New upstream version 3.13

16 files changed, 356 insertions, 287 deletions

diff --git a/docs/api/remctl.3 b/docs/api/remctl.3
index b3c618c..e1875fa 100644
--- a/docs/api/remctl.3
+++ b/docs/api/remctl.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL 3"
-.TH REMCTL 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_close.3 b/docs/api/remctl_close.3
index 3bc5d15..8719fbf 100644
--- a/docs/api/remctl_close.3
+++ b/docs/api/remctl_close.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_CLOSE 3"
-.TH REMCTL_CLOSE 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_CLOSE 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_command.3 b/docs/api/remctl_command.3
index e522f3f..55c6e19 100644
--- a/docs/api/remctl_command.3
+++ b/docs/api/remctl_command.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_COMMAND 3"
-.TH REMCTL_COMMAND 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_COMMAND 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_error.3 b/docs/api/remctl_error.3
index 688e5af..b07ac1a 100644
--- a/docs/api/remctl_error.3
+++ b/docs/api/remctl_error.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_ERROR 3"
-.TH REMCTL_ERROR 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_ERROR 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_new.3 b/docs/api/remctl_new.3
index 2acb013..96b8813 100644
--- a/docs/api/remctl_new.3
+++ b/docs/api/remctl_new.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_NEW 3"
-.TH REMCTL_NEW 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_NEW 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_noop.3 b/docs/api/remctl_noop.3
index 0a576ec..216ad26 100644
--- a/docs/api/remctl_noop.3
+++ b/docs/api/remctl_noop.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_NOOP 3"
-.TH REMCTL_NOOP 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_NOOP 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_open.3 b/docs/api/remctl_open.3
index 68dde52..0474f2d 100644
--- a/docs/api/remctl_open.3
+++ b/docs/api/remctl_open.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_OPEN 3"
-.TH REMCTL_OPEN 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_OPEN 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_output.3 b/docs/api/remctl_output.3
index 4cf5b7a..a927d1e 100644
--- a/docs/api/remctl_output.3
+++ b/docs/api/remctl_output.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_OUTPUT 3"
-.TH REMCTL_OUTPUT 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_OUTPUT 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_set_ccache.3 b/docs/api/remctl_set_ccache.3
index 841067f..cdafbbb 100644
--- a/docs/api/remctl_set_ccache.3
+++ b/docs/api/remctl_set_ccache.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_SET_CCACHE 3"
-.TH REMCTL_SET_CCACHE 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_SET_CCACHE 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_set_source_ip.3 b/docs/api/remctl_set_source_ip.3
index 5625f6a..efcf176 100644
--- a/docs/api/remctl_set_source_ip.3
+++ b/docs/api/remctl_set_source_ip.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_SET_SOURCE_IP 3"
-.TH REMCTL_SET_SOURCE_IP 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_SET_SOURCE_IP 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/api/remctl_set_timeout.3 b/docs/api/remctl_set_timeout.3
index 35b9d15..2fa4920 100644
--- a/docs/api/remctl_set_timeout.3
+++ b/docs/api/remctl_set_timeout.3
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL_SET_TIMEOUT 3"
-.TH REMCTL_SET_TIMEOUT 3 "2016-07-29" "3.12" "remctl Library Reference"
+.TH REMCTL_SET_TIMEOUT 3 "2016-10-11" "3.13" "remctl Library Reference"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/remctl-shell.8.in b/docs/remctl-shell.8.in
index edea4f0..46523f8 100644
--- a/docs/remctl-shell.8.in
+++ b/docs/remctl-shell.8.in
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL-SHELL 8"
-.TH REMCTL-SHELL 8 "2016-07-29" "3.12" "remctl"
+.TH REMCTL-SHELL 8 "2016-10-11" "3.13" "remctl"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -143,15 +139,17 @@ remctl\-shell \- Restricted shell that mimics a remctl server
 .SH "SYNOPSIS"
 .IX Header "SYNOPSIS"
 remctl-shell [\fB\-dhqSv\fR] [\fB\-f\fR \fIconfig\fR] \fB\-c\fR \fIcommand\fR
+.PP
+remctl-shell [\fB\-dqS\fR] [\fB\-f\fR \fIconfig\fR] \fIuser\fR
 .SH "DESCRIPTION"
