Provided by: xpra_3.1.5+dfsg1-0.2ubuntu1_amd64 bug

NAME

       xpra - viewer for remote, persistent X applications

SYNOPSIS

       xpra start [CONNECTIONSTRING] | xpra start-desktop [CONNECTIONSTRING] [OPTIONS..]
       xpra attach [CONNECTIONSTRING] [OPTIONS..]
       xpra shadow [CONNECTIONSTRING] [OPTIONS..]
       xpra proxy [:DISPLAY] [OPTIONS..]
       xpra  stop  |  xpra  exit  |  xpra  detach  |  xpra  screenshot  filename  |  xpra  version  |  xpra info
            [CONNECTIONSTRING] | xpra top [CONNECTIONSTRING] [OPTIONS..]
       xpra control [CONNECTIONSTRING] command [arguments..]  [--ssh=CMD] [--remote-xpra=CMD] [--socket-dir=DIR]
            [--socket-dirs=DIRS]
       xpra initenv [--socket-dir=DIR]
       xpra list [--socket-dir=DIR]
       xpra list-windows [--socket-dir=DIR]
       xpra showconfig [OPTIONS..]
       xpra showsetting [SETTING1..]
       xpra list-mdns
       xpra upgrade [:DISPLAY] [...any options accepted by xpra start...]
       xpra upgrade-desktop [:DISPLAY] [...any options accepted by xpra start-desktop...]

DESCRIPTION

       Xpra  is  a  tool  which  allows you to run X programs — usually on a remote host — and then direct their
       display to your local machine, disconnect from these programs, and reconnect from  the  same  or  another
       machine,  all  without  losing  any  state.   It  differs  from  standard  X forwarding in that it allows
       disconnection and reconnection without disrupting the forwarded application;  it  differs  from  VNC  and
       similar  remote  display technologies in that xpra can run rootless: i.e., applications forwarded by xpra
       appear on your desktop as normal windows managed by your window manager, rather than being  all  "trapped
       in  a  box  together".   Xpra  also  uses  a  custom protocol that is self-tuning and relatively latency-
       insensitive, and thus is usable over network connections that are too slow or unreliable for  standard  X
       forwarding.  Xpra can also be used to shadow an existing X11 display, or in desktop mode where it behaves
       more like VNC.

       By default the Xpra server announces available sessions (username and display number)  via  mDNS  to  the
       local network. Use mdns=no to disable it.

CONNECTION STRINGS

       Xpra supports many types of connection strings (some may require extra packages to be installed):

   :DISPLAY
       Local displays: this is the simplest form and is only valid for the current local displays of the current
       user.

   tcp://[USERNAME@]HOST:PORT[/DISPLAY]
       TCP mode uses port numbers and not display numbers. If multiple displays are available through  a  single
       TCP port (ie: using a proxy server), then one can also specify the display number.

   ssl://[USERNAME@]HOST:PORT[/DISPLAY]
       SSL adds a secure socket layer on top of the TCP mode.

   vsock://[USERNAME[:PASSWORD]@]HOST:PORT
       Almost identical to the TCP mode, but using AF_VSOCK for transport.

   ws://[USERNAME[:PASSWORD]@]HOST:PORT/[DISPLAY]
       Connect using websocket protocol.

   wss://[USERNAME[:PASSWORD]@]HOST:PORT/[DISPLAY]
       Connect using secure websocket protocol. (websocket with SSL)

   ssh://[USERNAME[:PASSWORD]@]HOST[:SSH_PORT]/[DISPLAY][?QUERYSTRING]
       Connect using secure shell. (SSH)

       Further  options  can  be  specified using the --ssh command line option.  The QUERYSTRING can be used to
       specify an ssh proxy: ?proxy=ssh://[USERNAME[:PASSWORD]@]HOST[:SSH_PORT] xpra will then establish an  SSH
       connection  to  the  specified "proxy" host, and from that host xpra will set up an SSH connection to the
       xpra server.

       For backwards compatibility, SSH mode also supports  the  syntax:  ssh:[USERNAME[:PASSWORD]@]HOST:DISPLAY
       but  this  form  does  not  support  specifying  the  SSH port number.  Older versions also used the form
       protocol:host:port, but users are encouraged to  move  to  a  more  standard  URI  format  using  ://  as
       separator.

       The  password  need  only be specified when the server authentication module requires it. (ie: often when
       authenticating against MS Windows servers, or with multifile and sqlite authentication modules)

EXAMPLES

       xpra start :7
            Start an xpra server using display number :7.  Note: using DISPLAY=:7 xterm  to  start  applications
            against  a  specific  display  is  not recommended. Always prefer using xpra's --start= command line
            option instead.  See this next example:

       xpra start --start=firefox
            Start an xpra server, choosing a display automatically and start firefox on  that  virtual  display.
            No  window  will appear until you attach with xpra attach.  The start child commands will inherit an
            environment tailored for running under xpra.

       xpra start ssh://bigbox/7 --start=xterm
            Start an xpra server on bigbox with an xterm in it, and connect to it.

       xpra start-desktop --start=xfce4-session
            Start an xfce session in a nested X11 server on an automatically assigned display number.

       xpra list
            Show a list of xpra servers you have running on the current host.

       xpra list-windows
            Show a list of xpra servers you have running on the current host, including the session name  and  a
            list of windows.  (only if the session can be queried using xpra info)

       xpra list-mdns
            Show a list of xpra servers found via mDNS. (local network)

       xpra showconfig
            Shows  the configuration that would be used with other sub-commands, taking into account the command
            line arguments.

       xpra showsetting [SETTING1..]
            Shows the value of a specific configuration setting  and  which  configuration  directory  set  this
            value.

       xpra attach :7
            Attach  to  the  xpra server that is using local display number :7.  Any apps running on that server
            will appear on your screen.

       xpra attach ssh://foo@frodo/7
            Use ssh to attach to the xpra server that is running on machine frodo as user foo and using  display
            :7.  Any apps running on that server will appear on your local screen.

       xpra start :7 --start=screen
            Start  an  xpra server and a screen(1) session.  If any of the applications inside screen attempt to
            use X, they will be directed to the xpra server.

DISPLAYS

       Understanding the basic idea of displays is critical to using xpra successfully.

       The idea comes from standard X.  If you have multiple X servers running on the same host, then there  has
       to  be some way to distinguish them.  X does this by assigning each server a small, unique integer called
       (perhaps confusingly) its "display".  In the common case of a desktop machine that has only one X  server
       running,  that  server uses display ":0" (or sometimes you'll see ":0.0", which is effectively the same).
       When an application starts under X, it needs to know how to find the right X server to use; it does  this
       by checking the environment variable $DISPLAY.

       Xpra  faces  a  similar problem — there may be multiple xpra servers running on the same host, as well as
       multiple X servers.  It solves this problem by re-using X's solution — each xpra  server  has  a  display
       associated  with  it.   This  display  functions  as  both  an  X  display (for when xpra is talking to X
       applications) and as an identifier by which xpra clients (like xpra attach) can locate the xpra server.

       You may omit the display number when using xpra start: a display will be chosen  for  you  automatically.
       The  display  number  chosen will be shown in the log output, you should also be able to see it with xpra
       list.  On Microsoft Windows and Mac OSX, the display number should be omitted.

