1saned(8) SANE Scanner Access Now Easy saned(8)
2
6 saned - SANE network daemon
7
9 saned [ -a [ username ] | -d [ n ] | -s [ n ] ]
10
12 saned is the SANE (Scanner Access Now Easy) daemon that allows remote
13 clients to access image acquisition devices available on the local
14 host.
15
17 The -a flag requests that saned run in standalone daemon mode. In this
18 mode, saned will detach from the console and run in the background,
19 listening for incoming client connections; inetd is not required for
20 saned operations in this mode. If the optional username is given after
21 -a , saned will drop root privileges and run as this user (and group).
22 The -d and -s flags request that saned run in debug mode (as opposed to
24 inetd(8) mode). In this mode, saned explicitly waits for a connection
25 request. When compiled with debugging enabled, these flags may be fol‐
26 lowed by a number to request debug info. The larger the number, the
27 more verbose the debug output. E.g., -d128 will request printing of
28 all debug info. Debug level 0 means no debug output at all. The default
29 value is 2. If flag -d is used, the debug messages will be printed to
30 stderr while -s requests using syslog.
31 If saned is run from inetd or xinetd, no option can be given.
33
35 First and foremost: saned is not intended to be exposed to the internet
36 or other non-trusted networks. Make sure that access is limited by tcp‐
37 wrappers and/or a firewall setup. Don't depend only on saned's own
38 authentication. Don't run saned as root if it's not necessary. And do
39 not install saned as setuid root.
40 The saned.conf configuration file contains both options for the daemon
42 and the access list.
43 data_portrange = min_port - max_port
45 Specify the port range to use for the data connection. Pick a
46 port range between 1024 and 65535; don't pick a too large port
47 range, as it may have performance issues. Use this option if
48 your saned server is sitting behind a firewall. If that firewall
49 is a Linux machine, we strongly recommend using the Netfilter
50 nf_conntrack_sane module instead.
51 The access list is a list of host names, IP addresses or IP subnets
53 (CIDR notation) that are permitted to use local SANE devices. IPv6
54 addresses must be enclosed in brackets, and should always be specified
55 in their compressed form. Connections from localhost are always permit‐
56 ted. Empty lines and lines starting with a hash mark (#) are ignored. A
57 line containing the single character ``+'' is interpreted to match any
58 hostname. This allows any remote machine to use your scanner and may
59 present a security risk, so this shouldn't be used unless you know what
60 you're doing.
61 A sample configuration file is shown below:
63 # Daemon options
65 data_portrange = 10000 - 10100
66 # Access list
67 scan-client.somedomain.firm
68 # this is a comment
69 192.168.0.1
70 192.168.2.12/29
71 [::1]
72 [2001:7a8:185e::42:12]/64
73 The case of the host names does not matter, so AHost.COM is considered
75 identical to ahost.com.
76
78 For saned to work properly in its default mode of operation, it is also
79 necessary to add a configuration line to /etc/inetd.conf. Note that
80 your inetd must support IPv6 if you want to connect to saned over IPv6
81 ; xinetd and openbsd-inetd are known to support IPv6, check the docu‐
82 mentation for your inetd daemon.
83 The configuration line normally looks like this:
85 sane-port stream tcp nowait saned.saned /usr/sbin/saned saned
87 However, if your system uses tcpd(8) for additional security screening,
89 you may want to disable saned access control by putting ``+'' in
90 saned.conf and use a line of the following form in /etc/inetd.conf
91 instead:
92 sane-port stream tcp nowait saned.saned /usr/sbin/tcpd
94 /usr/sbin/saned
95 Note that both examples assume that there is a saned group and a saned
97 user. If you follow this example, please make sure that the access
98 permissions on the special device are set such that saned can access
99 the scanner (the program generally needs read and write access to scan‐
100 ner devices).
101 If xinetd is installed on your system instead of inetd the following
103 example for xinetd.conf may be helpful:
104 # default: off
106 # description: The sane server accepts requests
107 # for network access to a local scanner via the
108 # network.
109 service sane-port
110 {
111 port = 6566
112 socket_type = stream
113 wait = no
114 user = saned
115 group = saned
116 server = /usr/sbin/saned
117 }
118 Finally, it is also necessary to add a line of the following form to
120 /etc/services:
121 sane-port 6566/tcp # SANE network scanner daemon
123 The official IANA short name for port 6566 is "sane-port". The older
125 name "sane" is now deprecated.
126
129 /etc/hosts.equiv
130 The hosts listed in this file are permitted to access all local
131 SANE devices. Caveat: this file imposes serious security risks
132 and its use is not recommended.
133 /etc/sane.d/saned.conf
135 Contains a list of hosts permitted to access local SANE devices
136 (see also description of SANE_CONFIG_DIR below).
137 /etc/sane.d/saned.users
139 If this file contains lines of the form
140 user:password:backend
142 access to the listed backends is restricted. A backend may be
144 listed multiple times for different user/password combinations.
145 The server uses MD5 hashing if supported by the client.
146
148 SANE_CONFIG_DIR
149 This environment variable specifies the list of directories that
150 may contain the configuration file. Under UNIX, the directories
151 are separated by a colon (`:'), under OS/2, they are separated
152 by a semi-colon (`;'). If this variable is not set, the config‐
153 uration file is searched in two default directories: first, the
154 current working directory (".") and then in /etc/sane.d. If the
155 value of the environment variable ends with the directory sepa‐
156 rator character, then the default directories are searched after
157 the explicitly specified directories. For example, setting
158 SANE_CONFIG_DIR to "/tmp/config:" would result in directories
159 "tmp/config", ".", and "/etc/sane.d" being searched (in this
160 order).
161
164 sane(7), scanimage(1), xscanimage(1), xcam(1), sane-dll(5),
165 sane-net(5), sane-"backendname"[22m(5)
166 http://www.penguin-breeder.org/?page=sane-net
167
169 David Mosberger
170 20 Apr 2009 saned(8)