+<ul>
+<li><p><a class="reference internal" href="#introduction" id="id2">Introduction</a></p></li>
+<li><p><a class="reference internal" href="#query-workflow" id="id3">Query workflow</a></p></li>
+<li><p><a class="reference internal" href="#setting-up-the-https-proxy" id="id4">Setting up the HTTPS Proxy</a></p></li>
+<li><p><a class="reference internal" href="#running-a-query-through-the-proxy" id="id5">Running a query through the proxy</a></p>
+<ul>
+<li><p><a class="reference internal" href="#first-try" id="id6">First try</a></p></li>
+<li><p><a class="reference internal" href="#access-declaration" id="id7">Access declaration</a></p></li>
+<li><p><a class="reference internal" href="#egress-password" id="id8">Egress password</a></p>
+<ul>
+<li><p><a class="reference internal" href="#for-personal-accesses" id="id9">For personal accesses</a></p></li>
+<li><p><a class="reference internal" href="#for-group-accesses" id="id10">For group accesses</a></p></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</div>
+<section id="introduction">
+<h2><a class="toc-backref" href="#id2">Introduction</a><a class="headerlink" href="#introduction" title="Permalink to this headline"></a></h2>
+<p>In addition to securing your SSH accesses, by splitting the authentication part (ingress connection)
+and the authorization part (egress connection), The Bastion can do a similar job for HTTPS connections.</p>
+<p>Note that there is an overhead (depending on your hardware setup) of several hundreds of milliseconds
+for each query-response trip, due to the fact that multiple processes are spawned for each query,
+to ensure proper security containment to the calling account's system user.
+It's probably a bad idea to use on a multi-million queries/day workload,
+or if each added millisecond to the query-response trip impacts the QoS of your service.</p>
+<p>The primary use is for network devices, that happen to have more and more HTTPS APIs in addition
+to the usual <code class="docutils literal notranslate"><span class="pre">conf</span> <span class="pre">terminal</span></code> available through SSH. As the same commands are usually available from
+HTTPS and SSH on these devices, it would be too bad to secure the access to SSH through the bastion,
+but leave direct access to their HTTPS API!</p>
+</section>
+<section id="query-workflow">
+<h2><a class="toc-backref" href="#id3">Query workflow</a><a class="headerlink" href="#query-workflow" title="Permalink to this headline"></a></h2>
+<p>The workflow is similar to the one used by SSH, e.g. two distinct connections (ingress and egress),
+with the egress connection using credentials stored on the bastion:</p>
+<ul class="simple">
+<li><p>A client makes an HTTP request to the proxy, with the following information embedded in:</p>
+<ul>
+<li><p>The type of request (GET or POST)</p></li>
+<li><p>The complete URI, including the host of the remote HTTPS server it would like to send the request to</p></li>
+<li><p>Potential body data for POST requests</p></li>
+<li><p>Credentials to authenticate to the proxy on the ingress connection, namely the
+bastion account name and its proxy password (set by <code class="docutils literal notranslate"><span class="pre">selfGenerateProxyPassword</span></code>)</p></li>
+<li><p>User name to use to authenticate on the remote HTTPS server (for the egress connection)</p></li>
+</ul>
+</li>
+<li><p>The bastion checks the provided credentials to authenticate the request against a known account (authentication part)</p></li>
+<li><p>The bastion verifies whether the just-authenticated account has access rights to connect to the remote server
+as the specified remote user (authorization part)</p></li>
+<li><p>The bastion uses the (group or personal) credentials stored on the bastion,
+to passthrough the HTTP request to the remote server, as the specified remote user</p></li>
+<li><p>The bastion forwards the response to the client</p></li>
+</ul>
+</section>
+<section id="setting-up-the-https-proxy">
+<h2><a class="toc-backref" href="#id4">Setting up the HTTPS Proxy</a><a class="headerlink" href="#setting-up-the-https-proxy" title="Permalink to this headline"></a></h2>
+<p>You should enable the HTTPS Proxy daemon, and configure it.
+Please check the <a class="reference internal" href="../administration/configuration/osh-http-proxy_conf.html"><span class="doc">osh-http-proxy.conf</span></a> for more information.</p>
+</section>
+<section id="running-a-query-through-the-proxy">
+<h2><a class="toc-backref" href="#id5">Running a query through the proxy</a><a class="headerlink" href="#running-a-query-through-the-proxy" title="Permalink to this headline"></a></h2>
+<section id="first-try">
+<h3><a class="toc-backref" href="#id6">First try</a><a class="headerlink" href="#first-try" title="Permalink to this headline"></a></h3>
+<p>Once the proxy is running, we can try to query it:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">curl https://bastion1.example.org:8443/
+</span>No authentication provided, and authentication is mandatory
+</pre></div>
+</div>
+<p>Of course, the proxy only accepts to work when one is properly authenticated to it.
+To do this, one should have an account on the bastion, and use the <a class="reference internal" href="../plugins/open/selfGenerateProxyPassword.html"><span class="doc">selfGenerateProxyPassword</span></a>
+command so that a new ingress password is set for their account. They'll then be able to authenticate to the proxy
+using the HTTP basic-auth method, and try to send a request to a remote server.
+To keep a high compatibility with HTTP clients and libraries that can be used on the ingress side,
+all the additional data required by the bastion to properly authenticate, authorize and passthrough the request
+is encoded in the <em>user</em> part of the widely supported HTTP Authorize header (basic-auth).
+The <em>password</em> part corresponds to the password we've generated just above.</p>
+<p>The format of the <em>user</em> part is as follows:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>BASTION_ACCOUNT@REMOTE_USER@REMOTE_HOST%REMOTE_PORT
+</pre></div>
+</div>
+<p>The <strong>%REMOTE_PORT</strong> part is optional, and defaults to <strong>443</strong> if omitted.
+For example, to send a <strong>GET /info</strong> request to the remote network device named <strong>router12.example.org</strong> on
+the default port <strong>443</strong>, using the remote account <strong>monitoring</strong>, through the <strong>bastion1.example.org</strong> bastion,
+having the HTTPS Proxy listening on its port <strong>8443</strong> and a bastion account <strong>robot-mon</strong>, one can use <strong>curl</strong>:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">curl -u robot-mon@monitoring@router12.example.org https://bastion1.example.org:8443/info
+</span>Enter host password for user &#39;robot-mon@monitoring@router12.example.org&#39;:
+This account doesn&#39;t have access to this user@host tuple (Access denied for robot-mon to monitoring@router12.example.org:443)
+</pre></div>
+</div>
+<p>A password will be prompted: the password generated by <code class="docutils literal notranslate"><span class="pre">selfGenerateProxyPassword</span></code> should be entered.