       Otherwise, when starting an xpra server, you may want to specify the name of the display to use.   To  do
       this,  simply pick any number you like and stick a colon in front of it.  For instance :7, :12, and :3117
       are all valid display names.  Just keep in mind that:

       •      Every X or xpra server that is running on a single machine must use a different display name.   If
              you pick a number that is already in use then xpra will not work.

       •      The first few numbers (0, 1, 2) are commonly used by real X servers.

       •      Everyone  who  connects  to a given machine using ssh(1) with X forwarding enabled will also use a
              display number; ssh generally picks numbers near ten (10, 11, 12, ...).

       When specifying an xpra server to a client program like xpra attach, xpra detach, xpra stop,  xpra  exit,
       xpra  version, xpra info, xpra list or xpra screenshot then you can use a display of the form :DISPLAY to
       refer to a server on the local host, or one of the form ssh://[USER@]HOST/DISPLAY to refer to a server on
       a  remote  host; xpra will automatically connect to the remote host using ssh(1).  Generally, if you have
       only one xpra session running on a machine (which you can verify by running xpra list on  that  machine),
       then  you  can  omit  the  number  entirely; xpra attach alone will attach to the lone xpra server on the
       current machine regardless of its number, xpra attach ssh://frodo will similarly attach to the lone  xpra
       session on a remote machine.

       Connecting  using  the  display  number assumes that the client and server use the same configuration for
       socket directories, or at least that the client can find at least one of the directories used by the unix
       domain sockets (see bind, socket-dir and socket-dirs).

       If  the xpra server was given the --bind-tcp, --bind-ssl --bind-udp=[HOST]:PORT, --bind-ws, --bind-wss or
       --bind-vsock option when started  then  you  can  also  connect  to  it  using  a  display  of  the  form
       tcp://HOST:PORT[/DISPLAY],              udp://HOST:PORT[/DISPLAY],             ssl://HOST:PORT[/DISPLAY],
       ws://HOST:PORT[/DISPLAY], wss://HOST:PORT[/DISPLAY] or vsock://HOST:PORT[/DISPLAY].

SUBCOMMANDS

   xpra start
       This command starts a new xpra server, including any necessary setup.  (When  starting  a  remote  server
       with the ssh://HOST/DISPLAY syntax, the new session will also be attached.)

   xpra start-desktop
       Starts a nested X11 server, all child commands will be started in the nested X11 server.

   xpra attach
       This command attaches to a running xpra server, and forwards any applications using that server to appear
       on your current screen.

   xpra detach
       Detaches the given xpra display.

   xpra screenshot
       Takes a screenshot and saves it to the filename specified.  Note: screenshots can only be  taken  when  a
       client is attached.

   xpra version
       Queries the server version and prints it out.  Note: older servers may not support this feature.

   xpra info
       Queries the server for version, status and statistics.

   xpra top
       Shows the server's key health attributes.

   xpra control
       Modify  the  server  at  runtime by issuing commands.  The list of commands can be obtained by specifying
       "help" as command.  Some of those commands may support a "help" mode themselves.

   xpra initenv
       This internal command creates the run-xpra script used with ssh connections.

   xpra stop
       This command attaches to a running xpra server,  and  requests  that  it  terminates  immediately.   This
       generally causes any applications using that server to terminate as well.

   xpra exit
       This command attaches to a running xpra server, and requests that it terminates immediately.  Unlike xpra
       stop, the Xvfb process and its X11 clients (if any) will be left running.

   xpra showconfig
       This commands shows the configuration which would be used given the arguments  provided.   You  can  also
       specify as extra arguments the specific options that should be displayed, or use the special value all to
       display all the options including the ones which are normally not displayed because they are not relevant
       on the given system.

   xpra list
       This  command  finds  all xpra servers that have been started by the current user on the current machine,
       and lists them.

   xpra upgrade
       This command starts a new xpra server, but instead of creating it from scratch, it  attaches  to  another
       existing  server, tells it to exit, and takes over managing the applications that it was managing before.
       As the name suggests, the main use case is to replace a server running against an older version  of  xpra
       with  a newer version, without having to restart your session.  Any currently-running xpra attach command
       will exit and need to be restarted.

   xpra upgrade-desktop
       Same as upgrade but for servers started using start-desktop.  It is possible to upgrade  seamless  server
       into a desktop server and vice versa.

   xpra shadow
       This  command  shadows an existing X11 display. If there is only one X11 display active and its number is
       below 10, it can be auto-detected.

       Note that this mode of operation uses screenscraping which is far less efficient. Using a  video  encoder
       (h264 or vp8) is highly recommended for this mode of operation.

   xpra proxy
       This  command  allows  a single server to proxy connections for multiple others, potentially serving as a
       load balancing or authentication entry point for many sessions.   The  proxy  server  will  spawn  a  new
       process  for  each  proxy  connection,  this proxy process will create an unauthenticated new unix domain
       socket which can be used with the subcommands info, version and stop.

   Important Note
       Some platforms and package managers may choose to only build the client and not the server. In this case,
       only the attach subcommand will be available.

OPTIONS

   General options
       --version
              Displays xpra's version number.

       -h, --help
              Displays a summary of command line usage.

       -d FILTER1,FILTER2,..., --debug=FILTER1,FILTER2,...
              Enable debug logging.  The special value all enables all debugging.

       --mmap=yes|no|ABSOLUTEFILENAME
              Enable  or  disable  memory  mapped  pixel  data  transfer.   By  default  it  is normally enabled
              automatically if the server and the client reside on the same filesystem namespace.   This  method
              of  data  transfer  offers much lower overheads and reduces both CPU consumption and local network
              traffic.  When attaching, you can also specify an absolute  path  where  the  mmap  file  will  be
              created.

       --mmap-group=GROUP
              Sets  the  mmap  file's  gid  to  the  group  specified, and sets the permissions to 660.  This is
              necessary to share the mmap file across user accounts.  You can also use the special GROUP values:

              no     Disable the functionality, the mmap file will use the default file permissions and  default
                     group ownership.

              SOCKET The  group  used  will  be  the same one as found on the unix domain socket file the client
                     connects to.  Obviously, this can only work when connecting to unix domain sockets.

              auto   Will use the 'xpra' group if the user is a member, otherwise it will fallback to  the  same
                     behaviour as SOCKET.

       --windows=yes|no
              Enable  or  disable the forwarding of windows. This is usually the primary use for xpra and should
              be enabled.

       --min-size=WIDTHxHEIGHT
              Sets the minimum size for all decorated windows.

       --max-size=WIDTHxHEIGHT
              Sets the maximum size for all windows.

       --readonly=yes|no
              Read only mode ignores all keyboard and mouse activity.

       --clipboard=yes|no|clipboard-type
              Enable or disable clipboard synchronization.  If disabled on the server, no clients will  be  able
              to  use  clipboard  synchronization  at  all.  If  turned  off on the client, only this particular
              connection will ignore clipboard data from the server.   This  can  also  be  used  to  specify  a
              different  clipboard  implementation.   The  clipboard  types available will vary from platform to
              platform and also depend on build time environment and options so  this  is  best  left  on  auto.
              Other clipboard types available may include:

              translated
                     Clipboard which can translate from one type of selection to another

              GDK    The most complete clipboard implementation, includes full X11 support

              default
                     Fallback clipboard, with limited X11 support

              OSX    OSX specific clipboard

       --clipboard-direction=to-server|to-client|both|disabled
              Choose the direction of the clipboard synchronization.