 .IX Header "DESCRIPTION"
 \&\fBremctl-shell\fR is a restricted shell that mimics the behavior of the
 \&\fBremctld\fR server without using the remctl protocol, GSS-API, or Kerberos.
-It's intended to be run via ssh as the shell for a special user (by
-convention, \f(CW\*(C`remctl\*(C'\fR, although the shell itself doesn't care), with an
-\&\fIauthorized_keys\fR file that specifies the user identity corresponding to
-each key that is allowed to run remctl commands.  All access control then
-works as normal.
+It's intended to be run via ssh as either the shell or the forced command
+for a special user (by convention, \f(CW\*(C`remctl\*(C'\fR, although \fBremctl-shell\fR
+doesn't care), with an \fIauthorized_keys\fR file that specifies the user
+identity corresponding to each key that is allowed to run remctl commands.
+All access control then works as normal.
 .PP
 The output of the command ran is returned on standard output and standard
 error, like a normal command run via ssh, and the exit status of
@@ -171,8 +169,9 @@ Since \fBremctl-shell\fR is designed to be run by a potentially untrusted
 user as a shell, normally all error messages and logging is done via
 syslog and not sent to standard error.  See the \fB\-S\fR, \fB\-d\fR, and \fB\-q\fR
 options when running it manually to debug problems.  (When running
-manually, you will also normally need to set the \s-1REMCTL_USER\s0 and
-\&\s-1SSH_CONNECTION\s0 environment variables.)
+manually, you will also normally need to set the \s-1SSH_CONNECTION\s0
+environment variable and either \s-1REMCTL_USER\s0 or \s-1SSH_ORIGINAL_COMMAND\s0
+depending on how you invoke it.)
 .SS "Quoting and Command Limitations"
 .IX Subsection "Quoting and Command Limitations"
 The ssh protocol is much less sophisticated than remctl at passing command
@@ -208,24 +207,62 @@ creating the command to send to the remote server.  It may be less
 confusing to get in the habit of quoting the entire command.
 .PP
 Also be aware that the full command is passed via command line arguments,
-which means there is a tight limit on the length of the whole command plus
-arguments.  Expect to have problems if the total command length exceeds
-1000 characters.  For the same reason, binary data including nul
-characters cannot be passed via \fBremctl-shell\fR.  (The regular remctl
-protocol supports arbitrary-length arguments, limited only by server-side
-configuration and available server memory, and supports arbitrary binary
-data in arguments.)
+which means, when invoking \fBremctl-shell\fR as a shell, there is a tight
+limit on the length of the whole command plus arguments.  Expect to have
+problems if the total command length exceeds 1000 characters.  For the
+same reason, binary data including nul characters cannot be passed via
+\&\fBremctl-shell\fR.  Invoking it as a forced command may work around these
+limitations by putting the command into the environment instead, but there
+may still be restrictions on that.  (The regular remctl protocol supports
+arbitrary-length arguments, limited only by server-side configuration and
+available server memory, and supports arbitrary binary data in arguments.)
 .ie n .SS """authorized_keys"" Configuration"
 .el .SS "\f(CWauthorized_keys\fP Configuration"
 .IX Subsection "authorized_keys Configuration"
 \&\fBremctl-shell\fR is intended for use via ssh using \f(CW\*(C`authorized_keys\*(C'\fR to
 manage authentication.  (If you have Kerberos available, it's generally
 better to use the normal \fBremctld\fR server and native remctl protocol.)
-The \f(CW\*(C`authorized_keys\*(C'\fR configuration must be set up to associate each key
-with an identity by setting the \s-1REMCTL_USER\s0 environment variable.  Using
-user identities that look like Kerberos principal names is strongly
-recommended, since it may make it easier to use some of the \s-1ACL\s0 methods
-intended for the normal remctl server.
+.PP
+There are two ways to set up \fBremctl-shell\fR: either by specifying forced
+commands, or by configuring \fBremctl-shell\fR as the shell of the account.
+The forced command approach is recommended, since it doesn't require
+setting a non-default \fIsshd_config\fR option.
+.PP
+\fIUsing forced commands\fR
+.IX Subsection "Using forced commands"
+.PP
+For the role account that you want to use to run remctl commands
