1saned(8) SANE Scanner Access Now Easy saned(8)
2
6 saned - SANE network daemon
7
9 saned [ -a [ username ] | -d [ n ] | -s [ n ] | -h ]
10
12 saned is the SANE (Scanner Access Now Easy) daemon that allows remote
13 clients to access image acquisition devices available on the local
14 host.
15
17 The -a flag requests that saned run in standalone daemon mode. In this
18 mode, saned will detach from the console and run in the background,
19 listening for incoming client connections; inetd is not required for
20 saned operations in this mode. If the optional username is given after
21 -a , saned will drop root privileges and run as this user (and group).
22 The -d and -s flags request that saned run in debug mode (as opposed to
24 inetd(8) daemon mode). In this mode, saned explicitly waits for a con‐
25 nection request. When compiled with debugging enabled, these flags may
26 be followed by a number to request debug info. The larger the number,
27 the more verbose the debug output. E.g., -d128 will request printing
28 of all debug info. Debug level 0 means no debug output at all. The
29 default value is 2. If flag -d is used, the debug messages will be
30 printed to stderr while -s requests using syslog.
31 If saned is run from inetd, xinetd or systemd, no option can be given.
33 The -h flag displays a short help message.
35
37 First and foremost: saned is not intended to be exposed to the internet
38 or other non-trusted networks. Make sure that access is limited by tcp‐
39 wrappers and/or a firewall setup. Don't depend only on saned's own
40 authentication. Don't run saned as root if it's not necessary. And do
41 not install saned as setuid root.
42 The saned.conf configuration file contains both options for the daemon
44 and the access list.
45 data_portrange = min_port - max_port
47 Specify the port range to use for the data connection. Pick a
48 port range between 1024 and 65535; don't pick a too large port
49 range, as it may have performance issues. Use this option if
50 your saned server is sitting behind a firewall. If that firewall
51 is a Linux machine, we strongly recommend using the Netfilter
52 nf_conntrack_sane module instead.
53 The access list is a list of host names, IP addresses or IP subnets
55 (CIDR notation) that are permitted to use local SANE devices. IPv6
56 addresses must be enclosed in brackets, and should always be specified
57 in their compressed form. Connections from localhost are always permit‐
58 ted. Empty lines and lines starting with a hash mark (#) are ignored. A
59 line containing the single character ``+'' is interpreted to match any
60 hostname. This allows any remote machine to use your scanner and may
61 present a security risk, so this shouldn't be used unless you know what
62 you're doing.
63 A sample configuration file is shown below:
65 # Daemon options
67 data_portrange = 10000 - 10100
68 # Access list
69 scan-client.somedomain.firm
70 # this is a comment
71 192.168.0.1
72 192.168.2.12/29
73 [::1]
74 [2001:db8:185e::42:12]/64
75 The case of the host names does not matter, so AHost.COM is considered
77 identical to ahost.com.
78
80 For saned to work properly in its default mode of operation, it is also
81 necessary to add the appropriate configuration for (x)inetd or systemd.
82 (see below). Note that your inetd must support IPv6 if you want to
83 connect to saned over IPv6 ; xinetd, openbsd-inetd and systemd are
84 known to support IPv6, check the documentation for your inetd daemon.
85 In the sections below the configuration for inetd, xinetd and systemd
87 are described in more detail.
88 For the configurations below it is necessary to add a line of the fol‐
90 lowing form to /etc/services:
91 sane-port 6566/tcp # SANE network scanner daemon
93 The official IANA short name for port 6566 is "sane-port". The older
95 name "sane" is now deprecated.
96
98 It is required to add a single line to the inetd configuration file
99 (/etc/inetd.conf)
100 The configuration line normally looks like this:
102 sane-port stream tcp nowait saned.saned /usr/sbin/saned saned
104 However, if your system uses tcpd(8) for additional security
106 screening, you may want to disable saned access control by
107 putting ``+'' in saned.conf and use a line of the following form
108 in /etc/inetd.conf instead:
109 sane-port stream tcp nowait saned.saned /usr/sbin/tcpd
111 /usr/sbin/saned
112 Note that both examples assume that there is a saned group and a
114 saned user. If you follow this example, please make sure that
115 the access permissions on the special device are set such that
116 saned can access the scanner (the program generally needs read
117 and write access to scanner devices).
118
120 If xinetd is installed on your system instead of inetd the following
121 example for /etc/xinetd.conf may be helpful:
122 # default: off
124 # description: The sane server accepts requests
125 # for network access to a local scanner via the
126 # network.
127 service sane-port
128 {
129 port = 6566
130 socket_type = stream
131 wait = no
132 user = saned
133 group = saned
134 server = /usr/sbin/saned
135 }
136
138 for systemd we need to add 2 configuation files in /etc/systemd/system.
139 The first file we need to add here is called saned.socket. It shall
141 have the following contents:
142 [Unit]
144 Description=saned incoming socket
145 [Socket]
147 ListenStream=6566
148 Accept=yes
149 MaxConnections=1
150 [Install]
152 WantedBy=sockets.target
153 The second file to be added is saned@.service with the following con‐
155 tents:
156 [Unit]
158 Description=Scanner Service
159 Requires=saned.socket
160 [Service]
162 ExecStart=/usr/sbin/saned
163 User=saned
164 Group=saned
165 StandardInput=null
166 StandardOutput=syslog
167 StandardError=syslog
168 # Environment=SANE_CONFIG_DIR=/etc/sane.d SANE_DEBUG_DLL=255
169 Is you need to set an environment variable for saned like SANE_CON‐
171 FIG_DIR you will have to remove the # on the last line and set the
172 variable appropriately. Multiple variables can be set by separating
173 the assignments by spaces as shown in the example above.
174 Unlike (x)inetd systemd allows debugging output from backends set using
176 SANE_DEBUG_<backend_name> to be captured. With the service unit as
177 described above, the debugging output is forwarded to the system log.
178 After creating unit files run as root:
180 systemctl start saned.socket
182 to start saned. If you want to have saned.socket running after startup,
184 run as root:
185 systemctl enable saned.socket
187
189 /etc/hosts.equiv
190 The hosts listed in this file are permitted to access all local
191 SANE devices. Caveat: this file imposes serious security risks
192 and its use is not recommended.
193 /etc/sane.d/saned.conf
195 Contains a list of hosts permitted to access local SANE devices
196 (see also description of SANE_CONFIG_DIR below).
197 /etc/sane.d/saned.users
199 If this file contains lines of the form
200 user:password:backend
202 access to the listed backends is restricted. A backend may be
204 listed multiple times for different user/password combinations.
205 The server uses MD5 hashing if supported by the client.
206
208 SANE_CONFIG_DIR
209 This environment variable specifies the list of directories that
210 may contain the configuration file. Under UNIX, the directories
211 are separated by a colon (`:'), under OS/2, they are separated
212 by a semi-colon (`;'). If this variable is not set, the config‐
213 uration file is searched in two default directories: first, the
214 current working directory (".") and then in /etc/sane.d. If the
215 value of the environment variable ends with the directory sepa‐
216 rator character, then the default directories are searched after
217 the explicitly specified directories. For example, setting
218 SANE_CONFIG_DIR to "/tmp/config:" would result in directories
219 "tmp/config", ".", and "/etc/sane.d" being searched (in this
220 order).
221
224 sane(7), scanimage(1), xscanimage(1), xcam(1), sane-dll(5),
225 sane-net(5), sane-"backendname"[22m(5)
226 http://www.penguin-breeder.org/?page=sane-net
227
229 David Mosberger
230 20 Apr 2009 saned(8)