File: couriertcpd.1

package info (click to toggle)
courier 0.60.0-2
  • links: PTS
  • area: main
  • in suites: lenny
  • size: 52,288 kB
  • ctags: 12,677
  • sloc: ansic: 165,348; cpp: 24,820; sh: 16,410; perl: 6,839; makefile: 3,621; yacc: 289; sed: 16
file content (626 lines) | stat: -rw-r--r-- 20,281 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
.\"  <!-- $Id: couriertcpd.sgml,v 1.9 2007/04/22 18:50:52 mrsam Exp $ -->
.\"  <!-- Copyright 2000-2007 Double Precision, Inc.  See COPYING for -->
.\"  <!-- distribution information. -->
.\"     Title: couriertcpd
.\"    Author: 
.\" Generator: DocBook XSL Stylesheets v1.72.0 <http://docbook.sf.net/>
.\"      Date: 04/22/2007
.\"    Manual: Double Precision, Inc.
.\"    Source: Double Precision, Inc.
.\"
.TH "COURIERTCPD" "1" "04/22/2007" "Double Precision, Inc." "Double Precision, Inc."
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.SH "NAME"
couriertcpd \- Courier TCP server daemon
.SH "SYNOPSIS"
.HP 12
\fBcouriertcpd\fR [\-pid=\fIpidfile\fR] [\fIoption\fR...] {\fIlist\fR} {\fIprogram\fR} {\fIarg\fR...}
.HP 12
\fBcouriertcpd\fR {\-pid=\fIpidfile\fR} {\-stop}
.HP 12
\fBcouriertcpd\fR {\-pid=\fIpidfile\fR} {\-restart}
.SH "DESCRIPTION"
.PP

\fBcouriertcpd\fR
accepts incoming network connections, and runs
\fBprogram\fR
after establishing each network connection. The
\fBprogram\fR's standard input and output are set to the network connection.
.PP