+Remember: this is to authenticate yourself to the bastion (ingress connection), then the bastion will authenticate
+itself to the remote machine (egress connection), using credentials stored on the bastion,
+that your account must have access to.</p>
+<p>In the above case, we entered the password correctly, but our account doesn't have access to
+the requested host <cite>monitoring&#64;router12.example.org</cite>. This is what we need to do now.</p>
+</section>
+<section id="access-declaration">
+<h3><a class="toc-backref" href="#id7">Access declaration</a><a class="headerlink" href="#access-declaration" title="Permalink to this headline"></a></h3>
+<p>The access check is the same than the one done for SSH accesses, which means that oneself
+can have access to a remote host either through a <a class="reference internal" href="basics/access_management.html#accessmanagementpersonalaccesses"><span class="std std-ref">personal access</span></a> or
+a <a class="reference internal" href="basics/access_management.html#accessmanagementgroupaccesses"><span class="std std-ref">group access</span></a>.</p>
+<p>To get granted access to a remote device, through a personal access, either
+the <a class="reference internal" href="../plugins/restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a> or the <a class="reference internal" href="../plugins/restricted/accountAddPersonalAccess.html"><span class="doc">accountAddPersonalAccess</span></a> shall
+be used (both are restricted commands) such as:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh accountAddPersonalAccess --host router12.example.org --port 443 --user monitoring --force
+</span></pre></div>
+</div>
+<p>Note the use of <code class="docutils literal notranslate"><span class="pre">--force</span></code> to skip the SSH connection test, which is useless in our case.</p>
+<p>To use a group access instead, one of the <a class="reference internal" href="basics/access_management.html#accessmanagementgrouproles"><span class="std std-ref">aclkeepers</span></a> of the group
+should use <a class="reference internal" href="../plugins/group-aclkeeper/groupAddServer.html"><span class="doc">groupAddServer</span></a>, such as:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh groupAddServer --group netdevices --host router12.example.org --port 443 --user monitoring --force
+</span></pre></div>
+</div>
+</section>
+<section id="egress-password">
+<h3><a class="toc-backref" href="#id8">Egress password</a><a class="headerlink" href="#egress-password" title="Permalink to this headline"></a></h3>
+<section id="for-personal-accesses">
+<h4><a class="toc-backref" href="#id9">For personal accesses</a><a class="headerlink" href="#for-personal-accesses" title="Permalink to this headline"></a></h4>
+<p>If access to a remote device is granted to you through a personal access (using either the <code class="docutils literal notranslate"><span class="pre">selfAddPersonalAccess</span></code>
+or <code class="docutils literal notranslate"><span class="pre">accountAddPersonalAccess</span></code> commands), you must first generate a new set of credentials that will be stored
+on your bastion account, for egress connections. This is the equivalent of your personal egress keys for SSH,
+but in that case it's a password that will be used to authenticate using basic-auth to the remote server.
+You can generate this password using the <code class="docutils literal notranslate"><span class="pre">selfGeneratePassword</span></code> command:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh selfGeneratePassword --do-it
+</span>*------------------------------------------------------------------------------*
+|THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+|ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+*------------------------------------------------------------------------------*
+╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+│ ▶ generating a new egress password for your account
+├───────────────────────────────────────────────────────────────────────────────
+│ Generated a new password of length 16 for your account, robot-mon, hashes follow:
+│ md5crypt: $1$G0fo$2DH2OJQJ9bMgo5fUUuPeK.
+│ sha256crypt: $5$2xd1aGuD$ze7px3olXdjWthSrdnzelm6avzT2kszx/voXms8/V00
+│ sha512crypt: $6$udw2UNLs$tQ1p7ZYraOT4Woh1ZCGJNf.UAIh09nXPBf4ejpRurOY/fJUs6Dgh1WdkpY4pdCvKMQrPeetB42bNTSzIwJyGi1
+│ This new password will now be used by default.
+╰─────────────────────────────────────────────────────&lt;/selfGeneratePassword&gt;───
+</pre></div>
+</div>
+<p>As you can see, the password is stored on your bastion account, and is not printed: only its hashes are.
+With this information, the corresponding remote account can be provisioned on the device (usually, a network device).
+In our above example, an account named <strong>monitoring</strong> would have to be created on the remote device,
+using one of these hashes. Prefer to use the most secure hashing algorithm supported by the remote device.</p>
+<p>To get your password (hash) list, you can use <code class="docutils literal notranslate"><span class="pre">selfListPasswords</span></code>:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh selfListPasswords
+</span>*------------------------------------------------------------------------------*
+|THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+|ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+*------------------------------------------------------------------------------*
+╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+│ ▶ list your egress passwords
+├───────────────────────────────────────────────────────────────────────────────
+│ Current password created at Tue Jun 22 15:42:10 2021 by robot-mon
+│ ... md5crypt: $1$G0fo$2DH2OJQJ9bMgo5fUUuPeK.
+│ ... sha256crypt: $5$2xd1aGuD$ze7px3olXdjWthSrdnzelm6avzT2kszx/voXms8/V00
+│ ... sha512crypt: $6$udw2UNLs$tQ1p7ZYraOT4Woh1ZCGJNf.UAIh09nXPBf4ejpRurOY/fJUs6Dgh1WdkpY4pdCvKMQrPeetB42bNTSzIwJyGi1
+│
+│ Fallback password 1 created at Wed Jun  2 08:00:01 2021 by robot-mon
+│ ... md5crypt: $1$qF0M$2.rbRRGs66aPiEpc/SqGv/
+│ ... sha256crypt: $5$E9qkC7D6$SG8BB.nXvwU0dB0Bq9S/sF5pDidLwSIDKCv95qNWhX0
+│ ... sha512crypt: $6$druGNgSk$bzVHSvux/OOE2ZhDpabFekQU3GTsiKS7Yl/lLmb9gIAmjnFfR6gj7GzOniK2jdLtEcB/hQlhcx9TDgj5zHhVd.
+│
+╰────────────────────────────────────────────────────────&lt;/selfListPasswords&gt;───
+</pre></div>
+</div>
+<p>If the <code class="docutils literal notranslate"><span class="pre">selfGeneratePassword</span></code> command is used several times, the newly generated password will always override
+the previous one. Still, all the previous passwords are kept (archived) for good measure, and can be restored
+manually by a bastion admin. These passwords are named <em>Fallback passwords</em> in the output of <code class="docutils literal notranslate"><span class="pre">selfListPasswords</span></code>.</p>
+</section>
+<section id="for-group-accesses">
+<h4><a class="toc-backref" href="#id10">For group accesses</a><a class="headerlink" href="#for-group-accesses" title="Permalink to this headline"></a></h4>
+<p>If the access to the remote device is given through a group, then the group's own credentials will be used.
+To this effect, one of the group owners should use the <a class="reference internal" href="../plugins/group-owner/groupGeneratePassword.html"><span class="doc">groupGeneratePassword</span></a> command:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh groupGeneratePassword --group netdevices --do-it
+</span>╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+│ ▶ generating a new egress password for the group
+├───────────────────────────────────────────────────────────────────────────────
+│ Generated a new password of length 16 for group netdevices, hashes follow:
+│ md5crypt: $1$9sb2$X8/pPBSLfQ0ddBGR/bzsT1
+│ sha256crypt: $5$o6Jr8w0X$yQfLuX17tUwE1jfhhAX//vsn6KpXU5jUd7SCNbkYNH.