+(\f(CW\*(C`remctl\*(C'\fR by convention), create an \fIauthorized_keys\fR file listing
+everyone who should be able to run commands.  Before each key, set the
+\&\f(CW\*(C`command\*(C'\fR option like the below:
+.PP
+.Vb 1
+\&    command="@sbindir@/remctl\-shell example@EXAMPLE.ORG"
+.Ve
+.PP
+where the argument to \fBremctl-shell\fR is the identity matching the ssh key
+on that line.  A more complete example of a line in \fIauthorized_keys\fR:
+.PP
+.Vb 4
+\&    command=="@sbindir@/remctl\-shell example@EXAMPLE.ORG",\e
+\&    no\-agent\-forwarding,no\-port\-forwarding,no\-pty,no\-user\-rc,\e
+\&    no\-X11\-forwarding ssh\-rsa AAAAB3NzaC1yc2EA... \e
+\&    example@some\-host.example.org
+.Ve
+.PP
+Backslashes and line breaks were added for clarity.  The actual entry
+should be a single long line.  For more information on the other settings
+here, see Examples below.
+.PP
+\fIUsing a shell\fR
+.IX Subsection "Using a shell"
+.PP
+When running \fBremctl-shell\fR as the shell of the account, instead of using
+forced commands, the \fIauthorized_keys\fR configuration must be set up to
+associate each key with an identity by setting the \s-1REMCTL_USER\s0 environment
+variable.  Using user identities that look like Kerberos principal names
+is strongly recommended, since it may make it easier to use some of the
+\&\s-1ACL\s0 methods intended for the normal remctl server.
 .PP
 Since this relies on setting environment variables via \f(CW\*(C`authorized_keys\*(C'\fR,
 you unfortunately have to enable \f(CW\*(C`PermitUserEnvironment\*(C'\fR in
@@ -235,10 +272,16 @@ you unfortunately have to enable \f(CW\*(C`PermitUserEnvironment\*(C'\fR in
 \&    PermitUserEnvironment yes
 .Ve
 .PP
+\fIOther options\fR
+.IX Subsection "Other options"
+.PP
 \&\fBremctl-shell\fR will not make use of forwarded connections or agents, and
 will not pass them along to the processes they run, so all such ssh
 options should normally be disabled for defense in depth security.
 .PP
+\fIExamples\fR
+.IX Subsection "Examples"
+.PP
 Here is a recommended line in \f(CW\*(C`authorized_keys\*(C'\fR for the account managed
 by \fBremctl-shell\fR, with appropriate restrictions and an example of how to
 set the \s-1REMCTL_USER\s0 variable.  Backslashes and line breaks were added for
@@ -263,10 +306,12 @@ can instead use the much simpler:
 pair, as used in the ACLs in your remctl configuration.
 .SH "OPTIONS"
 .IX Header "OPTIONS"
-\&\fBremctl-shell\fR is normally only run with the \fB\-c\fR option since it's
-intended for use as a shell.  However, it does support some other options
-for testing, and one can use a small wrapper program as the configured
-shell that passes additional options into \fBremctl-shell\fR if needed.
+\&\fBremctl-shell\fR is normally only run with either the \fB\-c\fR option or with
+a user, since it's intended for use as a shell or forced command.
+However, it does support some other options for testing, which may be
+useful in \fIauthorized_keys\fR.  If using it as a shell, one can use a small
+wrapper program as the configured shell that passes additional options
+into \fBremctl-shell\fR if needed.
 .PP
 The start of each option description is annotated with the version of
 \&\fBremctl-shell\fR in which that option was added with its current meaning.
@@ -277,8 +322,9 @@ The start of each option description is annotated with the version of
 arguments using an algorithm similar to that used by a shell.  See the
 above discussion of quoting for more information.
 .Sp
-The start of each option description is annotated with the version of
-\&\fBremctl-shell\fR in which that option was added with its current meaning.
+This is mandatory when using \fBremctl-shell\fR as a shell.  If using it as a
+forced command, pass the user on the command line instead and do not use
+this option.
 .IP "\fB\-d\fR" 4
 .IX Item "-d"
 [3.12] Enable verbose debug logging to syslog (or to standard output if
@@ -312,11 +358,12 @@ and debugging.
 when it is invoked, or it exits with an error and doesn't do anything.
 .IP "\s-1REMCTL_USER\s0" 4
 .IX Item "REMCTL_USER"
-The user used for logging and to make authorization decisions.  The
-security of all \fBremctl-shell\fR authorization checks is based on the
-accuracy of this environment variable, so be sure that it is set