\fIlist\fR
is a comma\-separated list of TCP port numbers where incoming connections are created.
\fBprogram\fR
is the program to run. If
\fBprogram\fR
requires any arguments, they are specified on the command line, after
\fBprogram\fR
itself.
.PP
Before running
\fBprogram\fR,
\fBcouriertcpd\fR
initializes several environment variables that describe the network connection. The environment inherited by
\fBprogram\fR
will be the environment inherited by
\fBcouriertcpd\fR, plus any additional environment variables initialized by
\fBcouriertcpd\fR. It is also possible to reject certain network connections. Several options are available to specify which network connections will be rejected.
.SH "OPTIONS"
.PP
\-access=\fIfilename\fR
.RS 4
Specifies an optional access file. The access file lists the IP addresses from which connections should be accepted or rejected. The access file is also used to initialize environment variables based on the IP address of the connection.
\fIfilename\fR
is a GDBM or DB database file that's usually created by a script from one or more text files. See "ACCESS FILE" below for more information.
.RE
.PP
\-accesslocal
.RS 4
Lookup the local interface IP and port in the access file, in addition to looking up the remote IP. This gives a mechanism for setting environment variables depending on which IP address and/or port the client connected to. In the access file, "1.2.3.4.25" matches connections to IP address 1.2.3.4 port 25; "1.2.3.4" matches connections to IP address 1.2.3.4 on any port; and "*.25" matches connections to port 25 on any IP address.
.RE
.PP
\-address=\fIn.n.n.n\fR
.RS 4
Accept network connections only to IP address
\fIn.n.n.n\fR. If not specified,
\fBcouriertcpd\fR
accepts connections to any IP address that the system accepts connections on. If the system has multiple network interfaces with separate IP addresses, this option makes
\fBcouriertcpd\fR
accept connections only to one specific IP address. Most systems have multiple network interfaces: the loopback interface, plus the local network interface, so that
\-address=127.0.0.1
accepts connections only from the local system. When multiple port numbers are specified, it is also possible to selectively bind different network addresses to each port number when
\fIlist\fR
specifies more than one port number. See "\fIMultiple port list\fR\&[1]" below for more information.
.RE
.PP
\-block=\fIzone\fR[,\fIvar\fR[/\fIn.n.n.n\fR][,\fImsg\fR]]
.RS 4
Initialize the environment variable
\fIvar\fR
if both of the following conditions are true:
\fIvar\fR
is not already initialized; the connecting IP address can be found in a DNS\-based list. See DNS ACCESS LISTS, below. Multiple
\fB\-block\fR
options can be used.
.RE
.PP
\-denymsg=\fItext\fR
.RS 4
Specifies an optional message to be returned to the client if the
\fI\-access\fR
option rejects them. The default is to drop the TCP connection without sending back any messages.
.RE
.PP
\-group=\fIgroup\fR
.RS 4
Set
\fBcouriertcpd\fR's its group ID.
\fIgroup\fR
may be specified numerically, or by its name. Only the superuser may use
\fB\-group\fR.
.RE
.PP
\-listen=\fIn\fR
.RS 4
Length of the queue which holds pending connections.
\fIn\fR
is a number. If not specified, the system default is used.
.RE
.PP
\-maxperc=\fIn\fR
.RS 4
Maximum number of connections accepted from the same C network block. Using this option is recommended, because connection slots are limited. Without this option, the same C network block can potentially use up all available connection slots.
.RE
.PP
\-maxperip=\fIn\fR
.RS 4
Maximum number of connections accepted from the same IP address. Use both the
\fB\-maxperc\fR
and
\fB\-maxperip\fR
options to fine tune connection limits. For example, when
\fBcouriertcpd\fR
is listening on the SMTP port it makes sense to set an upper limit on the number of connections from the same C block. Domains that send a large amount of mail often have multiple servers sending outbound mail from the same C block, so it makes sense to set limits on individual C blocks. On the other hand, if
\fBcouriertcpd\fR
is listening on the POP3 port it makes more sense to set limits on individual IP addresses. If a C block of addresses is assigned to a dialup modem pool, it is certainly possible to have many IP addresses within the same C block have connections to the POP3 server at the same time.
.RE
.PP
\-maxprocs=\fIn\fR
.RS 4
Maximum number of connection slots, or the maximum number of processes started. This effectively specifies the maximum number of connections accepted at the same time. After the maximum number of connections has been opened,
\fBcouriertcpd\fR
waits for an existing connection to close, before accepting any more connections.
.RE
.PP
\-warn=\fIn\fR
.RS 4
Log a
\fBLOG_WARNING\fR
message to syslog when the number of active processes exceeds
\fIn\fR. The default is 90% of
\fImaxprocs\fR.
\fBcouriertcpd\fR
logs a
\fBLOG_ALERT\fR
syslog message when the number of active processes reaches the maximum.
.RE
.PP
\-nodnslookup
.RS 4
Do not look up the hostname associated with connecting IP address and the local addres, do not initialize the
\fBTCPREMOTEHOST\fR
or
\fBTCPLOCALHOST\fR
environment variables (see below).
.RE
.PP
\-noidentlookup
.RS 4
Do not perform an
\fIident\fR
lookup, and do not initialize the
\fBTCPREMOTEINFO\fR
environment variable.
.RE
.PP
\-pid=\fIfilename\fR
.RS 4
If given,
\fBcouriertcpd\fR
puts itself into the background and saves its process ID in this file, usually somewhere in
\fI/var/run\fR.
.sp
This option must also be present when using the
\fB\-restart\fR
and
\fB\-stop\fR
options.
.RE
.PP
\-restart
.RS 4
Send a SIGHUP to an existing
\fBcouriertcpd\fR
process. Specify the same
\fB\-pid\fR
argument as the one that was used to start
\fBcouriertcpd\fR. The process ID is read from the
\fB\-pid\fR
file, and the
\fBcouriertcpd\fR
receives a SIGHUP signal.
.RE
.PP
\-stderr=socket
.RS 4
Set
\fBprogram\fR's standard error to the network connection, just like its standard input and output.
.RE
.PP
\-stderr=\fIlogfile\fR
.RS 4
Set
\fBprogram\fR's standard error to the specified file,
\fIlogfile\fR. The file is created, if necessary, and is opened in append mode.
