1HOSTS_OPTIONS(5) File Formats Manual HOSTS_OPTIONS(5)
2
6 hosts_options - host access control language extensions
7
9 This document describes optional extensions to the language described
10 in the hosts_access(5) document. The extensions are enabled at program
11 build time. For example, by editing the Makefile and turning on the
12 PROCESS_OPTIONS compile-time option.
13 The extensible language uses the following format:
15 daemon_list : client_list : option : option ...
17 The first two fields are described in the hosts_access(5) manual page.
19 The remainder of the rules is a list of zero or more options. Any ":"
20 characters within options should be protected with a backslash.
21 An option is of the form "keyword" or "keyword value". Options are pro‐
23 cessed in the specified order. Some options are subjected to %<letter>
24 substitutions. For the sake of backwards compatibility with earlier
25 versions, an "=" is permitted between keyword and value.
26
28 severity mail.info
29 severity notice
31 Change the severity level at which the event will be logged.
32 Facility names (such as mail) are optional, and are not sup‐
33 ported on systems with older syslog implementations. The sever‐
34 ity option can be used to emphasize or to ignore specific
35 events.
36
38 allow
39 deny Grant (deny) service. These options must appear at the end of a
41 rule.
42 The allow and deny keywords make it possible to keep all access control
44 rules within a single file, for example in the hosts.allow file.
45 To permit access from specific hosts only:
47 ALL: .friendly.domain: ALLOW
49 ALL: ALL: DENY
50 To permit access from all hosts except a few trouble makers:
52 ALL: .bad.domain: DENY
54 ALL: ALL: ALLOW
55 Notice the leading dot on the domain name patterns.
57
59 aclexec shell_command
60 Execute, in a child process, the specified shell command, after
61 performing the %<letter> expansions described in the
62 hosts_access(5) manual page. The command is executed with
63 stdin, stdout and stderr connected to the null device, so that
64 it won't mess up the conversation with the client host. Example:
65 smtp : ALL : aclexec checkdnsbl %a
67 executes, in a background child process, the shell command
69 "checkdnsbl %a" after replacing %a by the address of the remote
70 host.
71 The connection will be allowed or refused depending on whether
73 the command returns a true or false exit status.
74 spawn shell_command
76 Execute, in a child process, the specified shell command, after
77 performing the %<letter> expansions described in the
78 hosts_access(5) manual page. The command is executed with
79 stdin, stdout and stderr connected to the null device, so that
80 it won´t mess up the conversation with the client host. Example:
81 spawn (/some/where/safe_finger -l @%h | /usr/ucb/mail root) &
83 executes, in a background child process, the shell command
85 "safe_finger -l @%h | mail root" after replacing %h by the name
86 or address of the remote host.
87 The example uses the "safe_finger" command instead of the regu‐
89 lar "finger" command, to limit possible damage from data sent by
90 the finger server. The "safe_finger" command is part of the dae‐
91 mon wrapper package; it is a wrapper around the regular finger
92 command that filters the data sent by the remote host.
93 twist shell_command
95 Replace the current process by an instance of the specified
96 shell command, after performing the %<letter> expansions
97 described in the hosts_access(5) manual page. Stdin, stdout and
98 stderr are connected to the client process. This option must
99 appear at the end of a rule.
100 To send a customized bounce message to the client instead of
102 running the real ftp daemon:
103 in.ftpd : ... : twist /bin/echo 421 Some bounce message
105 For an alternative way to talk to client processes, see the ban‐
107 ners option below.
108 To run /some/other/in.telnetd without polluting its command-line
110 array or its process environment:
111 in.telnetd : ... : twist PATH=/some/other; exec in.telnetd
113 Warning: in case of UDP services, do not twist to commands that
115 use the standard I/O or the read(2)/write(2) routines to commu‐
116 nicate with the client process; UDP requires other I/O primi‐
117 tives.
118
120 keepalive
121 Causes the server to periodically send a message to the client.
122 The connection is considered broken when the client does not
123 respond. The keepalive option can be useful when users turn off
124 their machine while it is still connected to a server. The
125 keepalive option is not useful for datagram (UDP) services.
126 linger number_of_seconds
128 Specifies how long the kernel will try to deliver not-yet deliv‐
129 ered data after the server process closes a connection.
130
132 rfc931 [ timeout_in_seconds ]
133 Look up the client user name with the RFC 931 (TAP, IDENT, RFC
134 1413) protocol. This option is silently ignored in case of ser‐
135 vices based on transports other than TCP. It requires that the
136 client system runs an RFC 931 (IDENT, etc.) -compliant daemon,
137 and may cause noticeable delays with connections from non-UNIX
138 clients. The timeout period is optional. If no timeout is spec‐
139 ified a compile-time defined default value is taken.
140
142 banners /some/directory
143 Look for a file in `/some/directory' with the same name as the
144 daemon process (for example in.telnetd for the telnet service),
145 and copy its contents to the client. Newline characters are
146 replaced by carriage-return newline, and %<letter> sequences are
147 expanded (see the hosts_access(5) manual page).
148 The tcp wrappers source code distribution provides a sample
150 makefile (Banners.Makefile) for convenient banner maintenance.
151 Warning: banners are supported for connection-oriented (TCP)
153 network services only.
154 nice [ number ]
156 Change the nice value of the process (default 10). Specify a
157 positive value to spend more CPU resources on other processes.
158 setenv name value
160 Place a (name, value) pair into the process environment. The
161 value is subjected to %<letter> expansions and may contain
162 whitespace (but leading and trailing blanks are stripped off).
163 Warning: many network daemons reset their environment before
165 spawning a login or shell process.
166 umask 022
168 Like the umask command that is built into the shell. An umask of
169 022 prevents the creation of files with group and world write
170 permission. The umask argument should be an octal number.
171 user nobody
173 user nobody.kmem
175 Assume the privileges of the "nobody" userid (or user "nobody",
176 group "kmem"). The first form is useful with inetd implementa‐
177 tions that run all services with root privilege. The second form
178 is useful for services that need special group privileges only.
179
181 When a syntax error is found in an access control rule, the error is
182 reported to the syslog daemon; further options will be ignored, and
183 service is denied.
184
186 hosts_access(5), the default access control language
187
189 Wietse Venema (wietse@wzv.win.tue.nl)
190 Department of Mathematics and Computing Science
191 Eindhoven University of Technology
192 Den Dolech 2, P.O. Box 513,
193 5600 MB Eindhoven, The Netherlands
194 HOSTS_OPTIONS(5)