-correctly.  The best way to do this is via \f(CW\*(C`environment\*(C'\fR stanzas in
-\&\fIauthorized_keys\fR as described above.
+The user used for logging and to make authorization decisions, unless that
+was passed on the command line.  The security of all \fBremctl-shell\fR
+authorization checks is based on the accuracy of this environment
+variable, so be sure that it is set correctly.  The best way to do this is
+via \f(CW\*(C`environment\*(C'\fR stanzas in \fIauthorized_keys\fR as described above.  If
+the user is passed on the command line, this is ignored.
 .IP "\s-1SSH_CONNECTION\s0" 4
 .IX Item "SSH_CONNECTION"
 \&\fBsshd\fR uses this environment variable to communication information about
@@ -324,6 +371,10 @@ the local and remote \s-1IP\s0 addresses and ports of the ssh connection.
 \&\fBremctl-shell\fR expects the first space-separated token in this
 environment variable to be the \s-1IP\s0 address of the client.  It then uses
 that to set \s-1REMOTE_ADDR\s0 in the environment of any commands it runs.
+.IP "\s-1SSH_ORIGINAL_COMMAND\s0" 4
+.IX Item "SSH_ORIGINAL_COMMAND"
+When run as a forced command, the command run by the user is taken from
+this environment variable, which is set by \fBsshd\fR.
 .PP
 The following environment variables will be set for any commands run via
 \&\fBremctl-shell\fR (annotated with the version at which they were added).
@@ -367,17 +418,24 @@ discussed above.
 Note that \s-1REMOTE_HOST\s0 is not set by \fBremctl-shell\fR, at least currently.
 .SH "EXAMPLES"
 .IX Header "EXAMPLES"
-Typically, \fBremctl-shell\fR will be set as the shell for a dedicated user,
-normally \f(CW\*(C`remctl\*(C'\fR, via the normal mechanism for local account creation.
-That account should be configured with an ssh \fIauthorized_keys\fR file as
-discussed above.  \fBremctl-shell\fR will then be invoked with:
+Typically, \fBremctl-shell\fR will either be run as a forced command or set
+as the shell for a dedicated user, normally \f(CW\*(C`remctl\*(C'\fR, via the normal
+mechanism for local account creation.  That account should be configured
+with an ssh \fIauthorized_keys\fR file as discussed above.  \fBremctl-shell\fR
+will then be invoked with:
 .PP
 .Vb 1
 \&    remctl\-shell \-c \*(Aqcommand subcommand argument\*(Aq
 .Ve
 .PP
-by \fBsshd\fR for each incoming connection from a user that has a key in the
-\&\fIauthorized_keys\fR file.
+(if used as a shell) or with:
+.PP
+.Vb 1
+\&    remctl\-shell user@EXAMPLE.ORG
+.Ve
+.PP
+(if used as a forced command) by \fBsshd\fR for each incoming connection from
+a user that has a key in the \fIauthorized_keys\fR file.
 .PP
 If you need to run a command manually for debugging, you can run the same
 command as above, but it's often more useful to send errors to standard
@@ -389,10 +447,16 @@ error instead of to syslog.  You can do that with:
 .PP
 If you don't want to see the normal command logging, add the \fB\-q\fR option
 as well.  You can test an alternate configuration file by specifying it
-with the \fB\-f\fR option.
+with the \fB\-f\fR option.  You will need to set \s-1SSH_CONNECTION\s0 and either
+\&\s-1REMCTL_USER \s0(if using \fB\-c\fR) or \s-1SSH_ORIGINAL_COMMAND \s0(if passing the user
+on the command line).
 .SH "COMPATIBILITY"
 .IX Header "COMPATIBILITY"
 \&\fBremctl-shell\fR was added in the remctl 3.12 release.
+.PP
+The forced command mode where the user can be passed on the command line
+and the command retrieved from \s-1SSH_ORIGINAL_COMMAND\s0 was added in the
+remctl 3.13 release.
 .SH "CAVEATS"
 .IX Header "CAVEATS"
 Most of the caveats and differences between \fBremctl-shell\fR and the normal
@@ -418,6 +482,8 @@ thanks to Dropbox, Inc. for providing the time to write the initial
 implementation during Dropbox's annual Hack Week.
 .SH "COPYRIGHT AND LICENSE"
 .IX Header "COPYRIGHT AND LICENSE"
+Copyright 2016 Russ Allbery <eagle@eyrie.org>
+.PP
 Copyright 2016 Dropbox, Inc.
 .PP
 Copying and distribution of this file, with or without modification, are
diff --git a/docs/remctl-shell.pod b/docs/remctl-shell.pod
index 0322a0e..0454050 100644
--- a/docs/remctl-shell.pod
+++ b/docs/remctl-shell.pod
@@ -1,5 +1,5 @@
 =for stopwords
-remctl -dhqSv ACL Allbery GSS-API REMUSER nul remctld sshd subcommand
+remctl -dqS -dhqSv ACL Allbery GSS-API REMUSER nul remctld sshd subcommand
 