+│ sha512crypt: $6$gyxMyjao$YNhZJPXZa4r838XKg2tfvvoV/Dtm5HKsyKt18BnvFfT.y.hZuSXRX9GhM4mA0hUsO9f0UBisO/WiK3vF/9qsL1
+│ This new password will now be used by default.
+╰────────────────────────────────────────────────────&lt;/groupGeneratePassword&gt;───
+</pre></div>
+</div>
+<p>As with the personal egress passwords, the password is stored on the bastion only, and is not printed:
+only its hashes are. With this information, the corresponding remote account can be provisioned
+on the device (usually, a network device).
+In our above example, an account named <strong>monitoring</strong> would have to be created on the remote device,
+using one of these hashes. Prefer to use the most secure hashing algorithm supported by the remote device.</p>
+<p>To get the group's password (hash) list, one can use the <a class="reference internal" href="../plugins/open/groupListPasswords.html"><span class="doc">groupListPasswords</span></a> command:</p>
+<div class="highlight-none notranslate"><div class="highlight"><pre><span></span><span class="hll">bssh --osh groupListPasswords --group netdevices
+</span>*------------------------------------------------------------------------------*
+|THIS IS A PRIVATE COMPUTER SYSTEM, UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED.|
+|ALL CONNECTIONS ARE LOGGED. IF YOU ARE NOT AUTHORIZED, DISCONNECT NOW.        |
+*------------------------------------------------------------------------------*
+╭──bastion1.example.org───────────────────────────────the-bastion-3.03.99-rc1───
+│ ▶ list the egress passwords of the group
+├───────────────────────────────────────────────────────────────────────────────
+│ Current password created at Tue Jun 29 10:21:38 2021 by slesimpl
+│ ... md5crypt: $1$9sb2$X8/pPBSLfQ0ddBGR/bzsT1
+│ ... sha256crypt: $5$o6Jr8w0X$yQfLuX17tUwE1jfhhAX//vsn6KpXU5jUd7SCNbkYNH.
+│ ... sha512crypt: $6$gyxMyjao$YNhZJPXZa4r838XKg2tfvvoV/Dtm5HKsyKt18BnvFfT.y.hZuSXRX9GhM4mA0hUsO9f0UBisO/WiK3vF/9qsL1
+╰───────────────────────────────────────────────────────&lt;/groupListPasswords&gt;───
+</pre></div>
+</div>
+<p>If the <code class="docutils literal notranslate"><span class="pre">groupGeneratePassword</span></code> command is used several times, the newly generated password will always
+override the previous one. Still, all the previous passwords are kept (archived) for good measure,
+and can be restored manually by a bastion admin.
+These passwords are named <em>Fallback passwords</em> in the output of <code class="docutils literal notranslate"><span class="pre">groupListPasswords</span></code>.</p>
+</section>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="sftp_scp.html" class="btn btn-neutral float-left" title="SFTP &amp; SCP support" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="api.html" class="btn btn-neutral float-right" title="JSON API" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/piv.html b/using/piv.html
new file mode 100644
index 000000000..927611e3b
--- /dev/null
+++ b/using/piv.html
@@ -0,0 +1,326 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>PIV keys support &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="SFTP &amp; SCP support" href="sftp_scp.html" />
+    <link rel="prev" title="Access management" href="basics/access_management.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basics/index.html">The basics</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">PIV keys support</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#without-a-policy">Without a policy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#per-account-policy">Per-account policy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#global-policy">Global policy</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#temporary-grace-period">Temporary grace period</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>PIV keys support</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/using/piv.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="piv-keys-support">
+<h1><a class="toc-backref" href="#id1">PIV keys support</a><a class="headerlink" href="#piv-keys-support" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#piv-keys-support" id="id1">PIV keys support</a></p>
+<ul>
+<li><p><a class="reference internal" href="#introduction" id="id2">Introduction</a></p></li>
+<li><p><a class="reference internal" href="#without-a-policy" id="id3">Without a policy</a></p></li>
+<li><p><a class="reference internal" href="#per-account-policy" id="id4">Per-account policy</a></p></li>
+<li><p><a class="reference internal" href="#global-policy" id="id5">Global policy</a></p></li>
+<li><p><a class="reference internal" href="#temporary-grace-period" id="id6">Temporary grace period</a></p></li>
+</ul>
+</li>
+</ul>
+</div>
+<section id="introduction">
+<h2><a class="toc-backref" href="#id2">Introduction</a><a class="headerlink" href="#introduction" title="Permalink to this headline"></a></h2>
+<p>The Bastion supports enabling a policy forcing accounts SSH ingress keys to originate from a known hardware token,
+ensuring that the private SSH key is only stored on this hardware token, and not on the filesystem.</p>
+<p>Currently, only Yubico keys implementing PIV can be verified this way. In that case, each individual hardware token
+has a builtin Certificate Authority, signed by a well-known Yubico certificate, hence proving that the hardware token
+is known and legit.</p>
+<p>This builtin CA, in turn, emits an attestation certificate each time a new PIV key is generated on the hardware token,
+hence proving that the bikey (private and public) has been generated by this individual hardware token.
+Other metadata is included in the attestation, such as the firmware version, the serial number of the token,
+the <em>TouchPolicy</em> and <em>PinPolicy</em>. Note that you may decide to overwrite the builtin CA by a one of your own,
+possibly signed by a CA of your company. This would ensure not only that the SSH key is provided by the device,
+but also that the device has been provided by your company.</p>
+<p>Please refer to
+the <a class="reference external" href="https://developers.yubico.com/PIV/Introduction/PIV_attestation.html">Yubico PIV attestation page</a> and
+the <a class="reference external" href="https://developers.yubico.com/yubico-piv-tool/YubiKey_PIV_introduction.html">Yubico PIV tool page</a>
+for more information.</p>
+</section>
+<section id="without-a-policy">
+<h2><a class="toc-backref" href="#id3">Without a policy</a><a class="headerlink" href="#without-a-policy" title="Permalink to this headline"></a></h2>
+<p>If you want to support PIV keys without making those mandatory, you don't have anything to do:
+those keys are just regular RSA/ECDSA keys and they <em>just work</em> with The Bastion.
+In that case, after having properly configured your hardware token with a key in slot 9a,
+you can just use <a class="reference internal" href="../plugins/open/selfAddIngressKey.html"><span class="doc">selfAddIngressKey</span></a> to add the key to your bastion account, and call it a day.