       --pulseaudio=yes|no
              Enable or disable the starting of a pulseaudio server with the session.

       --pulseaudio-command=SERVER-START-COMMAND
              Specifies  the  pulseaudio  command  to  use  to start the pulseaudio server, unless disabled with
              pulseaudio=no.

       --session-name=VALUE
              Sets the name of this session. This value may be used in notifications, utilities, tray menu, etc.
              Setting this value on the server provides a default value which may be overridden on the client.

       --encoding=ENCODING
              This  specifies  the  image encoding to use, there are a number of encodings supported: jpeg, png,
              png/P, png/L, webp, rgb, vp8, vp9, h264 and h265 (some may not be available in your  environment).
              The default option is auto which allows the server to select the best encoding automatically.

              auto   default mode: the built-in heuristics will choose the most appropriate encoding

              png    compressed and lossless, can be quite slow.

              png/P  compressed  and  lossy:  it uses a colour palette, which means better compression but still
                     slow.

              png/L  compressed and lossy: grayscale only using a palette.

              rgb    a raw pixel format (lossless) compressed with  lz4,  lzo  or  zlib  (see  compressors)  the
                     compression ratio is lower, but it is by far the fastest encoding available.

              webp   can  be  used  in  lossy or lossless mode, useful for graphical applications, it compresses
                     better than jpeg and is reasonably fast except at high resolutions.

              jpeg   can be useful for graphical applications, it is lossy and usually very fast.

              vp8    lossy video encoding which always uses colour subsampling.  Fast at encoding and decoding.

              vp9    Video encoding which supports both lossy and  lossless  modes,  available  if  your  ffmpeg
                     library version is recent enough.

              h264   One  of  the best encoding available: it is fast, efficient and tunable via the quality and
                     speed options.

              h265   Far too slow at encoding, avoid.

       The default encoding which is automatically selected if you do  not  specify  one  will  depend  on  what
       options  are available on both the server and the client: rgb is always available (builtin), jpeg and png
       require the Python Imaging Library, vp8, vp9, webp, h264 and h265 all  require  their  respective  shared
       libraries, as well as the xpra codec that uses them.

       Note:  when  selecting a video encoding (usually h264, vp8 or vp9), it will only be used if the screen is
       updating quickly enough, some of the smaller screen updates will also be sent using one of the other non-
       video encodings.

       --video-scaling=on|off|SCALING
              How  much  automatic video downscaling should be used, from 1 (rarely) to 100 (aggressively), 0 to
              disable.  Video scaling is normally used with video regions or very large windows (especially full
              screen  windows)  to  try  to  maintain  a decent framerate.  Video downscaling negatively affects
              visual quality and will cause automatic refreshes (if enabled), it is most useful on video content
              where it saves a considerable amount of bandwidth.

       --socket-dir=DIR
              Location  where  to  write  and  look for the Xpra socket files.  The default location varies from
              platform to platform ("~/.xpra" on most Posix systems).  If  unspecified,  the  first  value  from
              socket-dirs  will  be  used.   It  may  also  be  specified  using the XPRA_SOCKET_DIR environment
              variable.

              When using the socket-dir option, it is generally necessary to specify socket-dir  or  socket-dirs
              on all following commands, for xpra to work with the open sessions.

              By  specifying  a  shared directory this can be coupled with the mmap-group and socket-permissions
              option to connect Xpra sessions across user accounts with shared memory acceleration.

       --socket-dirs=DIR
              Specifies the directories where to look for existing sockets if a specific one was not  set  using
              socket-dir.   You  may  specify each directory using a new --socket-dirs command line argument, or
              joined together by the path separator (: on Posix).  The paths will be expanded.   (ie:  --socket-
              dirs=~/.xpra:/tmp)

       --file-transfer=on|off
              Enable file transfers.

       --open-files=on|off
              This  option  may be used to allow the remote end to automatically open files after they have been
              uploaded.  This may be a security risk if you are using xpra to constrain  what  the  clients  can
              execute on the server.

       --forward-xdg-open=on|off
              Intercept execution of xdg-open and forward the request to the client.

       --open-command=COMMAND
              The command to use for opening files and URLs.

       --bandwidth-limit=BITSPERSECOND
              Restrict  bandwidth  usage to below the limit given.  The client's value cannot raise the limit of
              the server.  The value may be specified using standard units, ie: 1Mbps or 500K.   In  auto  mode,
              the client will set the bandwidth limit value to 80% of the maximum speed of the network interface
              it is using to connect to the server.

   Options for start, start-desktop, upgrade, proxy and shadow
       --daemon=yes|no
              By default, the xpra server puts itself into the background, i.e. 'daemonizes', and redirects  its
              output to a log file.  This can be used to prevent that behavior (useful mostly for debugging).

       --resize-display=yes|no
              Resize  the  virtual display to match the resolution of the client currently connected.  This only
              applies to the start and start-desktop subcommands.

       --fake-xinerama=PATH|auto|no
              Specify the path to the libfakeXinerama.so library which will  be  injected  into  all  the  child
              processes  the  server  starts  using  LD_PRELOAD.   This can also be disabled or set to auto: the
              server will then try to locate the library itself.  This only applies to the start subcommand.

       --chdir=DIR
              Change to this directory after daemonizing.

       --uid=UID and --gid=GID
              When launching the server as root, these options can be used to drop privileges to the given UID /
              GID.

       --pidfile=FILENAME
              Writes  the server process ID to this file on startup.  If the file has not been replaced, it will
              be deleted when the server exits.

       --bind=BIND_LOCATION
              Create a local Unix domain socket (on Unix) or named-pipe (on MS Windows)  for  each  bind  option
              specified.

              This  option  can be specified multiple times to specify multiple socket locations.  These sockets
              support local connections with the :7-style display  address,  and  remote  connections  with  the
              ssh://frodo/7-style display address.

              Local sockets may also process HTTP / Websocket connections if the html switch is enabled.

              The location can take the form:

              none   do not create a socket

              auto   backwards compatible default which uses the current socket-dir

              DIRECTORY/
                     create a socket in the directory specified, if the directory does not exist then it will be
                     created - you should include the trailing slash to prevent  the  confusion  with  the  PATH
                     form:

              PATH   create the socket using the path specified

       --bind-tcp=[HOST]:PORT
              Create  a  TCP  socket for each --bind-tcp option specified.  If the host portion is omitted, then
              127.0.0.1 (localhost) will be used.  If you wish to accept connections  on  all  interfaces,  pass
              0.0.0.0 for the host portion.

              Using  this  switch  without using the tcp-auth option is not recommended, and is a major security
              risk (especially when passing 0.0.0.0)!  Anyone at all may connect to this port  and  access  your
              session.

              TCP  sockets  may  also  process  HTTP / Websocket connections if the html switch is enabled.  TCP
              sockets may also be upgraded to SSL sockets if the ssl switch is enabled.