 =head1 NAME
 
@@ -9,15 +9,17 @@ remctl-shell - Restricted shell that mimics a remctl server
 
 remctl-shell [B<-dhqSv>] [B<-f> I<config>] B<-c> I<command>
 
+remctl-shell [B<-dqS>] [B<-f> I<config>] I<user>
+
 =head1 DESCRIPTION
 
 B<remctl-shell> is a restricted shell that mimics the behavior of the
 B<remctld> server without using the remctl protocol, GSS-API, or Kerberos.
-It's intended to be run via ssh as the shell for a special user (by
-convention, C<remctl>, although the shell itself doesn't care), with an
-F<authorized_keys> file that specifies the user identity corresponding to
-each key that is allowed to run remctl commands.  All access control then
-works as normal.
+It's intended to be run via ssh as either the shell or the forced command
+for a special user (by convention, C<remctl>, although B<remctl-shell>
+doesn't care), with an F<authorized_keys> file that specifies the user
+identity corresponding to each key that is allowed to run remctl commands.
+All access control then works as normal.
 
 The output of the command ran is returned on standard output and standard
 error, like a normal command run via ssh, and the exit status of
@@ -37,8 +39,9 @@ Since B<remctl-shell> is designed to be run by a potentially untrusted
 user as a shell, normally all error messages and logging is done via
 syslog and not sent to standard error.  See the B<-S>, B<-d>, and B<-q>
 options when running it manually to debug problems.  (When running
-manually, you will also normally need to set the REMCTL_USER and
-SSH_CONNECTION environment variables.)
+manually, you will also normally need to set the SSH_CONNECTION
+environment variable and either REMCTL_USER or SSH_ORIGINAL_COMMAND
+depending on how you invoke it.)
 
 =head2 Quoting and Command Limitations
 
@@ -71,24 +74,56 @@ creating the command to send to the remote server.  It may be less
 confusing to get in the habit of quoting the entire command.
 
 Also be aware that the full command is passed via command line arguments,
-which means there is a tight limit on the length of the whole command plus
-arguments.  Expect to have problems if the total command length exceeds
-1000 characters.  For the same reason, binary data including nul
-characters cannot be passed via B<remctl-shell>.  (The regular remctl
-protocol supports arbitrary-length arguments, limited only by server-side
-configuration and available server memory, and supports arbitrary binary
-data in arguments.)
+which means, when invoking B<remctl-shell> as a shell, there is a tight
+limit on the length of the whole command plus arguments.  Expect to have
+problems if the total command length exceeds 1000 characters.  For the
+same reason, binary data including nul characters cannot be passed via
+B<remctl-shell>.  Invoking it as a forced command may work around these
+limitations by putting the command into the environment instead, but there
+may still be restrictions on that.  (The regular remctl protocol supports
+arbitrary-length arguments, limited only by server-side configuration and
+available server memory, and supports arbitrary binary data in arguments.)
 
