---
name: "bgplgsh"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/bgplgsh"
---

# bgplgsh(8)

looking glass shell for the OpenBSD Border Gateway Protocol daemon

## NAME

**bgplgsh** – looking glass shell for the OpenBSD Border Gateway Protocol daemon

## SYNOPSIS

**bgplgsh**

## DESCRIPTION

The **bgplgsh** program is a looking glass shell for the [bgpd(8)](/bgpd/8.md) Border Gateway Protocol daemon. The looking glass will provide a simple command line interface with read-only access to a restricted set of [bgpd(8)](/bgpd/8.md) and system status information, which is typically used on route servers by Internet Service Providers (ISPs) and Internet eXchange points (IXs).

It requires three steps to enable the looking glass shell:

1. Add **bgplgsh** as a valid login shell. See [shells(5)](/shells/5.md) for more information.

   ```
   # echo /usr/bin/bgplgsh  /etc/shells
   ```

2. Create a new user for restricted looking glass access. See [adduser(8)](/adduser/8.md) for more information about system user management.

   ```
   # adduser -shell bgplgsh -batch bgplg
   # passwd bgplg
   ```

3. Start the Border Gateway Protocol daemon with a second, restricted, control socket. See [bgpd.conf(5)](/bgpd.conf/5.md) and [bgplg(8)](/bgplg/8.md) for more information.

   For example, add the following to */etc/bgpd.conf* to have [bgpd(8)](/bgpd/8.md) open a second, restricted, control socket:

   ```
   socket "/var/www/run/bgpd.rsock" restricted
   ```

## FILES

- */var/www/run/bgpd.rsock*

  Position of the second, restricted, control socket of [bgpd(8)](/bgpd/8.md).

## SEE ALSO

[bgpd(8)](/bgpd/8.md), [bgplg(8)](/bgplg/8.md)

## HISTORY

The **bgplgsh** program first appeared in OpenBSD 4.1. The initial implementation was done in 2005 for DE-CIX, the German commercial internet exchange point.

## AUTHORS

The **bgplgsh** program was written by Reyk Floeter ⟨*reyk@openbsd.org*⟩.

## CAVEATS

To prevent commands from running endlessly, **bgplgsh** will kill the corresponding processes after a hard limit of 60 seconds. For example, this can take effect when using [traceroute(8)](/traceroute/8.md) with blackholed or bad routes.