+As a quick guidance, on a Yubikey you can usually generate a key in the proper slot this way,
+after you've setup a management key:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">yubico-piv-tool --key<span class="o">=</span>YOUR_MGMT_KEY --action generate --pin-policy always --touch-policy never --slot 9a -o -
+</span></pre></div>
+</div>
+<p>Now, if you want the bastion to be aware that this key is from a hardware token, you shall use the <code class="docutils literal notranslate"><span class="pre">--piv</span></code> option
+to <a class="reference internal" href="../plugins/open/selfAddIngressKey.html"><span class="doc">selfAddIngressKey</span></a>. This won't do anything special per-se, except storing
+the certificates information, and showing the details of the PIV key in command outputs
+such as <a class="reference internal" href="../plugins/open/selfListIngressKeys.html"><span class="doc">selfListIngressKeys</span></a>.
+Note however that if in the future you enable the PIV enforcing policy either on your account or globally,
+this key will be considered valid, contrary to all the keys added without the <code class="docutils literal notranslate"><span class="pre">--piv</span></code> option,
+even if these keys happen to be PIV ones. To add a key with the <code class="docutils literal notranslate"><span class="pre">--piv</span></code> option, you'll need the SSH public key
+as usual, but also the attestation certificate and the key certificate.
+Step by step details on how to get those are out of the scope of this document,
+but again as a quick guidance, on a Yubikey you can usually get those this way:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span><span class="hll">yubico-piv-tool --action<span class="o">=</span>read-certificate --slot<span class="o">=</span>9a --key-format<span class="o">=</span>SSH
+</span><span class="hll">yubico-piv-tool --action<span class="o">=</span>attest --slot<span class="o">=</span>9a
+</span><span class="hll">yubico-piv-tool --action<span class="o">=</span>read-certificate --slot<span class="o">=</span>f9
+</span></pre></div>
+</div>
+<p>When you'll have added your key, you'll see a few more details than usual:</p>
+<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="go">bssh --osh selfAddIngressKey --piv</span>
+</span><span class="go">Enter PIN for &#39;PIV Card Holder pin (PIV_II)&#39;:</span>
+<span class="go">---the-bastion.example.org--------------------------------the-bastion-3.01.03---</span>
+<span class="go">=&gt; add a new public key to your account</span>
+<span class="go">--------------------------------------------------------------------------------</span>
+<span class="go">~ Please paste the SSH key you want to add. This bastion supports the following algorithms:</span>
+<span class="go">~ ED25519: strongness[#####] speed[#####], use `ssh-keygen -t ed25519&#39; to generate one</span>
+<span class="go">~ ECDSA  : strongness[####.] speed[#####], use `ssh-keygen -t ecdsa -b 521&#39; to generate one</span>
+<span class="go">~ RSA    : strongness[###..] speed[#....], use `ssh-keygen -t rsa -b 4096&#39; to generate one</span>
+<span class="go">~</span>
+<span class="go">~ In any case, don&#39;t save it without a passphrase.</span>
+<span class="go">~ You can prepend your key with a from=&quot;IP1,IP2,...&quot; as this bastion policy allows ingress keys &quot;from&quot; override by users</span>
+<span class="go">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyAMtxGT/RvzBZXiYlrCswZMruRtoBtONrVJTZ3Cj5ZpjaZyCRjQ/ETzZXXbvu9KiBsZyhVb/5H9F7CSGi+D5BlcRAKrT9P8MsT7BHWU14GhJddhHDy4rMnXapE93oxbnQIjQT34ozvTKlb0qOoR/SlT14LllvQS6ajaXB7Fm4bAJG/gYGXHEs2nmZn37Rll6vvpZ4ExM29UrqU3hAjYO0Ha+kL5G8Tr+fOhV/5ZmzNsYigdW7Ft7Co4Tpld9D0PqVhDPK7F1zHIFUXunFsewGtB3IQxLdLGDaCMzrRi11V6q/pBzN/75YsW6npRdOzJKjnwxG19lTtVCmCY3EPRFz</span>
+<span class="go">~</span>
+<span class="go">~ You have requested to add a PIV-enabled SSH key.</span>
+<span class="go">~ Please paste the PIV attestation certificate of your hardware key in PEM format.</span>
+<span class="go">~ This snippet should start with &#39;-----BEGIN CERTIFICATE-----&#39; and end with &#39;-----END CERTIFICATE-----&#39;:</span>
+<span class="go">~</span>
+<span class="go">-----BEGIN CERTIFICATE-----</span>
+<span class="go">MIIDIDCCAgigAwIBAgIQAajpKeFbM+X1Yfk8GaH9dzANBgkqhkiG9w0BAQsFADAh</span>
+<span class="go">MR8wHQYDVQQDDBZZdWJpY28gUElWIEF0dGVzdGF0aW9uMCAXDTE2MDMxNDAwMDAw</span>
+<span class="go">MFoYDzIwNTIwNDE3MDAwMDAwWjAlMSMwIQYDVQQDDBpZdWJpS2V5IFBJViBBdHRl</span>
+<span class="go">c3RhdGlvbiA5YTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALIAy3EZ</span>
+<span class="go">P9G/MFleJiWsKzBkyu5G2gG042tUlNncKPlmmNpnIJGND8RPNlddu+70qIGxnKFV</span>
+<span class="go">v/kf0XsJIaL4PkGVxEAqtP0/wyxPsEdZTXgaEl12EcPLisyddqkT3ejFudAiNBPf</span>
+<span class="go">ijO9MqVvSo6hH9KVPXguWW9BLpqNpcHsWbhsAkb+BgZccSzaeZmfftGWXq++lngT</span>
+<span class="go">Ezb1SupTeECNg7Qdr6QvkbxOv586FX/lmbM2xiKB1bsW3sKjhOmV30PQ+pWEM8rs</span>
+<span class="go">XXMcgVRe6cWx7Aa0HchDEt0sYNoIzOtGLXVXqr+kHM3/vlixbqelF07MkqOfDEbX</span>
+<span class="go">2VO1UKYJjcQ9EXMCAwEAAaNOMEwwEQYKKwYBBAGCxAoDAwQDBQIEMBQGCisGAQQB</span>
