1HOSTS_OPTIONS(5) File Formats Manual HOSTS_OPTIONS(5)
2
6 hosts_options - host access control language extensions
7
9 This document describes optional extensions to the language described
10 in the hosts_access(5) document. The extensions are enabled at program
11 build time. For example, by editing the Makefile and turning on the
12 PROCESS_OPTIONS compile-time option.
13 The extensible language uses the following format:
15 daemon_list : client_list : option : option ...
17 The first two fields are described in the hosts_access(5) manual page.
19 The remainder of the rules is a list of zero or more options. Any ":"
20 characters within options should be protected with a backslash.
21 An option is of the form "keyword" or "keyword value". Options are pro‐
23 cessed in the specified order. Some options are subjected to %<letter>
24 substitutions. For the sake of backwards compatibility with earlier
25 versions, an "=" is permitted between keyword and value.
26
28 severity mail.info
29 severity notice
31 Change the severity level at which the event will be logged.
32 Facility names (such as mail) are optional, and are not sup‐
33 ported on systems with older syslog implementations. The sever‐
34 ity option can be used to emphasize or to ignore specific
35 events.
36
38 allow
39 deny Grant (deny) service. These options must appear at the end of a
41 rule.
42 The allow and deny keywords make it possible to keep all access control
44 rules within a single file, for example in the hosts.allow file.
45 To permit access from specific hosts only:
47 ALL: .friendly.domain: ALLOW
49 ALL: ALL: DENY
50 To permit access from all hosts except a few trouble makers:
52 ALL: .bad.domain: DENY
54 ALL: ALL: ALLOW
55 Notice the leading dot on the domain name patterns.
57
59 spawn shell_command
60 Execute, in a child process, the specified shell command, after
61 performing the %<letter> expansions described in the
62 hosts_access(5) manual page. The command is executed with
63 stdin, stdout and stderr connected to the null device, so that
64 it won´t mess up the conversation with the client host. Example:
65 spawn (/some/where/safe_finger -l @%h | /usr/ucb/mail root) &
67 executes, in a background child process, the shell command
69 "safe_finger -l @%h | mail root" after replacing %h by the name
70 or address of the remote host.
71 The example uses the "safe_finger" command instead of the regu‐
73 lar "finger" command, to limit possible damage from data sent by
74 the finger server. The "safe_finger" command is part of the dae‐
75 mon wrapper package; it is a wrapper around the regular finger
76 command that filters the data sent by the remote host.
77 twist shell_command
79 Replace the current process by an instance of the specified
80 shell command, after performing the %<letter> expansions
81 described in the hosts_access(5) manual page. Stdin, stdout and
82 stderr are connected to the client process. This option must
83 appear at the end of a rule.
84 To send a customized bounce message to the client instead of
86 running the real ftp daemon:
87 in.ftpd : ... : twist /bin/echo 421 Some bounce message
89 For an alternative way to talk to client processes, see the ban‐
91 ners option below.
92 To run /some/other/in.telnetd without polluting its command-line
94 array or its process environment:
95 in.telnetd : ... : twist PATH=/some/other; exec in.telnetd
97 Warning: in case of UDP services, do not twist to commands that
99 use the standard I/O or the read(2)/write(2) routines to commu‐
100 nicate with the client process; UDP requires other I/O primi‐
101 tives.
102
104 keepalive
105 Causes the server to periodically send a message to the client.
106 The connection is considered broken when the client does not
107 respond. The keepalive option can be useful when users turn off
108 their machine while it is still connected to a server. The
109 keepalive option is not useful for datagram (UDP) services.
110 linger number_of_seconds
112 Specifies how long the kernel will try to deliver not-yet deliv‐
113 ered data after the server process closes a connection.
114
116 rfc931 [ timeout_in_seconds ]
117 Look up the client user name with the RFC 931 (TAP, IDENT, RFC
118 1413) protocol. This option is silently ignored in case of ser‐
119 vices based on transports other than TCP. It requires that the
120 client system runs an RFC 931 (IDENT, etc.) -compliant daemon,
121 and may cause noticeable delays with connections from non-UNIX
122 clients. The timeout period is optional. If no timeout is spec‐
123 ified a compile-time defined default value is taken.
124
126 banners /some/directory
127 Look for a file in `/some/directory' with the same name as the
128 daemon process (for example in.telnetd for the telnet service),
129 and copy its contents to the client. Newline characters are
130 replaced by carriage-return newline, and %<letter> sequences are
131 expanded (see the hosts_access(5) manual page).
132 The tcp wrappers source code distribution provides a sample
134 makefile (Banners.Makefile) for convenient banner maintenance.
135 Warning: banners are supported for connection-oriented (TCP)
137 network services only.
138 nice [ number ]
140 Change the nice value of the process (default 10). Specify a
141 positive value to spend more CPU resources on other processes.
142 setenv name value
144 Place a (name, value) pair into the process environment. The
145 value is subjected to %<letter> expansions and may contain
146 whitespace (but leading and trailing blanks are stripped off).
147 Warning: many network daemons reset their environment before
149 spawning a login or shell process.
150 umask 022
152 Like the umask command that is built into the shell. An umask of
153 022 prevents the creation of files with group and world write
154 permission. The umask argument should be an octal number.
155 user nobody
157 user nobody.kmem
159 Assume the privileges of the "nobody" userid (or user "nobody",
160 group "kmem"). The first form is useful with inetd implementa‐
161 tions that run all services with root privilege. The second form
162 is useful for services that need special group privileges only.
163
165 When a syntax error is found in an access control rule, the error is
166 reported to the syslog daemon; further options will be ignored, and
167 service is denied.
168
170 hosts_access(5), the default access control language
171
173 Wietse Venema (wietse@wzv.win.tue.nl)
174 Department of Mathematics and Computing Science
175 Eindhoven University of Technology
176 Den Dolech 2, P.O. Box 513,
177 5600 MB Eindhoven, The Netherlands
178 HOSTS_OPTIONS(5)