1saned(8) SANE Scanner Access Now Easy saned(8)
2
6 saned - SANE network daemon
7
9 saned [ -a [ username ] | -d [ n ] | -s [ n ] | -h ]
10
12 saned is the SANE (Scanner Access Now Easy) daemon that allows remote
13 clients to access image acquisition devices available on the local
14 host.
15
17 The -a flag requests that saned run in standalone daemon mode. In this
18 mode, saned will detach from the console and run in the background,
19 listening for incoming client connections; inetd is not required for
20 saned operations in this mode. If the optional username is given after
21 -a , saned will drop root privileges and run as this user (and group).
22 The -d and -s flags request that saned run in debug mode (as opposed to
24 inetd(8) daemon mode). In this mode, saned explicitly waits for a con‐
25 nection request. When compiled with debugging enabled, these flags may
26 be followed by a number to request debug info. The larger the number,
27 the more verbose the debug output. E.g., -d128 will request printing
28 of all debug info. Debug level 0 means no debug output at all. The
29 default value is 2. If flag -d is used, the debug messages will be
30 printed to stderr while -s requests using syslog.
31 If saned is run from inetd, xinetd or systemd, no option can be given.
33 The -h flag displays a short help message.
35
37 First and foremost: saned is not intended to be exposed to the internet
38 or other non-trusted networks. Make sure that access is limited by tcp‐
39 wrappers and/or a firewall setup. Don't depend only on saned's own
40 authentication. Don't run saned as root if it's not necessary. And do
41 not install saned as setuid root.
42 The saned.conf configuration file contains both options for the daemon
44 and the access list.
45 data_portrange = min_port - max_port
47 Specify the port range to use for the data connection. Pick a
48 port range between 1024 and 65535; don't pick a too large port
49 range, as it may have performance issues. Use this option if
50 your saned server is sitting behind a firewall. If that firewall
51 is a Linux machine, we strongly recommend using the Netfilter
52 nf_conntrack_sane module instead.
53 The access list is a list of host names, IP addresses or IP subnets
55 (CIDR notation) that are permitted to use local SANE devices. IPv6
56 addresses must be enclosed in brackets, and should always be specified
57 in their compressed form. Connections from localhost are always permit‐
58 ted. Empty lines and lines starting with a hash mark (#) are ignored. A
59 line containing the single character ``+'' is interpreted to match any
60 hostname. This allows any remote machine to use your scanner and may
61 present a security risk, so this shouldn't be used unless you know what
62 you're doing.
63 A sample configuration file is shown below:
65 # Daemon options
67 data_portrange = 10000 - 10100
68 # Access list
69 scan-client.somedomain.firm
70 # this is a comment
71 192.168.0.1
72 192.168.2.12/29
73 [::1]
74 [2001:db8:185e::42:12]/64
75 The case of the host names does not matter, so AHost.COM is considered
77 identical to ahost.com.
78
80 For saned to work properly in its default mode of operation, it is also
81 necessary to add the appropriate configuration for (x)inetd or systemd.
82 (see below). Note that your inetd must support IPv6 if you want to
83 connect to saned over IPv6 ; xinetd, openbsd-inetd and systemd are
84 known to support IPv6, check the documentation for your inetd daemon.
85 In the sections below the configuration for inetd, xinetd and systemd
87 are described in more detail.
88 For the configurations below it is necessary to add a line of the fol‐
90 lowing form to /etc/services:
91 sane-port 6566/tcp # SANE network scanner daemon
93 The official IANA short name for port 6566 is "sane-port". The older
95 name "sane" is now deprecated.
96
98 It is required to add a single line to the inetd configuration file
99 (/etc/inetd.conf)
100 The configuration line normally looks like this:
102 sane-port stream tcp nowait saned.saned /usr/sbin/saned saned
104 However, if your system uses tcpd(8) for additional security screening,
106 you may want to disable saned access control by putting ``+'' in
107 saned.conf and use a line of the following form in /etc/inetd.conf
108 instead:
109 sane-port stream tcp nowait saned.saned /usr/sbin/tcpd
111 /usr/sbin/saned
112 Note that both examples assume that there is a saned group and a saned
114 user. If you follow this example, please make sure that the access
115 permissions on the special device are set such that saned can access
116 the scanner (the program generally needs read and write access to scan‐
117 ner devices).
118
120 If xinetd is installed on your system instead of inetd the following
121 example for /etc/xinetd.conf may be helpful:
122 # default: off
124 # description: The sane server accepts requests
125 # for network access to a local scanner via the
126 # network.
127 service sane-port
128 {
129 port = 6566
130 socket_type = stream
131 wait = no
132 user = saned
133 group = saned
134 server = /usr/sbin/saned
135 }
136
138 Saned can be compiled with explicit systemd support. This will allow
139 logging debugging information to be forwarded to the systemd journal.