+<span class="go">gsQKAwcEBgIEALeG1jAQBgorBgEEAYLECgMIBAIDATAPBgorBgEEAYLECgMJBAEB</span>
+<span class="go">MA0GCSqGSIb3DQEBCwUAA4IBAQAq9O6H02KRvSmBYsz23r6cNTNS/fr5lSPYMHz/</span>
+<span class="go">fX+D5B1thKKGstsfZVzoopwIjj86cIWpCYuNfEje+a5HrELL8ClV88JutJR2Nihs</span>
+<span class="go">NxU3BbsSUqnwi2rQHcmtHJcC8rjfDzpYDlW1yR+SxVenbVxuRy0v8sbleHSPYaXG</span>
+<span class="go">EhjupEAuhq7n0TjZMF1X7KElx9FZZM9HeuxUJvzV7XWiUgA4Zm05+4/zKW01n2kt</span>
+<span class="go">+aMaQk7T1oiE0oOK51wJX6J80GzF51pM00oPlh4iDvnnNXYN2KvkNuNwPoceDDE/</span>
+<span class="go">8K23ZfJyTN5nibk13UbxEWSHMUue1zcnFp0KdhqxbJYSS/9q</span>
+<span class="go">-----END CERTIFICATE-----</span>
+<span class="go">~</span>
+<span class="go">~ Thanks, now please paste the PIV key certificate of your generated key in PEM format.</span>
+<span class="go">~ This snippet should also start with &#39;-----BEGIN CERTIFICATE-----&#39; and end with &#39;-----END CERTIFICATE-----&#39;:</span>
+<span class="go">~</span>
+<span class="go">-----BEGIN CERTIFICATE-----</span>
+<span class="go">MIIC5jCCAc6gAwIBAgIJAKT/dqaxohbiMA0GCSqGSIb3DQEBCwUAMCsxKTAnBgNV</span>
+<span class="go">BAMMIFl1YmljbyBQSVYgUm9vdCBDQSBTZXJpYWwgMjYzNzUxMCAXDTE2MDMxNDAw</span>
+<span class="go">MDAwMFoYDzIwNTIwNDE3MDAwMDAwWjAhMR8wHQYDVQQDDBZZdWJpY28gUElWIEF0</span>
+<span class="go">dGVzdGF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwDhP3YUI</span>
+<span class="go">yLWSjseIKNzMscqCdicslrdkxPgMoK8Ocxu0err4yvFXiSZZL32BTZYLD8N7Y+d1</span>
+<span class="go">cww6VVsFYdwn01Kc6YLrwM5FIN/msXkGTPdPVhVeqNMHh4QyYrYixwWaTbDCGoQD</span>
+<span class="go">axVlifVmPS02Mvm8NDjC17X3LhsV1OiS/wOScsI8HHGgQXQIQEDMnt6cwZ83QK73</span>
+<span class="go">7Wuu5uhSzT3jVOz28Rnij1p/8PcVWcGKWCPVYNbCmCdcm/sQeJB8y5aERDaePIIZ</span>
+<span class="go">v9axnDT0DnUO7aDpzXA7i7XPbrkiSBEp7RCqXGs5cBqGCbq//xGh+/AGtCCV/sQM</span>
+<span class="go">nTjl0d2k2Q8XTwIDAQABoxUwEzARBgorBgEEAYLECgMDBAMFAgQwDQYJKoZIhvcN</span>
+<span class="go">AQELBQADggEBAHCnp3k5kQaBwYmR9nUHKGY1dgCvhJUlX2SAyY2fUeaMuURcRRlW</span>
+<span class="go">BFw6CvLAjvSs5Dy3O6JWDmk+1WFZo0UMr15WZFiS5Fpy0M+GWvBCRP3YmbSw+J2t</span>
+<span class="go">kyWypCIIu7cMtLpRYkL5SAlWmUCAz8dZPk5FLPpeqmxgQnRoSSe67IXiv3bNyPA1</span>
+<span class="go">3NoXI2xw0hWQU1+85tfTxoTxOiAzY8UpAT2GggtSmCwO3sHsHJUYXRyCf8e6jtJL</span>
+<span class="go">OFBx/uz+VJoRH7hUVOY+sbP5JJ83dRrWZkS57Hf3q0LOtbn27vM+fmL0y7z4vgDo</span>
+<span class="go">DedmrmsbPtsRc3t7RWoqCa80Iq1jPvdm5gw=</span>
+<span class="go">-----END CERTIFICATE-----</span>
+<span class="go">~</span>
+<span class="go">~ Public key successfully added:</span>
+<span class="go">~ info: ADDED_BY=jdoe USING=selfAddIngressKey UNIQID=2993de2bb014 TIMESTAMP=1609427402 DATETIME=2020-12-31T15:10:02 VERSION=3.01.03</span>
+<span class="go">~ PIV: TouchPolicy=Never, PinPolicy=Always, SerialNo=12345678, Firmware=5.2.4</span>
+<span class="go">~ fingerprint: SHA256:8B0T6174KUPL1iTSyC0UpnDOvuaCgyKpu8zo9rb2lco (RSA-2048) [2020/12/17]</span>
+<span class="go">---------------------------------------------------------&lt;/selfAddIngressKey&gt;---</span>
+</pre></div>
+</div>
+<p>As you can see, we added the public key as usual but were also asked for the two certificates.
+On the bastion answer, right before the fingerprint of the key, we have a line starting with <em>PIV:</em>,
+with some metadata extracted from the certificate.</p>
+</section>
+<section id="per-account-policy">
+<h2><a class="toc-backref" href="#id4">Per-account policy</a><a class="headerlink" href="#per-account-policy" title="Permalink to this headline"></a></h2>
+<p>If you want to force several accounts to only use certified PIV keys, you can set the option per-account
+using the <a class="reference internal" href="../plugins/restricted/accountPIV.html"><span class="doc">accountPIV</span></a> command, see its documentation page for all the possible options.
+The main takeaways are:</p>
+<ul class="simple">
+<li><p>If you want an account to only have PIV keys, set the <code class="docutils literal notranslate"><span class="pre">enforce</span></code> policy for this account</p></li>
+<li><p>If you want an account to never require PIV keys, even if the global policy would require it,
+set the <code class="docutils literal notranslate"><span class="pre">never</span></code> policy (useful for accounts used by automated workflows)</p></li>
+</ul>
+</section>
+<section id="global-policy">
+<h2><a class="toc-backref" href="#id5">Global policy</a><a class="headerlink" href="#global-policy" title="Permalink to this headline"></a></h2>
+<p>If you want to apply a policy bastion-wide, please refer to the <a class="reference internal" href="../administration/configuration/bastion_conf.html#ingressrequirepiv"><span class="std std-ref">ingressRequirePIV</span></a> option.
+This policy can still be overridden per-account if needed, see above.</p>
+</section>
+<section id="temporary-grace-period">
+<h2><a class="toc-backref" href="#id6">Temporary grace period</a><a class="headerlink" href="#temporary-grace-period" title="Permalink to this headline"></a></h2>
+<p>If you enable the PIV policy globally or on several accounts, you'll soon find out that sometimes people forget
+or lose their PIV-enabled hardware tokens, effectively locking them out of the bastion.