       --bind-udp=[HOST]:PORT
              Create a UDP socket for each --bind-udp option specified.  If the host portion  is  omitted,  then
              127.0.0.1  (localhost)  will  be  used.  If you wish to accept connections on all interfaces, pass
              0.0.0.0 for the host portion.

              Using this switch without using the udp-auth option is not recommended, and is  a  major  security
              risk  (especially  when  passing 0.0.0.0)!  Anyone at all may connect to this port and access your
              session.  UDP sessions are trivial to hijack for anyone able to sniff even just a  single  packet,
              it should only be used in very specific use-cases, and never over unsecured networks.

       --bind-ws=[HOST]:PORT
              Create an HTTP / Websocket listener.  See bind-tcp for host restrictions, you should use the auth-
              ws to secure access.

       --bind-wss=[HOST]:PORT
              Create an HTTPS / Secure Websocket listener.  See bind-tcp for host restrictions, you  should  use
              the auth-wss to secure access.

       --bind-ssl=[HOST]:PORT
              Just like --bind-tcp but for SSL sockets.  See ssl-auth and the other SSL options.

       --bind-rfb=[HOST]:PORT
              Listens  for  RFB connections on the given port.  These sockets are only supported with the start-
              desktop and shadow modes.

       --bind-vsock=CID:PORT
              Create a VSOCK socket for each --bind-vsock option specified.

       --auth=MODULE[:OPTION=VALUE]
              Specifies the authentication module to use for unix domain sockets created using the bind  switch.
              Authentication modules can validate a username and password against a variety of backend modules:

              allow  always allows authentication - this is dangerous and should only be used for testing

              fail   always fails authentication, useful for testing

              env    matches  against  the  environment variable specified by the name option (which defaults to
                     XPRA_PASSWORD).  ie: --auth=env:name=SOME_OTHER_ENV_VAR_NAME.

              password
                     matches   against   the   password    specified    using    the    value    option.     ie:
                     --auth=password:value=YOURPASSWORD.  Note: this command line option may be exposed to other
                     processes on the same system.

              file   checks the password against the password  data  found  in  the  file  specified  using  the
                     filename option.  ie: --auth=file:filename=./password.txt.

                     The  contents  of  this  file  will be treated as binary data, there are no restrictions on
                     character encodings or file size.  Beware of trailing  newline  characters  which  will  be
                     included in the password data.

              multifile
                     checks the username and password against the file specified using the filename option.  The
                     file must contain each user credentials on one line of the form:

                     username|password|uid|gid|displays|env_opts|session_opts

                     It is not possible to have usernames or password that contain the pipe character | which is
                     used  as  delimiter,  or  newlines and carriage returns.  This module is deprecated, sqlite
                     should be used instead.

              sqlite

              mysql

              sql    checks the username and password against the  sqlite  database  file  specified  using  the
                     filename  option  (for  the sqlite backend), or the database specified using the uri option
                     (mysql and sql backends).  The authentication will be processed using the  following  query
                     (which  is  configurable using the password_query option): SELECT password FROM users WHERE
                     username=(?)  The sessions available  for  each  user  will  be  queried  using:  (this  is
                     configurable  using  the  sessions_query  option):  SELECT uid, gid, displays, env_options,
                     session_options FROM users WHERE username=(?)  Multiple displays  may  be  specified  as  a
                     comma separated list.

              hosts  checks the host using the system's tcp-wrappers library.  (Posix only, and not available on
                     Mac OS) See hosts.allow and hosts.deny for details.

              exec   Executes the command specified using the command attribute, the arguments to  this  command
                     are:  a description of the access request and the timeout value. (also configurable) If the
                     command is not specified, the system will try to locate and  use  the  auth_dialog  utility
                     which  is  shipped with xpra.  The command should return 0 to allow access, any other value
                     will deny access.

              peercred
                     checks the unix domain socket peer  credentials  using  SO_PEERCRED.   This  authentication
                     module is only available on some Posix compliant operating systems. This module will verify
                     that the operating system provides the uid and  gid  of  the  process  that  initiated  the
                     connection.  Access can be restricted by supplying a colon separated list of valid uids and
                     gids that are allowed to connect.  Those id values may be specified using numerical  values
                     or  using the usernames / group names.  This module is different from the others in that it
                     will not require the client to supply  a  username  or  password,  as  those  are  ignored.
                     Environment  variables  and  pseudo-environment  variables  may also be used as values, eg:
                     --auth=peercred:uid=\$UID:fred,gid=xpra.

              pam    validates the username and password using the PAM system

              win32  validates the username and password using Microsoft Windows authentication (only  available
                     on this platform)

              sys    chooses the appropriate system authentication module automatically (either pam or win32)

              kerberos-password
                     validates  the  username  and password using kerberos authentication.  Warning: this module
                     does not use kerberos tickets and the password will be sent in plain text  to  the  server.
                     This should only be used for testing.

              kerberos-ticket
                     validates a kerberos ticket obtained by the client.

              gss    validates a GSS ticket obtained by the client.

              u2f    requests a U2F token from the client.

              ldap   validates the username and password against an LDAP server, using the python-ldap library.

              ldap3  validates the username and password against an LDAP server, using the python ldap3 library.

       --tcp-auth=MODULE
              Just  like the auth switch, except this one only applies to TCP sockets (sockets defined using the
              bind-tcp switch).

       --udp-auth=MODULE
              Just like the tcp-auth switch, except this one only applies to UDP sockets (sockets defined  using
              the bind-udp switch).

       --ws-auth=MODULE
              Just  like  the auth switch, except this one only applies to ws sockets: sockets defined using the
              bind-ws switch, or TCP sockets upgraded to websockets. (if the html option is enabled).

       --wss-auth=MODULE
              Just like the auth switch, except this one only applies to wss sockets: sockets defined using  the
              bind-wss switch, ws sockets upgraded to SSL (if the ssl option is enabled) or TCP sockets upgraded
              to SSL and then to wss.  (if both the ssl and html options are enabled).

       --ssl-auth=MODULE
              Just like the auth switch, except this one only applies to SSL sockets: sockets defined using  the
              bind-ssl switch, or TCP sockets upgraded by ssl=auto or ssl=on.

       --rfb-auth=MODULE
              Authentication module to use for the bind-rfb sockets.

       --vsock-auth=MODULE
              Just  like  the  auth switch, except this one only applies to VSOCK sockets (sockets defined using
              the bind-vsock switch).

       --challenge-handlers=MODULE:options
              Configures which challenge handlers are used by the client and in which order. This option may  be
              repeated  to  specify  multiple  handlers,  which  can be useful if the server sends more than one
              authentication   challenge.    The   default    value    is:    all    which    corresponds    to:
              uri,file,env,kerberos,gss,u2f,prompt.

              uri    Use the password specified on the connection string, if any.

              file   The  filename  used  to  store the password can be specified using the filename option.  If
                     this option is not specified, it will fallback to using  the  password  filename  specified
                     with the password-file switch.

              env    Use  the password specified using the environment variable specified using the name option,
                     which defaults to XPRA_PASSWORD if unspecified.

              kerberos
                     Requests a kerberos token for the service specified.

              gss    Requests a gss token for the service specified.

              u2f    Requests a token from a U2F device.

              prompt Prompt the user for the value.  Terminal clients prompt using text input, GUI clients use a
                     dialog.

