1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
|
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/><title>couriertcpd</title><link rel="stylesheet" href="style.css" type="text/css"/><meta name="generator" content="DocBook XSL Stylesheets V1.72.0"/><link rel="start" href="#couriertcpd" title="couriertcpd"/><link xmlns="" rel="stylesheet" type="text/css" href="manpage.css"/><meta xmlns="" name="MSSmartTagsPreventParsing" content="TRUE"/><link xmlns="" rel="icon" href="icon.gif" type="image/gif"/><!--
Copyright 1998 - 2007 Double Precision, Inc. See COPYING for distribution
information.
--></head><body><div class="refentry" lang="en" xml:lang="en"><a id="couriertcpd" shape="rect"> </a><div class="titlepage"/><div class="refnamediv"><h2>Name</h2><p>couriertcpd — Courier TCP server daemon</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">couriertcpd</code> [-pid=<em class="replaceable"><code>pidfile</code></em>] [<em class="replaceable"><code>option</code></em>...] {<em class="replaceable"><code>list</code></em>} {<em class="replaceable"><code>program</code></em>} {<em class="replaceable"><code>arg</code></em>...}</p></div><div class="cmdsynopsis"><p><code class="command">couriertcpd</code> {-pid=<em class="replaceable"><code>pidfile</code></em>} {-stop}</p></div><div class="cmdsynopsis"><p><code class="command">couriertcpd</code> {-pid=<em class="replaceable"><code>pidfile</code></em>} {-restart}</p></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id282386" shape="rect"> </a><h2>DESCRIPTION</h2><p>
<span><strong class="command">couriertcpd</strong></span> accepts incoming network connections, and runs
<span><strong class="command">program</strong></span> after establishing each network connection. The
<span><strong class="command">program</strong></span>'s standard input and output are set to the network
connection.</p><p>
<em class="replaceable"><code>list</code></em> is a comma-separated list of TCP port numbers
where incoming
connections are created. <span><strong class="command">program</strong></span> is the program to
run. If <span><strong class="command">program</strong></span> requires any
arguments, they are specified on the command line, after
<span><strong class="command">program</strong></span> itself.</p><p>
Before running <span><strong class="command">program</strong></span>, <span><strong class="command">couriertcpd</strong></span>
initializes
several environment variables that describe the network connection. The
environment inherited by <span><strong class="command">program</strong></span> will be the environment
inherited by <span><strong class="command">couriertcpd</strong></span>, plus any additional environment
variables initialized by <span><strong class="command">couriertcpd</strong></span>. It is also possible to
reject certain network connections. Several options are available to specify
which network connections will be rejected.</p></div><div class="refsect1" lang="en" xml:lang="en"><a id="id282668" shape="rect"> </a><h2>OPTIONS</h2><div class="variablelist"><dl><dt><span class="term">-access=<em class="replaceable"><code>filename</code></em></span></dt><dd><p>
Specifies an optional access
file. The access file lists the IP addresses from which connections
should be accepted or rejected. The access file is also used to
initialize environment variables based on the IP address of the
connection. <em class="replaceable"><code>filename</code></em> is a GDBM or DB database file
that's usually
created by a script from one or more text files. See "ACCESS FILE" below for
more information.</p></dd><dt><span class="term">-accesslocal</span></dt><dd><p>
Lookup the local interface IP and port in the access file, in addition to
looking up the remote IP. This gives a mechanism for setting environment
variables depending on which IP address and/or port the client connected to.
In the access file, "1.2.3.4.25" matches connections to IP address 1.2.3.4
port 25; "1.2.3.4" matches connections to IP address 1.2.3.4 on any port;
and "*.25" matches connections to port 25 on any IP address.</p></dd><dt><span class="term">-address=<em class="replaceable"><code>n.n.n.n</code></em></span></dt><dd><p>
Accept network connections only to IP address
<em class="replaceable"><code>n.n.n.n</code></em>. If not specified,
<span><strong class="command">couriertcpd</strong></span>
accepts connections to any IP address that the system accepts connections
on. If the system has multiple network interfaces with separate IP
addresses, this option makes <span><strong class="command">couriertcpd</strong></span> accept connections
only to one specific IP address. Most systems have multiple network
interfaces: the loopback interface, plus the local network interface, so
that <code class="literal">-address=127.0.0.1</code> accepts connections only from the
local system. When multiple port numbers are specified, it is also
possible to selectively bind different network addresses to each port
number when <em class="replaceable"><code>list</code></em> specifies more than one port
number. See "<a href="#list" target="_top" shape="rect">Multiple port list</a>" below for more
information.</p></dd><dt><span class="term">-block=<em class="replaceable"><code>zone</code></em>[,<em class="replaceable"><code>var</code></em>[/<em class="replaceable"><code>n.n.n.n</code></em>][,<em class="replaceable"><code>msg</code></em>]]</span></dt><dd><p>
Initialize the environment variable <em class="replaceable"><code>var</code></em> if both of
the following
conditions are true: <em class="replaceable"><code>var</code></em> is not already initialized;
the connecting IP address can be found in a DNS-based list. See
DNS ACCESS LISTS, below.
Multiple <code class="option">-block</code> options can be used.</p></dd><dt><span class="term">-denymsg=<em class="replaceable"><code>text</code></em></span></dt><dd><p>
Specifies an optional message to be returned to the client if the
<em class="parameter"><code>-access</code></em> option rejects them.
The default is to drop the TCP
connection without sending back any messages.</p></dd><dt><span class="term">-group=<em class="replaceable"><code>group</code></em></span></dt><dd><p>
Set <span><strong class="command">couriertcpd</strong></span>'s its
group ID. <em class="replaceable"><code>group</code></em> may be specified numerically, or by
its name. Only the superuser may use <code class="option">-group</code>.</p></dd><dt><span class="term">-listen=<em class="replaceable"><code>n</code></em></span></dt><dd><p>
Length of the queue which holds pending connections.