+There is a <em>temporary grace period</em> feature you can use to handle such cases nicely:</p>
+<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="hll"><span class="go">bssh --osh accountPIV --account lechuck --policy grace --ttl 48h</span>
+</span><span class="go">---the-bastion.example.org--------------------------------the-bastion-3.01.03---</span>
+<span class="go">=&gt; modify the PIV policy of an account</span>
+<span class="go">--------------------------------------------------------------------------------</span>
+<span class="go">~ Changing account configuration...</span>
+
+<span class="go">~ PIV grace up to 2d+00:00:00 (Wed 2021-01-13 09:22:29 UTC) has been set for this account</span>
+<span class="go">~ Applying change to keys...</span>
+
+<span class="go">~ Non-PIV account&#39;s ingress keys, if any, have been restored</span>
+<span class="go">----------------------------------------------------------------&lt;/accountPIV&gt;---</span>
+</pre></div>
+</div>
+<p>What happens here is that, for a duration of 48 hours, this account will behave as if no PIV policy was enforced:
+non-PIV keys are allowed again. If this account had non-PIV keys before its policy was set to enforce,
+those keys are even restored (can be viewed using <a class="reference internal" href="../plugins/open/selfListIngressKeys.html"><span class="doc">selfListIngressKeys</span></a> as usual),
+so that they can easily connect again. However, after the grace period expires, their policy will go back to
+what it was previously, and all the non-PIV keys will be disabled again.
+This event is logged, so you can easily link this event from your SIEM to a potential ticket to your Helpdesk
+for a hardware key replacement, or such.</p>
+<p>This mechanism allows some flexibility (avoiding sending people back home just because they forgot their hardware key),
+while still enforcing a high-level security policy with the proper processes in place.</p>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="basics/access_management.html" class="btn btn-neutral float-left" title="Access management" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="sftp_scp.html" class="btn btn-neutral float-right" title="SFTP &amp; SCP support" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/sftp_scp.html b/using/sftp_scp.html
new file mode 100644
index 000000000..dfd0bad06
--- /dev/null
+++ b/using/sftp_scp.html
@@ -0,0 +1,250 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>SFTP &amp; SCP support &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+        <script src="../_static/jquery.js"></script>
+        <script src="../_static/underscore.js"></script>
+        <script src="../_static/doctools.js"></script>
+    <script src="../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../genindex.html" />
+    <link rel="search" title="Search" href="../search.html" />
+    <link rel="next" title="HTTPS Proxy" href="http_proxy.html" />
+    <link rel="prev" title="PIV keys support" href="piv.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="piv.html">PIV keys support</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">SFTP &amp; SCP support</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#introduction">Introduction</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#prerequisites">Prerequisites</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#basic-usage">Basic usage</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#access-model">Access model</a><ul>
+<li class="toctree-l3"><a class="reference internal" href="#error-message-1">Error message 1</a></li>
+<li class="toctree-l3"><a class="reference internal" href="#error-message-2">Error message 2</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="api.html">JSON API</a></li>
+<li class="toctree-l1"><a class="reference internal" href="specific_ssh_clients_tutorials/index.html">Specific SSH clients tutorials</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>SFTP &amp; SCP support</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../_sources/using/sftp_scp.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="sftp-scp-support">
+<h1><a class="toc-backref" href="#id1">SFTP &amp; SCP support</a><a class="headerlink" href="#sftp-scp-support" title="Permalink to this headline"></a></h1>
+<div class="contents topic" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="#sftp-scp-support" id="id1">SFTP &amp; SCP support</a></p>
+<ul>
+<li><p><a class="reference internal" href="#introduction" id="id2">Introduction</a></p></li>
+<li><p><a class="reference internal" href="#prerequisites" id="id3">Prerequisites</a></p></li>
+<li><p><a class="reference internal" href="#basic-usage" id="id4">Basic usage</a></p></li>
+<li><p><a class="reference internal" href="#access-model" id="id5">Access model</a></p>
+<ul>
+<li><p><a class="reference internal" href="#error-message-1" id="id6">Error message 1</a></p></li>
+<li><p><a class="reference internal" href="#error-message-2" id="id7">Error message 2</a></p></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+</div>
+<section id="introduction">
+<h2><a class="toc-backref" href="#id2">Introduction</a><a class="headerlink" href="#introduction" title="Permalink to this headline"></a></h2>
+<p>The Bastion's main goal is to secure <code class="docutils literal notranslate"><span class="pre">ssh</span></code> connections. However, one might also want to use <code class="docutils literal notranslate"><span class="pre">sftp</span></code> or <code class="docutils literal notranslate"><span class="pre">scp</span></code> through it.</p>
+<p>Its use is supported through the <a class="reference internal" href="../plugins/open/scp.html"><span class="doc">scp</span></a> and <a class="reference internal" href="../plugins/open/sftp.html"><span class="doc">sftp</span></a> bastion plugins,
+respectively, and documented as part of all the plugins.
+This additional documentation section gives some examples and outlines some common configuration errors.</p>
+</section>
+<section id="prerequisites">
+<h2><a class="toc-backref" href="#id3">Prerequisites</a><a class="headerlink" href="#prerequisites" title="Permalink to this headline"></a></h2>
+<p>The use of SFTP or SCP through the bastion requires an SFTP or SCP program that supports the <strong>-S</strong> option,
+and a shell to run the wrapper. This is the case on all operating systems using OpenSSH such as Linux or *BSD.</p>
+<p>If you're running under Microsoft Windows, you might want to setup either a Linux VM, or a WSL (Windows Subsystem
+for Linux) environment, to have the OpenSSH version of <code class="docutils literal notranslate"><span class="pre">scp</span></code> or <code class="docutils literal notranslate"><span class="pre">sftp</span></code> and a working POSIX-style shell.</p>
+<p>Note that it won't work with Windows GUI apps, because there's no way to specify a wrapper (through <strong>-S</strong>),
+and no shell. For example, it won't work under WinSCP.</p>
+</section>
+<section id="basic-usage">
+<h2><a class="toc-backref" href="#id4">Basic usage</a><a class="headerlink" href="#basic-usage" title="Permalink to this headline"></a></h2>
+<p>Please check the <a class="reference internal" href="../plugins/open/scp.html"><span class="doc">scp</span></a> and <a class="reference internal" href="../plugins/open/sftp.html"><span class="doc">sftp</span></a> documentation to see how to use these.</p>
+</section>
+<section id="access-model">
+<h2><a class="toc-backref" href="#id5">Access model</a><a class="headerlink" href="#access-model" title="Permalink to this headline"></a></h2>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>Currently, to be able to use SFTP or SCP with a remote server,
+you first need to have a declared SSH access to it.
+This might change in a future version.</p>
+</div>
+<section id="error-message-1">
+<h3><a class="toc-backref" href="#id6">Error message 1</a><a class="headerlink" href="#error-message-1" title="Permalink to this headline"></a></h3>
+<p>This is briefly explained in the <a class="reference internal" href="../plugins/open/scp.html"><span class="doc">scp</span></a>/<a class="reference internal" href="../plugins/open/sftp.html"><span class="doc">sftp</span></a> documentation,
+but having access rights to SSH to a machine is not enough to have the right to SCP to or from it, or use SFTP on it.
+If you have the following error, then this is your problem:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Sorry, you seem to have access through ssh and through scp but by different and distinct means <span class="o">(</span>distinct keys<span class="o">)</span>.
+The intersection between your rights <span class="k">for</span> ssh and <span class="k">for</span> scp needs to be at least one.