       --min-port=PORT
              The  minimum  port number allowed when creating UDP and TCP sockets.  You can use a lower value to
              allow unprivileged users to bind to privileged ports when starting sessions via  the  system  wide
              proxy server.  The default value is 1024 which is the standard value for privileged ports.

       --mdns=yes|no
              Enable or disable the publication of new sessions via mDNS.

       --dbus-launch=COMMAND|no
              Start the session within a dbus-launch context, you can specify the dbus launch command to use, or
              turn it off completely.  Some features may not be available without a dbus context.

       --dbus-proxy=yes|no
              Allows the client to forward dbus calls to the server.

       --dbus-control=yes|no
              Start a dbus server which can be used to interact with the server process.

   Options for start, start-desktop, upgrade
       --exec-wrapper=CMD
              A wrapper command which is prepended to all start commands.  Typically, this is used for  starting
              all sub-commands via VirtualGL.

       --start=CMD
              After  starting the server, runs the command CMD using the default shell.  The command is run with
              its $DISPLAY set to point to the newly-started server.  This option may be given multiple times to
              start multiple commands.

       --start-child=CMD
              Identical to --start, except that the commands are taken into account by --exit-with-children.

       --start-after-connect=CMD
              Wait for the first client to connect before starting the command.

       --start-child-after-connect=CMD
              Wait for the first client to connect before starting the child command.  See start-child.

       --start-on-connect=CMD
              Execute this command every time a client connects.

       --start-child-on-connect=CMD
              Execute this child command every time a client connects.  See start-child.

       --start-on-last-client-exit=CMD
              Execute this command every time a client disconnects and there are no other clients left.

       --start-child-on-last-client-exit=CMD
              Execute  this  child  command every time a client disconnects and there are no other clients left.
              See start-child.

       --terminate-children=yes|no
              On server stop, terminate all the child commands that have been started by the server.  This  does
              not  affect  server exit.  Most child commands are tied to the display so they are normally forced
              to shutdown anyway, but this gives them more time to cleanup properly and  can  be  used  to  stop
              background commands that aren't tied to a display.

       --exit-with-children=yes|no
              This option may only be used if --start-child is also given.  If it is given, then the xpra server
              will monitor the status of the children started by --start-child, and will automatically terminate
              itself when the last of them has exited.

       --exit-with-client=yes|no
              The server will terminate when the last client disconnects.

       --env=KEY=VALUE
              Extra  environment  variables  which will only affect commands started using fB--start or --start-
              child.

       --start-new-commands=yes|no
              Allow clients to ask the server to execute new commands.  (this can also be used via  the  control
              channel)

       --start-via-proxy=yes|no|auto
              If  enabled,  the  start  and start-desktop subcommands will be delegated to the system wide proxy
              server instance.  With auto mode, this delegation will only occur if the system wide proxy  server
              is found.

       --systemd-run=yes|no|auto
              Wrap server start commands with systemd-run.

       --systemd-run-args=ARGS
              Command line arguments passed to systemd-run.

       --use-display
              Use  an existing display rather than starting one with xvfb.  You are responsible for starting the
              display yourself.  This can also be used to rescue an existing display whose xpra server  instance
              crashed or for running xpra against an accelerated X11 server.

       --displayfd=FD
              The xpra server will write the display number back on this file descriptor as a newline-terminated
              string.  This is most useful when the display number is not  specified  with  the  xpra  start  or
              start-desktop subcommands.

       --xvfb=CMD
              When  starting  a  seamless server, xpra starts a virtual X server to run the clients on.  If your
              Xvfb is installed in a funny location, or you want to use some other virtual X server,  then  this
              switch  allows  you  to  specify how to run your preferred X server executable.  The default value
              used depends on your platform.  For more information, see: https://xpra.org/Xdummy.html

       --sync-xvfb=DELAY
              The windows are normally only displayed on the client(s), they are  not  painted  on  the  virtual
              display.  Some applications like screen recorders may want to capture the window contents, you can
              use this option to enable painting with a configurable delay  (in  milliseconds).   Warning:  this
              extra painting is expensive and quite slow, which is why it is not enabled by default.

       --attach=yes|no|auto
              Once the server has started, immediately connect a client to it.  With the value auto, a client is
              started for remote servers only. (servers specified via a network URI)

   Options for start, start-desktop, upgrade, shadow
       --tcp-proxy=HOST:PORT
              Specifies the address to which non-xpra packets will be forwarded.  This can be used to share  the
              same TCP port with another TCP servers, usually a web server.  xpra clients will connect as usual,
              but any client that does not speak the xpra protocol will be forwarded to the alternative server.

       --html=on|off|auto|webrootpath
              Respond to HTTP requests on the TCP port(s) and local sockets.  This requires at least one TCP  or
              local  socket  to be configured using the matching bind option.  The auto mode will enable support
              if possible.  By default the server will provide access to the HTML5 client.  You can also specify
              your own web root path as argument.

       --rfb-upgrade=DELAY
              Allows RFB clients (ie: VNC) to connect to a plain TCP socket.  If no data is received after DELAY
              seconds, the server will send a RFB handshake.  This option is only applicable to servers  started
              in start-desktop or shadow modes.

       --video-encoders=ENCODERS
              Specifies the video encoders to try to load.  By default, all of them are loaded, but one may want
              to specify a more restrictive list of encoders.  Use the special value 'help' to  get  a  list  of
              options.  Use the value 'none' to not load any video encoders.

       --csc-modules=MODULES
              Specifies  the colourspace conversion modules to try to load.  By default, all of them are loaded,
              but one may want to specify a more restrictive list of modules.  Use the special value  'help'  to
              get a list of options.  Use the value 'none' to not load any colourspace conversion modules.

       --socket-permissions=ACCESS-MODE
              Specifies  the  file  permissions  on  the server's unix domain sockets.  Defaults to 600. This is
              ignored when mmap-group is enabled.

   Options for start, start-desktop, upgrade and attach
       --encryption=CIPHER
              Specifies the cipher to use for securing the connection from prying eyes.   This  option  requires
              the  use  of the --encryption-keyfile option.  The only cipher supported at present is AES, if the
              client requests encryption it will be used by both the client and  server  for  all  communication
              after  the initial password verification, but only if the server supports this feature too.  Note:
              this feature has not been extensively reviewed and as it is it should not be considered safe  from
              determined attackers.

       --tcp-encryption=CIPHER
              Just  like  the  encryption  switch,  except this one only applies to TCP sockets (sockets defined
              using the bind-tcp switch).

       --encryption-keyfile=FILENAME
              Specifies the key to use with the encryption cipher specified with --encryption.  The  client  and
              server must use the same keyfile contents.

       --tcp-encryption-keyfile=FILENAME
              Just  like  the  encryption-keyfile  switch,  except this one only applies to TCP sockets (sockets
              defined using the bind-tcp switch).

       --idle-timeout=IDLETIMEOUT
              The connection will be terminated if there is no user activity (mouse clicks or key  presses)  for
              the given amount of time (in seconds). Use the value 0 to disable this timeout.

       --server-idle-timeout=IDLETIMEOUT
              The server will exit if there are no active connections for the given amount of time (in seconds).
              Use the value 0 to disable this timeout.