.RE
.PP
\-stderrlogger=\fIlogprogram\fR
.RS 4
Set
\fBprogram\fR's standard error to a pipe, which is read by
\fBlogprogram\fR. Only one instance of
\fIlogger\fR
is started, which receives standard error from every instance of
\fBprogram\fR. The specified
\fIlogger\fR
is executed with the output end of the stderr pipe connected as standard input.
\fIlogprogram\fR
is executed with one argument \-
\fBprogram\fR's name.
.RE
.PP
\-stderrloggername=name
.RS 4
Use
\fIname\fR
as the argument to
\fIlogprogram\fR, instead of the
\fBprogram\fR's name.
.RE
.PP
\-stop
.RS 4
Stop (kill) an existing
\fBcouriertcpd\fR
process. Specify the same
\fB\-pid\fR
argument as the one that was used to start
\fBcouriertcpd\fR. The process ID is read from the
\fB\-pid\fR
file, and the
\fBcouriertcpd\fR
process is killed. All child processes of
\fBcouriertcpd\fR
will receive a SIGTERM signal.
.RE
.PP
\-user=\fIuser\fR
.RS 4
Set
\fBcouriertcpd\fR's user ID. Also, the group ID is set to the user's group ID. Using both
\fB\-group\fR
and
\fB\-user\fR
is not necessary. Only the superuser can specify
\fB\-user\fR.
.RE
.SH "MULTIPLE PORT LIST"
.PP
The
\fIlist\fR
argument can be a comma\-separated list of multiple port numbers.
\fBcouriertcpd\fR
will create network connections on any listed port. Each port number can be optionally specified as "address.port", for example:
.sp
.RS 4
.nf
couriertcpd \-pid=/var/run/smtp.pid 127.0.0.1.25,999 \fIprogram\fR
.fi
.RE
.PP
This instance accepts network connections to either port 25 or port 999, however connections on port 25 are created only on the IP address 127.0.0.1, the loopback interface.
.PP
Whenever an IP address is not specified, network connections are accepted to any IP address (called "wildcarding"). On IPv6\-capable systems,
\fBcouriertcpd\fR
will attempt to create two incoming network connection ports, if an IP address is not specified. After creating the first port as an IPv6 wildcard port, couriertcpd will then attept to create an IPv4 wildcard port, with the same port number. Some BSD\-derived systems must use separate IPv6 and IPv4 wildcard ports to create incoming network connections. Most other systems only need an IPv6 port to create both IPv6 and IPv4 incoming network connections.
\fBcouriertcpd\fR
quietly ignores a failure to create an IPv4 wildcard port, as long as an IPv6 wildcard was succesfully created.
.PP
The
\fB\-address\fR
option can be used to default a specific IP address for every listed port number. For example:
.sp
.RS 4
.nf
couriertcpd \-pid=/var/run/smtp.pid 127.0.0.1.25,127.0.0.1.999 \fIprogram\fR
.fi
.RE
.PP
and
.sp
.RS 4
.nf
couriertcpd \-pid=/var/run/smtp.pid \-address=127.0.0.1 25,999 \fIprogram\fR
.fi
.RE
.PP
will create network connections on ports 25 and 999 of the IP address 127.0.0.1.
.SH "ACCESS FILE"
.PP
The access file lists IP addresses that
\fBcouriertcpd\fR
will accept or reject connections from. An access file is optional. Without an access file
\fBcouriertcpd\fR
accepts a connection from any IP address.
.PP
Both IPv4 and IPv6 addresses can be specified, if IPv6 support is available. A non\-standard syntax is currently used to specify IPv6 addresses. This is subject to change in the near future. IPv6 support is currently considered to be experimental.
.PP
The access file is a binary database file that's usually created by a script, such as
\fI\fBmakesmtpaccess\fR(8)\fR\&[2], from one or more plain text files. Blank lines in the text file are ignored. Lines that start with the # character are also ignored.
.SS "Rejecting and accepting connections by IP address"
.PP
The following line instructs
\fBcouriertcpd\fR
to reject all connections from an IP address range:
.sp
.RS 4
.nf
netblock<tab>deny
.fi
.RE
.PP
\fInetblock\fR
is an IP address, such as
192.68.0.2.
<tab>
is the ASCII tab character. There MUST be exactly one tab character after the IP address and the word "deny".
.PP
You can also block connections from an entire network C block:
.sp
.RS 4
.nf
192.68.0<tab>deny
.fi
.RE
.PP
This blocks connections from IP addresses
192.68.0.0
through
192.68.0.255. Blocking connections from an entire B or A network block works the same way.
.PP
Use the word "allow" instead of "deny" to explicitly allow connections from that IP address or netblock. For example:
.sp
.RS 4
.nf
192.68.0<tab>deny
192.68.0.10<tab>allow
.fi
.RE
.PP
This blocks all connections from
192.68.0.0
to
192.68.0.255
except for
192.68.0.10. These two lines can occur in any order.
\fBcouriertcpd\fR
always uses the line with the most specific IP address.
.PP
If the IP address of the connection is not found in the access file the connection is accepted by default. The following line causes unlisted connections to be rejected:
.sp
.RS 4
.nf
*<tab>deny
.fi
.RE
.SS "IPv6 addresses"
.sp
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
\fBNote\fR
.PP
IPv6 support in the access file is experimental, and is subject to change in a future release. The following syntax is subject to change at any time.
.PP
The access file can also specify IPv6 addresses, if IPv6 support is available. The existing IPv4 address format is used for IPv6\-mapped IPv4 addresses, and no changes are required. For all other IPv6 addresses use the following format:
.sp
.RS 4
.nf
:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh<tab>\fIaction\fR
.fi
.RE
.PP
The IPv6 address must begin with :. The initial : character is not really a part of the IPv6 address, it is only used to designate this record as an IPv6 address, allowing an access file to contain a mixture of IPv4 and IPv6 addresses. The IPv6 address follows the initial : character, and it must be spelled out
\fIusing zero\-padded lowercase hexadecimal digits\fR. For example:
.sp
.RS 4
.nf
:0000:0000:0000:0000:0000:f643:00a2:9354<tab>deny
.fi
.RE
.PP
Netblocks must be specified using even\-word boundaries only:
.sp
.RS 4
.nf
:3ffe<tab>deny
.fi
.RE
.PP
This will deny entire 3ffe::/16 (6bone network, which is phased out).
.sp
.RS 4
.nf
:2002:c0a8<tab>deny
.fi
.RE
.PP
This will deny 2002:c0a8::/32 (6to4 addresses derived from private address space).
.SS "Setting environment variables"
.PP