+</pre></div>
+</div>
+<p>When this happens, it means that you have at least one declared SSH access to this machine (through one or
+several groups, or through personal accesses). You also have at least one declared SCP/SFTP access to it.
+However <strong>both accesses are declared through different means</strong>, and more precisely different SSH keys. For example:</p>
+<ul class="simple">
+<li><p>You are a member of a group having this machine on one hand, and you have a declared SCP/SFTP access to this machine
+using a personal access on the other hand. For SSH, the group key would be used, but for SCP/SFTP, your personal key
+would be used. However, for technical reasons (that might be lifted in a future version), your SSH and SCP/SFTP access
+must be declared with the same key, so in other words, using the same access mean (same group, or personal access).</p></li>
+<li><p>You are a member of group <strong>A</strong> having this machine, but SCP/SFTP access is declared in group <strong>B</strong>.
+In that case, as previously, as two different keys are used, this won't work.</p></li>
+</ul>
+<p>To declare an SCP or SFTP access, in addition to a preexisting SSH access, you should use either:</p>
+<ul class="simple">
+<li><p><a class="reference internal" href="../plugins/group-aclkeeper/groupAddServer.html"><span class="doc">groupAddServer</span></a>, if the SSH access is part of a group</p></li>
+<li><p><a class="reference internal" href="../plugins/restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a> or <a class="reference internal" href="../plugins/restricted/accountAddPersonalAccess.html"><span class="doc">accountAddPersonalAccess</span></a>,
+if the SSH access is personal (tied to an account)</p></li>
+</ul>
+<p>In both cases, where you would use the <code class="docutils literal notranslate"><span class="pre">--user</span></code> option to the command, to specify the remote user to use for
+the SSH access being declared, you should replace it by either <code class="docutils literal notranslate"><span class="pre">--scpdown</span></code>, <code class="docutils literal notranslate"><span class="pre">--scpup</span></code> or <code class="docutils literal notranslate"><span class="pre">--sftp</span></code>,
+to specify that you're about to add an SCP or SFTP access (not an SSH one), and which direction you want to allow.
+For SCP ,you can allow both directions by using the command first with <code class="docutils literal notranslate"><span class="pre">--scpdown</span></code>, then with <code class="docutils literal notranslate"><span class="pre">--scpup</span></code>.
+Note that for SFTP, you can't specify a direction, due to how the protocol works: you either have SFTP access (hence
+being able to upload and download files), or you don't.</p>
+<p>For example, this is a valid command to add SFTP access to a machine which is part of a group:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>bssh --osh groupAddServer --group mygroup --host scpserver.example.org --port <span class="m">22</span> --sftp
+</pre></div>
+</div>
+</section>
+<section id="error-message-2">
+<h3><a class="toc-backref" href="#id7">Error message 2</a><a class="headerlink" href="#error-message-2" title="Permalink to this headline"></a></h3>
+<p>If you have the following message:</p>
+<div class="highlight-shell notranslate"><div class="highlight"><pre><span></span>Sorry, but you don&#39;t seem to have access to HOST:IP
+</pre></div>
+</div>
+<p>Then it means that you don't even have SSH access to this machine. In that case, somebody should grant you access,
+either by adding you to a group having this machine (<a class="reference internal" href="../plugins/group-gatekeeper/groupAddMember.html"><span class="doc">groupAddMember</span></a>) or by adding
+this machine to your personal accesses (<a class="reference internal" href="../plugins/restricted/accountAddPersonalAccess.html"><span class="doc">accountAddPersonalAccess</span></a> or
+<a class="reference internal" href="../plugins/restricted/selfAddPersonalAccess.html"><span class="doc">selfAddPersonalAccess</span></a>).</p>
+</section>
+</section>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="piv.html" class="btn btn-neutral float-left" title="PIV keys support" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="http_proxy.html" class="btn btn-neutral float-right" title="HTTPS Proxy" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/specific_ssh_clients_tutorials/index.html b/using/specific_ssh_clients_tutorials/index.html
new file mode 100644
index 000000000..1d6ec673a
--- /dev/null
+++ b/using/specific_ssh_clients_tutorials/index.html
@@ -0,0 +1,156 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Specific SSH clients tutorials &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="Using PuTTY with The Bastion" href="putty.html" />
+    <link rel="prev" title="JSON API" href="../api.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../api.html">JSON API</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Specific SSH clients tutorials</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="putty.html">Using PuTTY with The Bastion</a></li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+      <li>Specific SSH clients tutorials</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/using/specific_ssh_clients_tutorials/index.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="specific-ssh-clients-tutorials">
+<h1>Specific SSH clients tutorials<a class="headerlink" href="#specific-ssh-clients-tutorials" title="Permalink to this headline"></a></h1>
+<p>This section has a few howtos about using The Bastion with some specific SSH clients,
+mostly ones having a GUI, as the rest of the documentation assumes usage of the
+more widespread SSH CLI.</p>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="putty.html">Using PuTTY with The Bastion</a></li>
+</ul>
+</div>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="../api.html" class="btn btn-neutral float-left" title="JSON API" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="putty.html" class="btn btn-neutral float-right" title="Using PuTTY with The Bastion" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file
diff --git a/using/specific_ssh_clients_tutorials/putty.html b/using/specific_ssh_clients_tutorials/putty.html
new file mode 100644
index 000000000..b6e0a7014
--- /dev/null
+++ b/using/specific_ssh_clients_tutorials/putty.html
@@ -0,0 +1,189 @@
+<!DOCTYPE html>
+<html class="writer-html5" lang="en" >
+<head>
+  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Using PuTTY with The Bastion &mdash; The Bastion 3.16.01 documentation</title>
+      <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+      <link rel="stylesheet" href="../../_static/css/thebastion.css" type="text/css" />
+  
+        <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
+        <script src="../../_static/jquery.js"></script>
+        <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/doctools.js"></script>
+    <script src="../../_static/js/theme.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" />
+    <link rel="next" title="Configuration files" href="../../administration/configuration/index.html" />
+    <link rel="prev" title="Specific SSH clients tutorials" href="index.html" /> 
+</head>
+
+<body class="wy-body-for-nav"> 
+  <div class="wy-grid-for-nav">
+    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
+      <div class="wy-side-scroll">
+        <div class="wy-side-nav-search" >
+            <a href="../../index.html" class="icon icon-home"> The Bastion
+          </a>
+              <div class="version">
+                3.16.01
+              </div>
+<div role="search">
+  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
+    <input type="text" name="q" placeholder="Search docs" />
+    <input type="hidden" name="check_keywords" value="yes" />
+    <input type="hidden" name="area" value="default" />
+  </form>
+</div>
+        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