       --clipboard-filter-file=FILENAME
              Name of a file containing regular expressions, any  clipboard  data  that  matches  one  of  these
              regular  expressions  will  be  dropped.   Note:  at present this only applies to copying from the
              machine where this option is used, not to it.

       --dpi=VALUE
              The 'dots per inch' value that client applications should  try  to  honour.   This  numeric  value
              should  be  in the range 10 to 500 to be useful.  Many applications will only read this value when
              starting up, so connecting to an existing session started with a different DPI value may not  have
              the desired effect.

       --pixel-depth=VALUE
              When  starting  a  server,  this  switch  controls  the bits per pixel of the virtual framebuffer.
              Possible values: 0 (auto), 16, 24, 30.  When starting a client, this switch controls  the  picture
              rendering  with  the  opengl  backend:  values higher than 24 will enable deep color, the value 24
              enables regular true color rendering. Use the value 0 to let the client decide  if  the  rendering
              will  benefit  from  using deep color. (this is only supported on some Posix clients) Other values
              should not be used.

       --cursors=yes|no
              Enable or disable forwarding of custom application mouse cursors.  Client applications may  change
              the  mouse  cursor  at any time, which will cause the new cursor's pixels to be sent to the client
              each time.  This disables the feature.

       --notifications=yes|no
              Enable or disable forwarding of system  notifications.   System  notifications  require  the  xpra
              server  to  have  its own instance of a dbus daemon, if it is missing a warning will be printed on
              startup.  This switch disables the feature entirely, and avoids the warning.

       --input-method=METHOD
              Specify which input method to configure.  This sets a number of environment variables which should
              be honoured by applications started with the start-child option.

              The following METHODs are currently supported:

              none   Disable  input methods completely and prevent it from interfering with keyboard input. This
                     is the default.

              keep   Keeps the environment unchanged. You are responsible for ensuring it is correct.

              xim    Enables the X Input Method.

              IBus   Enables the Intelligent Input Bus.

              SCIM   Enables the Smart Common Input Method.

              uim    Enables the Universal Input Method.

       Any other value will also be set up, but will trigger a warning.

       --xsettings=yes|no
              Enable or disable xsettings synchronization.  Xsettings are  only  forwarded  from  posix  clients
              connecting to real posix servers (not shadows).

       --system-tray=yes|no
              Enable  or  disable forwarding of system tray icons.  This feature requires client support and may
              not be available on all platforms.

       --bell=yes|no
              Enable or disable forwarding of the system bell.

       --webcam=yes|no
              Enable or disable webcam forwarding.

       --mousewheel=on|off|invert|invert-x|invert-y|invert-z
              Mouse wheel handling: can be used to disable mouse wheel forwarding or to invert some or all axes.

       --remote-logging=yes|no|both
              Allow the client to forward its log output to the server.  The client can specify the  value  both
              to both send it to the server and keep it locally.

       --av-sync=yes|no
              Enable  or  disable  audio-video  synchronization.   The  video data will be delayed so that it is
              displayed in sync with the audio.  Note: this only applies to video regions, either  auto-detected
              via the builtin heuristics or specified using the dbus interface.

   Options for attach
       --modal-windows=yes|no
              Honour  modal  windows.   This  may  have  undesirable side effects when multiple applications are
              forwarded through the same xpra server: modal windows will be made modal for all the  applications
              forwarded by xpra rather than just the one application which owns that window.

       --password-file=FILENAME
              Supply the password to be used for connecting to a server that uses authentication. See auth, tcp-
              auth, ssl-auth  and  vsock-auth  for  details.   Alternatively,  you  may  use  the  XPRA_PASSWORD
              environment variable.

       --opengl=(yes|no|auto)[:backend]
              Use OpenGL accelerated rendering on the client.  The default is to detect if the graphics card and
              drivers are supported (auto mode), but one can also disable OpenGL (no) or force it enabled (yes).
              On  some  platforms,  it  is  also possible to specify which backends should be used, only gtk and
              native  are  currently  supported  and  only  on  X11  platforms.    ie:   opengl=yes:native,   or
              opengl=auto:gtk,native.

       --webcam=yes|no|/dev/deviceXXX|DEVICEID
              Enable or disable webcam forwarding.  The webcam device to use can also be specified.

       -zLEVEL, --compress=LEVEL
              Select  the  level of compression xpra will use when transmitting data over the network.  With the
              lz4 and lzo compressors, there are only two possible values: 0  (meaning  no  compression)  and  1
              (compression enabled).  The zlib compressor supports values between 0 (meaning no compression) and
              9, inclusive. It should only be used when lz4 and lzo are not available.

              This compression is not used on pixel data (except when using the rgb encoding).

       --quality=VALUE
              This option sets a fixed image compression quality for lossy encodings (jpeg, webp, h264/h265  and
              vp8/vp9).  First, one of those lossy encodings must be enabled with --encoding.  Values range from
              1  (lowest  quality,  high  compression  -  generally  unusable)  to  100  (highest  quality,  low
              compression).   Specify  a value of zero to let the system tune the quality dynamically to achieve
              the best bandwidth usage possible.  It is usually best not to use this option and use  min-quality
              instead.

       --min-quality=MIN-QUALITY
              This  option sets the minimum encoding quality allowed when the quality option is set to automatic
              mode.

       --speed=SPEED
              This option sets the encoding speed.  Slower compresses more, faster  will  give  better  latency.
              The  system  normally  uses  a variable speed, this option forces a fixed speed setting to be used
              instead.  It is usually best not to use this option and use min-speed instead.

       --min-speed=MIN-SPEED
              This option sets the minimum encoding speed allowed when the speed  option  is  set  to  automatic
              mode.

       --auto-refresh-delay=DELAY
              This  option  sets  a  delay  after which the windows are automatically refreshed using a lossless
              frame.  The delay is a floating-point number and is in seconds.  This option is enabled by default
              with a delay of 0.25 seconds.  This option is only relevant when using a lossy encoding.

       --shortcut-modifiers=MODIFIERS
              Defines  the default shortcut modifiers required by the key-shortcuts, these modifiers can then be
              referred to as #.  The default value is 'auto' which evaluates to Meta+Shift on most platforms.

       --key-shortcut=KEY:ACTION
              Can be specified multiple times to add multiple key shortcuts.  These keys will be caught  by  the
              client and trigger the action specified and the key presses will not be passed on to the server.

              The  KEY  specification  may  include keyboard modifiers in the form [modifier+]*key, for example:
              Shift+F10 or Shift+Control+B.  You can refer to the shorcut-modifers option  value  using  #,  ie:
              #+F1.

              If no shortcuts are defined on the command line, the default builtin list will be used.

