265 lines
9.3 KiB
HTML
265 lines
9.3 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of HOSTS_OPTIONS</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>HOSTS_OPTIONS</H1>
|
|
Section: File Formats (5)<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
hosts_options - host access control language extensions
|
|
<A NAME="lbAC"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
This document describes extensions to the language described
|
|
in the <A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5) document.
|
|
<P>
|
|
|
|
The extensible language uses the following format:
|
|
<P>
|
|
<BR>
|
|
|
|
daemon_list : client_list : option : option ...
|
|
<P>
|
|
|
|
The first two fields are described in the <A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5) manual page.
|
|
The remainder of the rules is a list of zero or more options. Any ":"
|
|
characters within options should be protected with a backslash.
|
|
<P>
|
|
|
|
An option is of the form "keyword" or "keyword value". Options are
|
|
processed in the specified order. Some options are subjected to
|
|
%<letter> substitutions. For the sake of backwards compatibility with
|
|
earlier versions, an "=" is permitted between keyword and value.
|
|
<A NAME="lbAD"> </A>
|
|
<H2>LOGGING</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="1">severity mail.info<DD>
|
|
<DT id="2">severity notice<DD>
|
|
Change the severity level at which the event will be logged. Facility
|
|
names (such as mail) are optional, and are not supported on systems
|
|
with older syslog implementations. The severity option can be used
|
|
to emphasize or to ignore specific events.
|
|
</DL>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>ACCESS CONTROL</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="3">allow<DD>
|
|
<DT id="4">deny<DD>
|
|
Grant (deny) service. These options must appear at the end of a rule.
|
|
</DL>
|
|
<P>
|
|
|
|
The <I>allow</I> and <I>deny</I> keywords make it possible to keep all
|
|
access control rules within a single file, for example in the
|
|
<I>hosts.allow</I> file.
|
|
<P>
|
|
To permit access from specific hosts only:
|
|
<P>
|
|
|
|
<BR>
|
|
|
|
ALL: .friendly.domain: ALLOW
|
|
<BR>
|
|
|
|
ALL: ALL: DENY
|
|
<P>
|
|
To permit access from all hosts except a few trouble makers:
|
|
<P>
|
|
|
|
<BR>
|
|
|
|
ALL: .bad.domain: DENY
|
|
<BR>
|
|
|
|
ALL: ALL: ALLOW
|
|
<P>
|
|
Notice the leading dot on the domain name patterns.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>RUNNING OTHER COMMANDS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="5">aclexec shell_command<DD>
|
|
Execute, in a child process, the specified shell command, after
|
|
performing the %<letter> expansions described in the <A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5)
|
|
manual page. The command is executed with stdin, stdout and stderr
|
|
connected to the null device, so that it won't mess up the
|
|
conversation with the client host. Example:
|
|
<P>
|
|
<PRE>
|
|
<BR>
|
|
smtp : ALL : aclexec checkdnsbl %a
|
|
</PRE>
|
|
|
|
<P>
|
|
executes, in a background child process, the shell command "checkdnsbl %a"
|
|
after replacing %a by the address of the remote host.
|
|
<P>
|
|
The connection will be allowed or refused depending on whether the
|
|
command returns a true or false exit status.
|
|
<DT id="6">spawn shell_command<DD>
|
|
Execute, in a child process, the specified shell command, after
|
|
performing the %<letter> expansions described in the <A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5)
|
|
manual page. The command is executed with stdin, stdout and stderr
|
|
connected to the null device, so that it won't mess up the
|
|
conversation with the client host. Example:
|
|
<P>
|
|
<PRE>
|
|
<BR>
|
|
spawn (/usr/sbin/safe_finger -l @%h | /usr/bin/mail root) &
|
|
</PRE>
|
|
|
|
<P>
|
|
executes, in a background child process, the shell command "safe_finger
|
|
-l @%h | mail root" after replacing %h by the name or address of the
|
|
remote host.
|
|
<P>
|
|
The example uses the "safe_finger" command instead of the regular
|
|
"finger" command, to limit possible damage from data sent by the finger
|
|
server. The "safe_finger" command is part of the daemon wrapper
|
|
package; it is a wrapper around the regular finger command that filters
|
|
the data sent by the remote host.
|
|
<DT id="7">twist shell_command<DD>
|
|
Replace the current process by an instance of the specified shell
|
|
command, after performing the %<letter> expansions described in the
|
|
<A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5) manual page. Stdin, stdout and stderr are connected to
|
|
the client process. This option must appear at the end of a rule.
|
|
<P>
|
|
To send a customized bounce message to the client instead of
|
|
running the real ftp daemon:
|
|
<P>
|
|
<PRE>
|
|
<BR>
|
|
in.ftpd : ... : twist /bin/echo 421 Some bounce message
|
|
</PRE>
|
|
|
|
<P>
|
|
For an alternative way to talk to client processes, see the
|
|
<I>banners</I> option below.
|
|
<P>
|
|
To run /some/other/in.telnetd without polluting its command-line
|
|
array or its process environment:
|
|
<P>
|
|
<PRE>
|
|
<BR>
|
|
in.telnetd : ... : twist PATH=/some/other; exec in.telnetd
|
|
</PRE>
|
|
|
|
<P>
|
|
Warning: in case of UDP services, do not twist to commands that use
|
|
the standard I/O or the <A HREF="/cgi-bin/man/man2html?2+read">read</A>(2)/<A HREF="/cgi-bin/man/man2html?2+write">write</A>(2) routines to communicate with
|
|
the client process; UDP requires other I/O primitives.