 =head2 C<authorized_keys> Configuration
 
 B<remctl-shell> is intended for use via ssh using C<authorized_keys> to
 manage authentication.  (If you have Kerberos available, it's generally
 better to use the normal B<remctld> server and native remctl protocol.)
-The C<authorized_keys> configuration must be set up to associate each key
-with an identity by setting the REMCTL_USER environment variable.  Using
-user identities that look like Kerberos principal names is strongly
-recommended, since it may make it easier to use some of the ACL methods
-intended for the normal remctl server.
+
+There are two ways to set up B<remctl-shell>: either by specifying forced
+commands, or by configuring B<remctl-shell> as the shell of the account.
+The forced command approach is recommended, since it doesn't require
+setting a non-default F<sshd_config> option.
+
+=head3 Using forced commands
+
+For the role account that you want to use to run remctl commands
+(C<remctl> by convention), create an F<authorized_keys> file listing
+everyone who should be able to run commands.  Before each key, set the
+C<command> option like the below:
+
+    command="@sbindir@/remctl-shell example@EXAMPLE.ORG"
+
+where the argument to B<remctl-shell> is the identity matching the ssh key
+on that line.  A more complete example of a line in F<authorized_keys>:
+
+    command=="@sbindir@/remctl-shell example@EXAMPLE.ORG",\
+    no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,\
+    no-X11-forwarding ssh-rsa AAAAB3NzaC1yc2EA... \
+    example@some-host.example.org
+
+Backslashes and line breaks were added for clarity.  The actual entry
+should be a single long line.  For more information on the other settings
+here, see L<Examples> below.
+
+=head3 Using a shell
+
+When running B<remctl-shell> as the shell of the account, instead of using
+forced commands, the F<authorized_keys> configuration must be set up to
+associate each key with an identity by setting the REMCTL_USER environment
+variable.  Using user identities that look like Kerberos principal names
+is strongly recommended, since it may make it easier to use some of the
+ACL methods intended for the normal remctl server.
 
 Since this relies on setting environment variables via C<authorized_keys>,
 you unfortunately have to enable C<PermitUserEnvironment> in
@@ -96,10 +131,14 @@ F<sshd_config> (this is not the default) by adding:
 
     PermitUserEnvironment yes
 
+=head3 Other options
+
 B<remctl-shell> will not make use of forwarded connections or agents, and
 will not pass them along to the processes they run, so all such ssh
 options should normally be disabled for defense in depth security.
 
+=head3 Examples
+
 Here is a recommended line in C<authorized_keys> for the account managed
 by B<remctl-shell>, with appropriate restrictions and an example of how to
 set the REMCTL_USER variable.  Backslashes and line breaks were added for
@@ -121,10 +160,12 @@ pair, as used in the ACLs in your remctl configuration.
 
 =head1 OPTIONS
 
-B<remctl-shell> is normally only run with the B<-c> option since it's
-intended for use as a shell.  However, it does support some other options
-for testing, and one can use a small wrapper program as the configured
-shell that passes additional options into B<remctl-shell> if needed.
+B<remctl-shell> is normally only run with either the B<-c> option or with
+a user, since it's intended for use as a shell or forced command.
+However, it does support some other options for testing, which may be
+useful in F<authorized_keys>.  If using it as a shell, one can use a small
+wrapper program as the configured shell that passes additional options
+into B<remctl-shell> if needed.
 
 The start of each option description is annotated with the version of
 B<remctl-shell> in which that option was added with its current meaning.
@@ -138,8 +179,9 @@ B<remctl-shell>.  B<remctl-shell> will then parse it into separate
 arguments using an algorithm similar to that used by a shell.  See the
 above discussion of quoting for more information.
 
-The start of each option description is annotated with the version of
-B<remctl-shell> in which that option was added with its current meaning.
+This is mandatory when using B<remctl-shell> as a shell.  If using it as a
+forced command, pass the user on the command line instead and do not use
+this option.
 