allow
can be optionally followed by a list of environment variable assignments, separated by commas. The environment variables are set before executing
\fBprogram\fR
or checking access lists (see below). For example:
.sp
.RS 4
.nf
192.68.0<tab>allow,RELAYCLIENT
192.68.0.10<tab>allow,RELAYCLIENT,SIZELIMIT=1000000
.fi
.RE
.PP
This sets
\fBRELAYCLIENT\fR
environment variable for connections from the
192.68.0
block. In addition to that, the
\fBSIZELIMIT\fR
environment variable is set to
1000000
if the connection comes from the IP address
192.68.0.10.
.PP
Note that
\fBRELAYCLIENT\fR
must be explicitly specified for the IP address
192.68.0.10. The first line is NOT used for connections from this IP address.
\fBcouriertcpd\fR
only reads one entry from the access file, the entry for the most specific IP address.
.SS "DNS ACCESS LISTS"
.PP
An alternative to listing banned IP addresses is to use an external DNS\-based IP access list.
.PP
There is no provision to support IPv6\-based lists, because none yet exist. IPv6\-based access list support will be added in the future.
.PP

\fBcouriertcpd\fR
does not automatically reject connections from any IP address listed on a DNS\-based list. If the connecting IP address is listed couriertcpd simply sets an environment variable. It's up to the
\fBprogram\fR, run by
\fBcouriertcpd\fR, to read the environment variable and choose what to do if the environment variable is set.
.PP
Please note that if the environment variable is already set,
\fBcouriertcpd\fR
will NOT search the access list. This can be used to override the access list where
\fBprogram\fR
only recognizes the access list if the environment variable is not empty. By setting the environment variable to an empty string in the access file (see above), you can override access lists for selected IP addresses.
.PP
The
\fB\-block\fR
option queries a DNS list for each connecting IP address. The only required argument to
\fB\-block\fR
is the DNS zone that is used to publish thelist. The name of the zone can optionally be followed by a comma and the name of the environment variable to set if the DNS list includes the IP address.
\fBcouriertcpd\fR
sets the environment variable
\fBBLOCK\fR
if you do not specify the name yourself.
.PP
The name of the environment variable can be optionally followed by a slash and an IP address. Normally
\fBcouriertcpd\fR
sets the environment variable if the access list includes any A record entry for the specified IP address. Some access lists may offer additional information by returning one of several possible A records. If the name of the environment variable is followed by a slash and an IP address, the environment variable will be initialized only if the access list includes an A record containing the indicated IP address.
.PP
The contents of the environment variable will be the contents of any TXT record for the listed IP address.
\fIvar\fR[/\fIn.n.n.n\fR] can be optionally followed by a comma and a text message, which will be used instead of the TXT record. The text message may include a single @ character somewhere in it, which will be replaced by the listed IP address.
.SS "MULTIPLE DNS LISTS"
.PP
Multiple
\fB\-block\fR
options can be used. The connecting IP address will be looked up in multiple access lists. This is implemented as follows.
.PP

