View Source: hosts_options(5) - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
HOSTS_OPTIONS
!!!HOSTS_OPTIONS
NAME
DESCRIPTION
LOGGING
ACCESS CONTROL
RUNNING OTHER COMMANDS
NETWORK OPTIONS
USERNAME LOOKUP
MISCELLANEOUS
DIAGNOSTICS
SEE ALSO
AUTHOR
----
!!NAME


hosts_options - host access control language extensions
!!DESCRIPTION


This document describes optional extensions to the language
described in the hosts_access(5) document. The extensions
are enabled at program build time. For example, by editing
the Makefile and turning on the PROCESS_OPTIONS compile-time
option.


The extensible language uses the following
format:


daemon_list : client_list : option : option ...


The first two fields are described in the hosts_access(5)
manual page. The remainder of the rules is a list of zero or
more options. Any


An option is of the form
!!LOGGING


severity mail.info


severity notice


Change the severity level at which the event will be logged.
Facility names (such as mail) are optional, and are not
supported on systems with older syslog implementations. The
severity option can be used to emphasize or to ignore
specific events.
!!ACCESS CONTROL


allow


deny


Grant (deny) service. These options must appear at the end
of a rule.


The ''allow'' and ''deny'' keywords make it possible
to keep all access control rules within a single file, for
example in the ''hosts.allow'' file.


To permit access from specific hosts only:


ALL: .friendly.domain: ALLOW ALL: ALL: DENY


To permit access from all hosts except a few trouble
makers:


ALL: .bad.domain: DENY ALL: ALL: ALLOW


Notice the leading dot on the domain name
patterns.
!!RUNNING OTHER COMMANDS


spawn shell_command


Execute, in a child process, the specified shell command,
after performing the %


spawn (/usr/sbin/safe_finger -l @%h | /usr/bin/mail root)
executes, in a background child process, the shell command


The example uses the


twist shell_command


Replace the current process by an instance of the specified
shell command, after performing the %


To send a customized bounce message to the client instead of
running the real ftp daemon:


in.ftpd : ... : twist /bin/echo 421 Some bounce message
For an alternative way to talk to client processes, see the ''banners'' option below.


To run /some/other/in.telnetd without polluting its
command-line array or its process environment:


in.telnetd : ... : twist PATH=/some/other; exec in.telnetd
Warning: in case of UDP services, do not twist to commands that use the standard I/O or the read(2)/write(2) routines to communicate with the client process; UDP requires other I/O primitives.
!!NETWORK OPTIONS


keepalive


Causes the server to periodically send a message to the
client. The connection is considered broken when the client
does not respond. The keepalive option can be useful when
users turn off their machine while it is still connected to
a server. The keepalive option is not useful for datagram
(UDP) services.


linger number_of_seconds


Specifies how long the kernel will try to deliver not-yet
delivered data after the server process closes a
connection.
!!USERNAME LOOKUP


rfc931 [[ timeout_in_seconds ]


Look up the client user name with the RFC 931 (TAP, IDENT,
RFC 1413) protocol. This option is silently ignored in case
of services based on transports other than TCP. It requires
that the client system runs an RFC 931 (IDENT, etc.)
-compliant daemon, and may cause noticeable delays with
connections from non-UNIX clients. The timeout period is
optional. If no timeout is specified a compile-time defined
default value is taken.
!!MISCELLANEOUS


banners /some/directory


Look for a file in `/some/directory' with the same name as
the daemon process (for example in.telnetd for the telnet
service), and copy its contents to the client. Newline
characters are replaced by carriage-return newline, and
%


The tcp wrappers source code distribution provides a sample
makefile (Banners.Makefile) for convenient banner
maintenance.


Warning: banners are supported for connection-oriented (TCP)
network services only.


nice [[ number ]


Change the nice value of the process (default 10). Specify a
positive value to spend more CPU resources on other
processes.


setenv name value


Place a (name, value) pair into the process environment. The
value is subjected to %


Warning: many network daemons reset their environment before
spawning a login or shell process.


umask 022


Like the umask command that is built into the shell. An
umask of 022 prevents the creation of files with group and
world write permission. The umask argument should be an
octal number.


user nobody


user nobody.kmem


Assume the privileges of the
!!DIAGNOSTICS


When a syntax error is found in an access control rule, the
error is reported to the syslog daemon; further options will
be ignored, and service is denied.
!!SEE ALSO


hosts_access(5), the default access control
language
!!AUTHOR


Wietse Venema (wietse@wzv.win.tue.nl)
Department of Mathematics and Computing Science
Eindhoven University of Technology
Den Dolech 2, P.O. Box 513,
5600 MB Eindhoven, The Netherlands
----
9 pages link to hosts_options(5):
This page is a man page (or other imported legacy content). We are unable to automatically determine the license status of this page.
Last edited on Monday, June 3, 2002 6:55:57 pm by "perry"
Edit PageHistory Diff Info LikePages