+              <p class="caption" role="heading"><span class="caption-text">Presentation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/principles.html">Principles</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/features.html">Features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../presentation/security.html">Security</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../faq.html">FAQ</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/basic.html">Basic Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/advanced.html">Advanced Installation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/upgrading.html">Upgrading</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/docker.html">Sandbox using Docker</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../installation/restoring_from_backup.html">Restoring from backup</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Usage</span></p>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../basics/index.html">The basics</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../piv.html">PIV keys support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../sftp_scp.html">SFTP &amp; SCP support</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../http_proxy.html">HTTPS Proxy</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../api.html">JSON API</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="index.html">Specific SSH clients tutorials</a><ul class="current">
+<li class="toctree-l2 current"><a class="current reference internal" href="#">Using PuTTY with The Bastion</a></li>
+</ul>
+</li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Administration</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/configuration/index.html">Configuration files</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/logs.html">Logs</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/mfa.html">Multi-Factor Authentication</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../administration/security_advisories.html">Security Advisories</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Development</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../development/setup.html">Environment setup</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../development/tests.html">Writing tests</a></li>
+</ul>
+<p class="caption" role="heading"><span class="caption-text">Plugins</span></p>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/admin/index.html">admin plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-aclkeeper/index.html">group-aclkeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-gatekeeper/index.html">group-gatekeeper plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/group-owner/index.html">group-owner plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/open/index.html">open plugins</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../plugins/restricted/index.html">restricted plugins</a></li>
+</ul>
+
+        </div>
+      </div>
+    </nav>
+
+    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
+          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
+          <a href="../../index.html">The Bastion</a>
+      </nav>
+
+      <div class="wy-nav-content">
+        <div class="rst-content">
+          <div role="navigation" aria-label="Page navigation">
+  <ul class="wy-breadcrumbs">
+      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
+          <li><a href="index.html">Specific SSH clients tutorials</a> &raquo;</li>
+      <li>Using PuTTY with The Bastion</li>
+      <li class="wy-breadcrumbs-aside">
+            <a href="../../_sources/using/specific_ssh_clients_tutorials/putty.rst.txt" rel="nofollow"> View page source</a>
+      </li>
+  </ul>
+  <hr/>
+</div>
+          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
+           <div itemprop="articleBody">
+             
+  <section id="using-putty-with-the-bastion">
+<h1>Using PuTTY with The Bastion<a class="headerlink" href="#using-putty-with-the-bastion" title="Permalink to this headline"></a></h1>
+<p>First, you'll need to generate a pair of SSH keys. To this end, use the <code class="docutils literal notranslate"><span class="pre">PuTTY</span></code> companion tool: <code class="docutils literal notranslate"><span class="pre">PuTTYgen</span></code>.</p>
+<p>Before hitting <em>Generate</em> to generate a new key pair, ensure that EdDSA is selected, with the Ed25519 curve.
+You'll have to move your mouse a bit to feed the pseudo-random number generator.</p>
+<img alt="Main window of PuTTYgen" src="../../_images/putty1.png" />
+<p>Once the key has been generated, you'll have to input a passphrase that will protect your key.
+Ensure this passphrase is sufficiently hard to guess, but ensure you'll not forget it!
+Once you've entered your passphrase twice, it should look like this:</p>
+<img alt="Main window of PuTTYgen once a key has been generated" src="../../_images/putty2.png" />
+<p>You can now hit <em>Save private key</em> and choose a file name.
+Also save the corresponding public key next to it by hitting <em>Save public key</em>,
+but don't close <code class="docutils literal notranslate"><span class="pre">PuTTYgen</span></code> yet.</p>
+<p>The public key you've just saved, which is also displayed at the top of the <code class="docutils literal notranslate"><span class="pre">PuTTYgen</span></code> window,
+starting by <code class="docutils literal notranslate"><span class="pre">ssd-ed25519</span> <span class="pre">AAAA...</span></code> is the public key you'll need to give to The Bastion when
+creating your account there, so you can copy/paste it when The Bastion asks you for a key:</p>
+<img alt="Creating an account on The Bastion" src="../../_images/putty3.png" />
+<p>Now, you can close <code class="docutils literal notranslate"><span class="pre">PuTTYgen</span></code> (as you've saved the private and public keys in their respective
+files, you'll be able to use them later), and open <code class="docutils literal notranslate"><span class="pre">PuTTY</span></code> itself:</p>
+<img alt="Main window of PuTTY" src="../../_images/putty4.png" />
+<p>To create the proper connection settings, set your bastion host name (or IP) and port in the
+window above, and leave the connection type to SSH.</p>
+<p>Then, navigate to <em>Connection &gt; SSH &gt; Auth &gt; Credentials</em>, and use <em>Browse...</em> to set the
+location of the private key you've generated with <code class="docutils literal notranslate"><span class="pre">PuTTYgen</span></code>. Ensure you use the private
+key, not the public key: the private key usually ends in <code class="file docutils literal notranslate"><span class="pre">.ppk</span></code>, as shown below:</p>
+<img alt="Credentials options section of PuTTY window" src="../../_images/putty5.png" />
+<p>Then, navigate back to <em>Session</em>, and save the session settings under any name you wish,
+so that the next time you open <code class="docutils literal notranslate"><span class="pre">PuTTY</span></code>, you'll be able to load these settings back:</p>
+<img alt="Saving the settings in PuTTY" src="../../_images/putty6.png" />
+<p>Then, you can click <em>Open</em> to establish the connection. On the first connection attempt, you'll
+be prompted with this dialog box:</p>
+<img alt="Unknown hostkey dialog box" src="../../_images/putty7.png" />
+<p>This is because <code class="docutils literal notranslate"><span class="pre">PuTTY</span></code> never connected to the bastion before, and asks you to verify the
+bastion's host public key. This is expected on the first connection, so you can click <em>Accept</em>.</p>
+<p>You'll then be prompted for your login, which is the account name you've created on the bastion,
+associated with your public key:</p>
+<img alt="Waiting for the user login" src="../../_images/putty8.png" />
+<p>You'll then need to type the passphrase protecting your private key, so <code class="docutils literal notranslate"><span class="pre">PuTTY</span></code> can use it:</p>
+<img alt="Waiting for the private key passphrase" src="../../_images/putty9.png" />
+<p>Once done, the bastion should authenticate you, and drop you in interactive mode:</p>
+<img alt="" src="../../_images/putty10.png" />
+<p>You can now use The Bastion!</p>
+</section>
+
+
+           </div>
+          </div>
+          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
+        <a href="index.html" class="btn btn-neutral float-left" title="Specific SSH clients tutorials" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
+        <a href="../../administration/configuration/index.html" class="btn btn-neutral float-right" title="Configuration files" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
+    </div>
+
+  <hr/>
+
+  <div role="contentinfo">
+    <p>&#169; Copyright 2024, OVHcloud.</p>
+  </div>
+
+  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
+    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
+    provided by <a href="https://readthedocs.org">Read the Docs</a>.
+   
+
+</footer>
+        </div>
+      </div>
+    </section>
+  </div>
+  <script>
+      jQuery(function () {
+          SphinxRtdTheme.Navigation.enable(true);
+      });
+  </script> 
+
+</body>
+</html>
\ No newline at end of file