              Some  of  the  actions  may  allow  arguments  (ie:  the  log action does), in which case they are
              specified in the usual programming style syntax: ACTION(ARG1, ARG2, etc)
              String arguments must be quoted  (both  single  and  double  quotes  are  supported)  and  numeric
              arguments  must not be quoted.  Beware the the parenthesis and quotes must usually be escaped when
              used from a shell command line.  Example: --key-shortcut=Meta+Shift+F7:log\(\'hello\'\)

              The following ACTIONs are currently defined:

              quit   Disconnect the xpra client.

              log("MESSAGE")
                     Sends MESSAGE to the log.

              show_session_info[("TabName")]
                     Shows the session information window. The optional TabName allows the information tab shown
                     to be selected. Use the value help to get the list of options.

              show_menu
                     Shows the menu normally found in the system tray.

              show_start_new_command
                     Shows the start new command dialog.

              magic_key
                     Placeholder which can be used by some client toolkits.

              void   Does  not  do  anything, and can therefore be used to prevent certain key combinations from
                     ever being sent to the server.

              refresh_window
                     Force the currently focused window to be refreshed.

              refresh_all_windows
                     Force all windows to be refreshed.

              toggle_keyboard_grab
                     The keyboard will be grabbed / ungrabbed by the current window.

              toggle_pointer_grab
                     The pointer will be grabbed and confined to the current window.

              toggle_fullscreen
                     Make the current window fullscreen / unfullscreen.

              toggle_debug
                     Turn debugging on or off.

              scaleup
                     Increase the current value of desktop-scaling.

              scaledown
                     Decrease the current value of desktop-scaling.

              scalereset
                     Reset the desktop-scaling to its original value.

              scalingoff
                     Turn off desktop-scaling.

              increase_quality
                     Increase the min-quality or quality setting (whichever one is currently in use).

              decrease_quality
                     Decrease the min-quality or quality setting (whichever one is currently in use).

              increase_speed
                     Increase the min-speed or speed setting (whichever one is currently in use).

              decrease_speed
                     Decrease the min-speed or speed setting (whichever one is currently in use).

       --sharing=yes|no|auto
              Sharing allows more than one client to connect to the same session.  This must be enabled on  both
              the  server  and  all  co-operating clients to function.  When used server-side, the default value
              auto allows the clients to decide if they are willing to share the  session.   When  used  client-
              side,  the  default value auto evaluates to no.  To allow sharing to work with unix domain sockets
              (either using local connections or via ssh), you should create at least  one  socket  in  a  group
              accessible  directory.  On  Posix  with  a default configuration, being a member of the xpra group
              should be enough to create a socket in /run/xpra. You must also ensure  that  the  permissions  of
              this socket file allow group access, see socket-permissions.

       --lock=yes|no|auto
              Locking allows a client to refuse to hand over the session to a new client.  The session may still
              be shared with multiple clients (see the sharing option), but otherwise the server will reject new
              clients.   When used server-side, the default value auto allows the clients to decide if they want
              to lock the session.  When used client-side, the default value auto evaluates to no.

       --keyboard-sync=yes|no
              Normally the key presses and key release events are sent to the server as they occur so  that  the
              server  can maintain a consistent keyboard state.  Disabling synchronization can prevent keys from
              repeating unexpectedly on high latency links but it may also disrupt applications which access the
              keyboard directly (games, etc.).

       --keyboard-raw=yes|no
              Tells  the server to process all keyboard input untranslated.  Both the client and the server must
              be using the same type of keyboard interface. (ie: both using X11)

       --keyboard-layout=LAYOUTSTRING
              The keyboard layout is normally detected automatically.  This option overrides it.

       --keyboard-layouts=LAYOUTS
              The list of keyboard layouts to enable.

       --keyboard-variant=VARIANT
              Override for the keyboard layout variant.

       --keyboard-variants=VARIANTS
              Override for the keyboard layout variants.

       --keyboard-options=OPTIONS
              Override for the keyboard options sent to the server.

       --swap-keys=YES|NO
              This option only applies to MacOS clients, it swaps the command and control keys and is enabled by
              default.

       --sound-source=PLUGIN
              Specifies  the  GStreamer sound plugin used for capturing the sound stream.  This affects "speaker
              forwarding" on the server, and "microphone" forwarding on the client.  To get a  list  of  options
              use  the  special  value  'help'.   It  is also possible to specify plugin options using the form:
              --sound-source= pulsedevice=device.alsa_input.pci-0000_00_14.2.analog-stereo

       --speaker=on|off|disabled and --microphone=on|off|disabled|on:DEVICE|off:DEVICE
              Sound input and output forwarding support: on will start the forwarding as soon as the  connection
              is established, off will require the user to enable it via the menu, disabled will prevent it from
              being used and the menu entry will be disabled.  With microphone forwarding, you may also be  able
              to specify which device to use.

       --speaker-codec=CODEC and --microphone-codec=CODEC
              Specify  the codec(s) to use for sound output (speaker) or input (microphone).  This parameter can
              be specified multiple times and the order in which the codecs are specified defines the  preferred
              codec  order.   Use  the special value 'help' to get a list of options.  When unspecified, all the
              available codecs are allowed and the first one is used.

       --title=VALUE
              Sets the text shown as window title.   The  string  supplied  can  make  use  of  remote  metadata
              placeholders  which  will  be  populated  at  runtime with the values from the remote server.  The
              default value used is "@title@ on @client-machine@".

              The following placeholders are defined:

              @title@
                     Will be replaced by the remote window's title.

              @client-machine@
                     Will be replaced by the hostname of  the  system  where  the  application  is  running,  if
                     provided, the xpra server's hostname otherwise.

              @server-machine@
                     Will be replaced by the hostname of the xpra server.

              @server-display@
                     Will be replaced by the name of the display on which the application is running.

       --border=BORDER
              Specifies  the color and size of the border to draw inside every xpra window.  This can be used to
              easily distinguish xpra windows running on remote hosts from local windows.   The  BORDER  can  be
              specified using standard color names (ie: red, or orange) or using the web hexadecimal syntax (ie:
              #F00 or #FF8C00). The special color name "auto" will derive  the  color  from  the  server  target
              address  (the connection string) so that connecting to the same target should always give the same
              color.  You may also specify the size of the border in pixels, ie: --border=yellow,10.

       --window-icon=FILENAME
              Path to the default image which will be used for all windows.  This  icon  may  be  shown  in  the
              window's  bar,  its  iconified state or task switchers.  This depends on the operating system, the
              window manage and the application may override this too.

       --window-close=ACTION
              Choose what action to take when the window is closed by the client.  The following actions can  be
              used:

              auto   The  client  will  figure  out what is best based on the window type.  This is the default.
                     ie: it will use disconnect shadow sessions, Iforward for seamless windows.

              forward
                     The event will be forwarded to the server.

              ignore Do nothing.

              disconnect
                     Disconnect from the server.

              shutdown
                     Shutdown the server.

       --desktop-scaling=off|on|auto|VALUE
              Desktop scaling allows the windows to be scaled by the  client.   Downscaling  will  mostly  waste
              bandwidth,  upscaling  allows  the window's pixels to be sent over the wire at a lower resolution,
              saving bandwidth and CPU time.  This option can also be used to request a specific scaling  value.
              For  best  results,  use  opengl  client  rendering,  the  other  display backends may show visual
              artifacts when scaling.  Note: the scaling may  also  be  adjusted  at  runtime  through  keyboard
              shortcuts if those are configured.

              The desktop-scaling value can take the form:

              off    scaling will be disabled

              on     scaling will be allowed, but it will start unscaled

              auto   scaling  will  be  allowed and a scaling value will be automatically chosen if the client's
                     desktop is large (bigger desktops will use higher scaling values)

              scaling-value
                     scaling will be enabled and use the  given  value,  specified  as  a  number,  fraction  or
                     percentage. ie: 2, 3/2 or 150%.

              pair   the  scaling  will  be  enabled  and use a different value for the X and Y axis. ie: 3x2 or
                     3/2x4/3

              desktop-size
                     the scaling will be enabled and the server will render to the given size. ie: 1600x1200

       --tray=yes|no Enable or disable the system tray.  Not available on OSX since  the  dock  icon  is  always
       shown.