140 The systemd support requires compilation with the systemd-devel package
141 installed on the system. this is the preferred option.
142 Saned can be used wih systemd without the systemd integration compiled
144 in, but then logging of debug information is not supported.
145 The systemd configuration is different for the 2 options, but you need
147 to create unit files in both options and then run as root:
148 systemctl start saned.socket
150 to start saned. If you want to have saned.socket running after startup,
152 run as root:
153 systemctl enable saned.socket
155 The systemd configuration of both options is described below.
157
159 for the systemd configuration we need to add 2 configuration files in
160 /etc/systemd/system.
161 The first file we need to add here is called saned.socket. It shall
163 have the following contents:
164 [Unit]
166 Description=saned incoming socket
167 [Socket]
169 ListenStream=6566
170 Accept=yes
171 MaxConnections=1
172 [Install]
174 WantedBy=sockets.target
175 The second file to be added is saned@.service with the following con‐
177 tents:
178 [Unit]
180 Description=Scanner Service
181 Requires=saned.socket
182 [Service]
184 ExecStart=/usr/sbin/saned
185 User=saned
186 Group=saned
187 StandardInput=null
188 StandardOutput=syslog
189 StandardError=syslog
190 Environment=SANE_CONFIG_DIR=/etc/sane.d
191 # If you need to debug your configuration uncomment the next line and
192 # change it as appropriate to set the desired debug options
193 # Environment=SANE_DEBUG_DLL=255 SANE_DEBUG_BJNP=5
194 [Install]
196 Also=saned.socket
197 You need to set an environment variable for SANE_CONFIG_DIR pointing to
199 the directory where saned can find its configuration files. you will
200 have to remove the # on the last line and set the variables for the
201 desired debugging information if required. Multiple variables can be
202 set by separating the assignments by spaces as shown in the example
203 above.
204 Unlike (x)inetd , systemd allows debugging output from backends set
206 using SANE_DEBUG_XXX to be captured. See the man-page for your backend
207 to see what options are supported. With the service unit as described
208 above, the debugging output is forwarded to the system log.
209
212 This configuration will also work when Saned is compiled WITH systemd
213 integration support, but it does not allow debugging information to be
214 logged.
215 for systemd configuration for saned, we need to add 2 configuration
217 files in /etc/systemd/system.
218 The first file we need to add here is called saned.socket. It is iden‐
220 tical to the version for systemd with the support compiled in. It
221 shall have the following contents:
222 [Unit]
224 Description=saned incoming socket
225 [Socket]
227 ListenStream=6566
228 Accept=yes
229 MaxConnections=1
230 [Install]
232 WantedBy=sockets.target
233 The second file to be added is saned@.service This one differes from
235 the sersion with systemd integration compiled in:
236 [Unit]
238 Description=Scanner Service
239 Requires=saned.socket
240 [Service]
242 ExecStart=/usr/sbin/saned
243 User=saned
244 Group=saned
245 StandardInput=socket
246 Environment=SANE_CONFIG_DIR=/etc/sane.d
248 [Install]
250 Also=saned.socket
251
253 /etc/hosts.equiv
254 The hosts listed in this file are permitted to access all local
255 SANE devices. Caveat: this file imposes serious security risks
256 and its use is not recommended.
257 /etc/sane.d/saned.conf
259 Contains a list of hosts permitted to access local SANE devices
260 (see also description of SANE_CONFIG_DIR below).
261 /etc/sane.d/saned.users
263 If this file contains lines of the form
264 user:password:backend
266 access to the listed backends is restricted. A backend may be
268 listed multiple times for different user/password combinations.
269 The server uses MD5 hashing if supported by the client.
270
272 SANE_CONFIG_DIR
273 This environment variable specifies the list of directories that
274 may contain the configuration file. Under UNIX, the directories
275 are separated by a colon (`:'), under OS/2, they are separated
276 by a semi-colon (`;'). If this variable is not set, the config‐
277 uration file is searched in two default directories: first, the
278 current working directory (".") and then in /etc/sane.d. If the
279 value of the environment variable ends with the directory sepa‐
280 rator character, then the default directories are searched after
281 the explicitly specified directories. For example, setting
282 SANE_CONFIG_DIR to "/tmp/config:" would result in directories
283 "tmp/config", ".", and "/etc/sane.d" being searched (in this
284 order).
285
288 sane(7), scanimage(1), xscanimage(1), xcam(1), sane-dll(5),
289 sane-net(5), sane-"backendname"[22m(5)
290 http://www.penguin-breeder.org/?page=sane-net
291
293 David Mosberger
294 20 Apr 2009 saned(8)