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>NETWORK OPTIONS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="8">keepalive<DD>
|
|
Causes the server to periodically send a message to the client. The
|
|
connection is considered broken when the client does not respond. The
|
|
keepalive option can be useful when users turn off their machine while
|
|
it is still connected to a server. The keepalive option is not useful
|
|
for datagram (UDP) services.
|
|
<DT id="9">linger number_of_seconds<DD>
|
|
Specifies how long the kernel will try to deliver not-yet delivered
|
|
data after the server process closes a connection.
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>USERNAME LOOKUP</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="10">rfc931 [ timeout_in_seconds ]<DD>
|
|
Look up the client user name with the RFC 931 (TAP, IDENT, RFC 1413)
|
|
protocol. This option is silently ignored in case of services based on
|
|
transports other than TCP. It requires that the client system runs an
|
|
RFC 931 (IDENT, etc.) -compliant daemon, and may cause noticeable
|
|
delays with connections from non-UNIX clients. The timeout period is
|
|
optional. If no timeout is specified a compile-time defined default
|
|
value is taken.
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H2>MISCELLANEOUS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="11">banners /some/directory<DD>
|
|
Look for a file in `/some/directory' with the same name as the daemon
|
|
process (for example in.telnetd for the telnet service), and copy its
|
|
contents to the client. Newline characters are replaced by
|
|
carriage-return newline, and %<letter> sequences are expanded (see
|
|
the <A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5) manual page).
|
|
<P>
|
|
The tcp wrappers source code distribution provides a sample makefile
|
|
(Banners.Makefile) for convenient banner maintenance.
|
|
<P>
|
|
Warning: banners are supported for connection-oriented (TCP) network
|
|
services only.
|
|
<DT id="12">nice [ number ]<DD>
|
|
Change the nice value of the process (default 10). Specify a positive
|
|
value to spend more CPU resources on other processes.
|
|
<DT id="13">setenv name value<DD>
|
|
Place a (name, value) pair into the process environment. The value is
|
|
subjected to %<letter> expansions and may contain whitespace (but
|
|
leading and trailing blanks are stripped off).
|
|
<P>
|
|
Warning: many network daemons reset their environment before spawning a
|
|
login or shell process.
|
|
<DT id="14">umask 022<DD>
|
|
Like the umask command that is built into the shell. An umask of 022
|
|
prevents the creation of files with group and world write permission.
|
|
The umask argument should be an octal number.
|
|
<DT id="15">user nobody<DD>
|
|
<DT id="16">user nobody.kmem<DD>
|
|
Assume the privileges of the "nobody" userid (or user "nobody", group
|
|
"kmem"). The first form is useful with inetd implementations that run
|
|
all services with root privilege. The second form is useful for
|
|
services that need special group privileges only.
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>DIAGNOSTICS</H2>
|
|
|
|
When a syntax error is found in an access control rule, the error
|
|
is reported to the syslog daemon; further options will be ignored,
|
|
and service is denied.
|
|
<A NAME="lbAK"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?5+hosts_access">hosts_access</A>(5), the default access control language
|
|
<A NAME="lbAL"> </A>
|
|
<H2>AUTHOR</H2>
|
|
|
|
|
|
<PRE>
|
|
Wietse Venema (<A HREF="mailto:wietse@wzv.win.tue.nl">wietse@wzv.win.tue.nl</A>)
|
|
Department of Mathematics and Computing Science
|
|
Eindhoven University of Technology
|
|
Den Dolech 2, P.O. Box 513,
|
|
5600 MB Eindhoven, The Netherlands
|
|
|
|
</PRE>
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="17"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="18"><A HREF="#lbAC">DESCRIPTION</A><DD>
|
|
<DT id="19"><A HREF="#lbAD">LOGGING</A><DD>
|
|
<DT id="20"><A HREF="#lbAE">ACCESS CONTROL</A><DD>
|
|
<DT id="21"><A HREF="#lbAF">RUNNING OTHER COMMANDS</A><DD>
|
|
<DT id="22"><A HREF="#lbAG">NETWORK OPTIONS</A><DD>
|
|
<DT id="23"><A HREF="#lbAH">USERNAME LOOKUP</A><DD>
|
|
<DT id="24"><A HREF="#lbAI">MISCELLANEOUS</A><DD>
|
|
<DT id="25"><A HREF="#lbAJ">DIAGNOSTICS</A><DD>
|
|
<DT id="26"><A HREF="#lbAK">SEE ALSO</A><DD>
|
|
<DT id="27"><A HREF="#lbAL">AUTHOR</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:03 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|