 =item B<-d>
 
@@ -185,11 +227,12 @@ when it is invoked, or it exits with an error and doesn't do anything.
 
 =item REMCTL_USER
 
-The user used for logging and to make authorization decisions.  The
-security of all B<remctl-shell> authorization checks is based on the
-accuracy of this environment variable, so be sure that it is set
-correctly.  The best way to do this is via C<environment> stanzas in
-F<authorized_keys> as described above.
+The user used for logging and to make authorization decisions, unless that
+was passed on the command line.  The security of all B<remctl-shell>
+authorization checks is based on the accuracy of this environment
+variable, so be sure that it is set correctly.  The best way to do this is
+via C<environment> stanzas in F<authorized_keys> as described above.  If
+the user is passed on the command line, this is ignored.
 
 =item SSH_CONNECTION
 
@@ -199,6 +242,11 @@ B<remctl-shell> expects the first space-separated token in this
 environment variable to be the IP address of the client.  It then uses
 that to set REMOTE_ADDR in the environment of any commands it runs.
 
+=item SSH_ORIGINAL_COMMAND
+
+When run as a forced command, the command run by the user is taken from
+this environment variable, which is set by B<sshd>.
+
 =back
 
 The following environment variables will be set for any commands run via
@@ -251,15 +299,20 @@ Note that REMOTE_HOST is not set by B<remctl-shell>, at least currently.
 
 =head1 EXAMPLES
 
-Typically, B<remctl-shell> will be set as the shell for a dedicated user,
-normally C<remctl>, via the normal mechanism for local account creation.
-That account should be configured with an ssh F<authorized_keys> file as
-discussed above.  B<remctl-shell> will then be invoked with:
+Typically, B<remctl-shell> will either be run as a forced command or set
+as the shell for a dedicated user, normally C<remctl>, via the normal
+mechanism for local account creation.  That account should be configured
+with an ssh F<authorized_keys> file as discussed above.  B<remctl-shell>
+will then be invoked with:
 
     remctl-shell -c 'command subcommand argument'
 
-by B<sshd> for each incoming connection from a user that has a key in the
-F<authorized_keys> file.
+(if used as a shell) or with:
+
+    remctl-shell user@EXAMPLE.ORG
+
+(if used as a forced command) by B<sshd> for each incoming connection from
+a user that has a key in the F<authorized_keys> file.
 
 If you need to run a command manually for debugging, you can run the same
 command as above, but it's often more useful to send errors to standard
@@ -269,12 +322,18 @@ error instead of to syslog.  You can do that with:
 
 If you don't want to see the normal command logging, add the B<-q> option
 as well.  You can test an alternate configuration file by specifying it
-with the B<-f> option.
+with the B<-f> option.  You will need to set SSH_CONNECTION and either
+REMCTL_USER (if using B<-c>) or SSH_ORIGINAL_COMMAND (if passing the user
+on the command line).
 
 =head1 COMPATIBILITY
 
 B<remctl-shell> was added in the remctl 3.12 release.
 
+The forced command mode where the user can be passed on the command line
+and the command retrieved from SSH_ORIGINAL_COMMAND was added in the
+remctl 3.13 release.
+
 =head1 CAVEATS
 
 Most of the caveats and differences between B<remctl-shell> and the normal
@@ -302,6 +361,8 @@ implementation during Dropbox's annual Hack Week.
 
 =head1 COPYRIGHT AND LICENSE
 
+Copyright 2016 Russ Allbery <eagle@eyrie.org>
+
 Copyright 2016 Dropbox, Inc.
 