\fBcouriertcpd\fR
processes all
\fB\-block\fR
options one at a time. If the indicated environment variable is already set,
\fBcouriertcpd\fR
skips the DNS list lookup (this is also true if only one
\fB\-block\fR
option is specified). Therefore, if multiple
\fB\-block\fR
options are used, and an IP address is found in the first access list, the remaininglists that use the same environment variable will not be checked. But other lists that use a different environment variable WILL be checked.
.PP
The same
\fIzone\fR
can be specified more than once, with different environment variables and different IP addresses. For example:
.sp
.RS 4
.nf
couriertcpd \-block=block.example.org,BLOCK1/127.0.0.2 \e
            \-block=block.example.org,BLOCK2/127.0.0.3
.fi
.RE
.PP
If the specified access list contains an A record for the listed address, and the A record contains the IP address 127.0.0.2,
\fBcouriertcpd\fR
initializes the
\fBBLOCK1\fR
environment variable. If the A record contains the IP address 127.0.0.3,
\fBcouriertcpd\fR
initializes
\fBBLOCK2\fR. If both records are present, both variables are initialized.
.PP

\fBcouriertcpd\fR
uses the following logic to determine what kind of DNS query to issue:
.PP
If neither the IP address, nor
\fImsg\fR
is specified,
\fBcouriertcpd\fR
will query for existence of TXT records, for the IP address.
.PP
If only
\fImsg\fR
is specified,
\fBcouriertcpd\fR
looks up the existence of A records, for the IP address.
.PP
If
\fI/n.n.n.n\fR
is used, and
\fImsg\fR
is not specified for at least one
\fB\-block\fR
option for this same zone,
\fBcouriertcpd\fR
will query for existence of ANY records, which should return both TXT and all the A records for this IP address.
.PP
If
\fI/n.n.n.n\fR
is used, and
\fImsg\fR
is specified for every
\fB\-block\fR
option for this same zone,
\fBcouriertcpd\fR
will query for existence of A records only.
.SH "ENVIRONMENT VARIABLES"
.PP

\fBcouriertcpd\fR
also initializes the following environment variables prior to running
\fBprogram\fR:
.PP
TCPLOCALHOST
.RS 4
The name of the host on the local end of the network connection, looked up in DNS.
\fBTCPLOCALHOST\fR
will not be set if the IP address of the network connection's local end cannot be found in DNS, or if
\fB\-nodnslookup\fR
option is specified.
\fBTCPLOCALHOST\fR
will be set to the string
\fBsoftdnserr\fR
if the DNS lookup fails with a temporary error (so you cannot tell if the IP address has a valid host name associated with it), or if the reverse and forward DNS lookups do not match.
\fBTCPLOCALHOST\fR
will not be set if the reverse DNS lookup fails completely.
.RE
.PP
TCPLOCALIP
.RS 4
The IP address of the local end of the network connection.
.RE
.PP
TCPLOCALPORT
.RS 4
Rhe number of the port of the local end of the network connection.
.RE
.PP
TCPREMOTEHOST
.RS 4
The hostname of the connecting host. Like
\fBTCPLOCALHOST\fR, but for the connecting IP address.
.RE
.PP
TCPREMOTEIP
.RS 4
Connecting IP address.
.RE
.PP
TCPREMOTEINFO
.RS 4
Identification string received from the IDENT server on the remote IP address. Not set if the IDENT server returned an error, or if the
\fB\-noidentlookup\fR
option was specified.
.RE
.PP
TCPREMOTEPORT
.RS 4
TCP port of the remote end of the network connection.
.RE
.SH "SEE ALSO"
.PP

\fI\fBcourier\fR(8)\fR\&[3].
.SH "REFERENCES"
.IP " 1." 4
Multiple port list
.RS 4
\%#list
.RE
.IP " 2." 4
\fBmakesmtpaccess\fR(8)
.RS 4
\%makesmtpaccess.html
.RE
.IP " 3." 4
\fBcourier\fR(8)
.RS 4
\%courier.html
.RE