       --delay-tray
              Waits for the first window or notification to appear before showing the system tray. (posix only)

       --tray-icon=FILENAME
              Specifies  the icon shown in the dock/tray.  By default it uses a simple default 'xpra' icon.  (On
              Microsoft Windows, the icon must be in ico format.)

       --enable-pings
              The client and server will exchange ping and  echo  packets  which  are  used  to  gather  latency
              statistics.  Those statistics can be seen using the xpra info command.

   Options for attach, stop, info, screenshot, version
       --ssh=CMD
              When  you  use  an  ssh:  address  to  connect  to  a remote display, xpra runs ssh(1) to make the
              underlying connection. By default, it does this by running the command "ssh". If your ssh  program
              is  in  an  unusual  location,  has an unusual name, or you want to pass special options to change
              ssh's behavior, then you can use the --ssh switch to tell xpra how to run ssh.

              For example, if you want to use arcfour encryption, then you should run

                     xpra attach --ssh="ssh -c arcfour" ssh://frodo/7

              Note: Don't bother to enable ssh compression; this is redundant with xpra's own  compression,  and
              will just waste your CPU.  See also xpra's --compress switch.

              On  MS  Windows,  where  backslashes are used to separate path elements and where spaces are often
              used  as  part  of  paths,  you  need  to  add   quotes   around   paths.   (ie:   ssh="C:\Program
              Files\Xpra\Plink.exe" -ssh -agent)

       --exit-ssh=yes|no
              Choose whether the SSH client process should be forcibly terminated when xpra disconnects from the
              server.  If you are using SSH connection sharing, you may want to avoid stopping  the  SSH  master
              process  instance  spawned by xpra as it may be used by other SSH sessions.  Note: the exit-ssh=no
              detaches the SSH process from the terminal which prevents the SSH process  from  interacting  with
              the  terminal  input, this disables the keyboard interaction required for password input, host key
              verification, etc..

       --remote-xpra=CMD
              When connecting to a remote server over ssh, xpra needs to be  able  to  find  and  run  the  xpra
              executable  on  the  remote  host.   If this executable is in a non-standard location, or requires
              special environment variables to be set before it can run, then accomplishing  this  may  be  non-
              trivial.   If running xpra attach ssh:something fails because it cannot find the remote xpra, then
              you can use this option to specify how to run xpra on the remote host.

              That said, this option should not be needed in normal usage, as xpra  tries  quite  hard  to  work
              around  the  above  problems.  If you find yourself needing it often, then that may indicate a bug
              that we would appreciate hearing about.

   SSL Options
       --ssl=on|auto|off|tcp|www
              Whether to enable SSL on TCP sockets and for what purpose.  The TCP sockets will automatically  be
              upgraded to SSL when SSL packets are received.

              auto   The  server  will  try  to  guess  what protocol to use for each new SSL connection: either
                     xpra's native protocol or https / websocket (wss)

              tcp    The SSL sockets will only be used for xpra's native protocol

              www    The SSL sockets will only be used for https and websocket (wss)
       If SSL is enabled, then a ssl-cert is required.  Authentication,  if  required,  will  use  the  ssl-auth
       module specified, and fallback to tcp-auth or auth unless the value none is specified.

       The  remaining  options  mirror the Python ssl module attributes.  Please refer to that documentation and
       bear in mind that configuring SSL for security is not trivial,  and  definitely  not  just  a  matter  of
       enabling  SSL.  See:  https://docs.python.org/2/library/ssl.html  Some  options may not be available with
       older versions of Python.

       Summary: --ssl-key=KEYFILE The key file to use.

       --ssl-cert=ERTFILEORDIR
              Certificate file, required for server SSL support.

       --ssl-protocol=PROTOCOLVERSION
              Specifies which version of the SSL protocol to use.

       --ssl-ca-certs=CACERTSFILE
              The ca_certs file contains a set of concatenated  'certification  authority'  certificates.  If  a
              directory is specified, it should contain the certificates.

       --ssl-ca-data=ERTDATA
              Certificate data.

       --ssl-ciphers=CIPHERS
              Sets the available ciphers, it should be a string in the OpenSSL cipher list format.

       --ssl-client-verify-mode=none|optional|required
              Whether to try to verify the client's certificates and how to behave if verification fails.

       --ssl-server-verify-mode=none|optional|required
              Whether to try to verify the server's certificates and how to behave if verification fails.

       --ssl-verify-flags=FLAGS
              The flags for certificate verification operations.

       --ssl-check-hostname=yes|no
              Whether to match the peer cert's hostname.

       --ssl-options=options
              Set of SSL options enabled on this context.

       ENVIRONMENT

       DISPLAY
              xpra  start  --start-child=...  sets this variable in the environment of the child to point to the
              xpra display.

              xpra attach, on the other  hand,  uses  this  variable  to  determine  which  display  the  remote
              applications should be shown on.

              fIXPRA_PASSWORD may be used with xpra attach instead of the password-file option.

FILES

       xpra.conf  stores  default  values  for  most  options.   There is a global configuration file in /etc or
       /usr/local/etc, and each user may override those defaults by creating the file .xpra/xpra.conf.  You  can
       also  split  the  options  into  multiple  files  by  placing  them  in a conf.d directory with the .conf
       extension.  Depending on OS and version, xpra uses the directory ~/.xpra or /run/<uid>/xpra  to  store  a
       number of files.  (The examples below are given for the display :7.)

       ~/.xpra/:7
              The  unix  domain  socket that clients use to contact the xpra server, if the system configuration
              uses this directory.

       ~/.xpra/:7.log
              When run in daemon mode (the default), the xpra server directs all  output  to  this  file.   This
              includes all debugging output, if debugging is enabled.

       ~/.xpra/run-xpra
              A  shell  script  that,  when run, starts up xpra with the correct python interpreter, PYTHONPATH,
              PATH, location of the main xpra script, etc.  Automatically generated by xpra initenv, xpra  start
              and used by xpra attach (see also the discussion of --remote-xpra).

BUGS

       Xpra has no test suite.

       Xpra  does  not  fully  handle  all  aspects  of  the X protocol; for instance, fancy input features like
       pressure-sensitivity on tablets, some window manager hints, and probably other more obscure parts of  the
       X  protocol.   It  does,  however,  degrade  gracefully, and patches for each feature would be gratefully
       accepted.

       The xpra server allocates an over-large framebuffer when using Xvfb; this wastes  memory.   If  the  Xvfb
       does  not  support  RandR  this  can  also cause applications to misbehave (e.g. by letting menus go off-
       screen). This is not a problem when using Xdummy, see the --xvfb= switch for details.  Conversely, if the
       framebuffer  is  ever insufficiently large, clients will misbehave in other ways (e.g., input events will
       be misdirected).

REPORTING BUGS

       Send any questions or bugs reports to http://xpra.org/trac/

SEE ALSO

       screen(1), winswitch_applet(1)

                                                                                                         XPRA(1)