 Copying and distribution of this file, with or without modification, are
diff --git a/docs/remctl.1 b/docs/remctl.1
index 08d882a..bbf8b0b 100644
--- a/docs/remctl.1
+++ b/docs/remctl.1
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTL 1"
-.TH REMCTL 1 "2016-07-29" "3.12" "remctl"
+.TH REMCTL 1 "2016-10-11" "3.13" "remctl"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff --git a/docs/remctld.8.in b/docs/remctld.8.in
index 50374a8..94c0c74 100644
--- a/docs/remctld.8.in
+++ b/docs/remctld.8.in
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
+.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -46,7 +46,7 @@
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" If the F register is >0, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
@@ -54,20 +54,16 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.nr rF 0
-.if \n(.g .if rF .nr rF 1
-.if (\n(rF:(\n(.g==0)) \{
-.    if \nF \{
-.        de IX
-.        tm Index:\\$1\t\\n%\t"\\$2"
+.if !\nF .nr F 0
+.if \nF>0 \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.        if !\nF==2 \{
-.            nr % 0
-.            nr F 2
-.        \}
+.    if !\nF==2 \{\
+.        nr % 0
+.        nr F 2
 .    \}
 .\}
-.rr rF
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
@@ -133,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "REMCTLD 8"
-.TH REMCTLD 8 "2016-07-29" "3.12" "remctl"
+.TH REMCTLD 8 "2016-10-11" "3.13" "remctl"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -411,23 +407,20 @@ Since the argument is passed verbatim to \fBsudo\fR's \fB\-u\fR option, you can
 specify a numeric \s-1UID\s0 by prepending it with \f(CW\*(C`#\*(C'\fR.
 .IP "summary=\fIarg\fR" 4
 .IX Item "summary=arg"
-[3.2] Specifies the argument for this command that will print a usage
+[3.13] Specifies the argument for this command that will print a usage
 summary to standard output.
 .Sp
 If remctld receives the command \f(CW\*(C`help\*(C'\fR with no arguments, and no \f(CW\*(C`help\*(C'\fR
 command is defined in the configuration file, the server will look through
 the configuration for any command with a \f(CW\*(C`summary\*(C'\fR option set.  If this
-option is set, the \fIsubcommand\fR is \f(CW\*(C`ALL\*(C'\fR, and the user is authorized to
-run the command, the server will run the specified \fIexecutable\fR with the
-argument \fIarg\fR, sending the output back to the user.  It will do this for
-every command in the configuration that meets the above criteria.
+option is set, and the user is authorized to run the command, the server
+will run the specified \fIexecutable\fR with the argument \fIarg\fR, sending the
+output back to the user.  It will do this for every command in the
+configuration that meets the above criteria.
 .Sp
 This allows display of a summary of available commands to the user based
 on which commands that user is authorized to run.  It's a lightweight form
 of service discovery.  Also see the \f(CW\*(C`help\*(C'\fR option.
-.Sp
-As mentioned above, this option is only meaningful on configuration lines
-with a \fIsubcommand\fR of \f(CW\*(C`ALL\*(C'\fR.
 .IP "user=(\fIusername\fR | \fIuid\fR)" 4
 .IX Item "user=(username | uid)"
 [3.1] Run this command as the specified user, which can be given as either
diff --git a/docs/remctld.pod b/docs/remctld.pod
index 5d7fcfa..b58e269 100644
--- a/docs/remctld.pod
+++ b/docs/remctld.pod
@@ -307,24 +307,21 @@ specify a numeric UID by prepending it with C<#>.
 
 =item summary=I<arg>
 
-[3.2] Specifies the argument for this command that will print a usage
+[3.13] Specifies the argument for this command that will print a usage
 summary to standard output.
 
 If remctld receives the command C<help> with no arguments, and no C<help>
 command is defined in the configuration file, the server will look through
 the configuration for any command with a C<summary> option set.  If this
-option is set, the I<subcommand> is C<ALL>, and the user is authorized to
-run the command, the server will run the specified I<executable> with the
-argument I<arg>, sending the output back to the user.  It will do this for
-every command in the configuration that meets the above criteria.
+option is set, and the user is authorized to run the command, the server
+will run the specified I<executable> with the argument I<arg>, sending the
+output back to the user.  It will do this for every command in the
+configuration that meets the above criteria.
 
 This allows display of a summary of available commands to the user based
 on which commands that user is authorized to run.  It's a lightweight form
 of service discovery.  Also see the C<help> option.
 
-As mentioned above, this option is only meaningful on configuration lines
-with a I<subcommand> of C<ALL>.
-
 =item user=(I<username> | I<uid>)
 
 [3.1] Run this command as the specified user, which can be given as either