<em class="replaceable"><code>n</code></em> is a number. If not specified, the system default
is used.</p></dd><dt><span class="term">-maxperc=<em class="replaceable"><code>n</code></em></span></dt><dd><p>
Maximum number of connections accepted
from the same C network block. Using this option is recommended, because
connection slots are limited. Without this option, the same C network
block can potentially use up all available connection slots.</p></dd><dt><span class="term">-maxperip=<em class="replaceable"><code>n</code></em></span></dt><dd><p>
Maximum number of connections
accepted from the same IP address. Use both the <code class="option">-maxperc</code>
and <code class="option">-maxperip</code> options to fine tune connection limits. For
example, when <span><strong class="command">couriertcpd</strong></span> is listening on the SMTP port it
makes sense to set an upper limit on the number of connections from the
same C block. Domains that send a large amount of mail often have
multiple servers sending outbound mail from the same C block, so it makes
sense to set limits on individual C blocks. On the other hand, if
<span><strong class="command">couriertcpd</strong></span> is listening on the POP3 port it makes more
sense to set limits on individual IP addresses. If a C block of
addresses is assigned to a dialup modem pool, it is certainly possible to
have many IP addresses within the same C block have connections to the
POP3 server at the same time.</p></dd><dt><span class="term">-maxprocs=<em class="replaceable"><code>n</code></em></span></dt><dd><p>
Maximum number of connection slots,
or the maximum number of processes started. This effectively specifies
the maximum number of connections accepted at the same time. After the
maximum number of connections has been opened, <span><strong class="command">couriertcpd</strong></span>
waits for an existing connection to close, before accepting any more
connections.</p></dd><dt><span class="term">-warn=<em class="replaceable"><code>n</code></em></span></dt><dd><p>
Log a <span class="errorcode">LOG_WARNING</span> message to
syslog when the number of active processes exceeds
<em class="replaceable"><code>n</code></em>. The default is 90% of
<em class="replaceable"><code>maxprocs</code></em>. <span><strong class="command">couriertcpd</strong></span> logs a
<span class="errorcode">LOG_ALERT</span> syslog message when the number of active
processes
reaches the maximum.</p></dd><dt><span class="term">-nodnslookup</span></dt><dd><p>
Do not look up the hostname associated with connecting IP address and the
local addres, do not initialize the
<code class="envar">TCPREMOTEHOST</code> or <code class="envar">TCPLOCALHOST</code> environment
variables (see below).</p></dd><dt><span class="term">-noidentlookup</span></dt><dd><p>
Do not perform an <span class="emphasis"><em>ident</em></span>
lookup, and do not initialize the <code class="envar">TCPREMOTEINFO</code> environment
variable.</p></dd><dt><span class="term">-pid=<em class="replaceable"><code>filename</code></em></span></dt><dd><p>
If given, <span><strong class="command">couriertcpd</strong></span> puts itself into the background
and saves its process ID in this file, usually
somewhere in <code class="filename">/var/run</code>.</p><p>This option must also be present when using the <code class="option">-restart</code>
and <code class="option">-stop</code> options.</p></dd><dt><span class="term">-restart</span></dt><dd><p>
Send a SIGHUP to an existing <span><strong class="command">couriertcpd</strong></span> process. Specify
the same <code class="option">-pid</code>
argument as the one that was used to start <span><strong class="command">couriertcpd</strong></span>. The
process ID is read from the <code class="option">-pid</code> file, and the
<span><strong class="command">couriertcpd</strong></span> receives a SIGHUP signal.</p></dd><dt><span class="term">-stderr=socket</span></dt><dd><p>
Set <span><strong class="command">program</strong></span>'s standard error to
the network connection, just like its standard input and output.</p></dd><dt><span class="term">-stderr=<em class="replaceable"><code>logfile</code></em></span></dt><dd><p>
Set <span><strong class="command">program</strong></span>'s standard
error to the specified file, <code class="filename">logfile</code>.
The file is created, if necessary, and is opened in append mode.</p></dd><dt><span class="term">-stderrlogger=<em class="replaceable"><code>logprogram</code></em></span></dt><dd><p>
Set <span><strong class="command">program</strong></span>'s
standard error to a pipe, which is read by <span><strong class="command">logprogram</strong></span>.
Only one instance of
<em class="replaceable"><code>logger</code></em> is started, which receives standard error
from every
instance of <span><strong class="command">program</strong></span>.
The specified <em class="replaceable"><code>logger</code></em> is executed with
the output end of the stderr pipe connected as standard input.
<em class="replaceable"><code>logprogram</code></em> is
executed with one argument - <span><strong class="command">program</strong></span>'s name.</p></dd><dt><span class="term">-stderrloggername=name</span></dt><dd><p>
Use <em class="replaceable"><code>name</code></em> as the argument to
<em class="replaceable"><code>logprogram</code></em>, instead of the
<span><strong class="command">program</strong></span>'s name.</p></dd><dt><span class="term">-stop</span></dt><dd><p>
Stop (kill) an existing <span><strong class="command">couriertcpd</strong></span>
process. Specify the same <code class="option">-pid</code> argument as the one that was
used to start <span><strong class="command">couriertcpd</strong></span>. The process ID is read from the
<code class="option">-pid</code> file, and the <span><strong class="command">couriertcpd</strong></span> process is
killed. All child processes of <span><strong class="command">couriertcpd</strong></span> will receive a
SIGTERM signal.</p></dd><dt><span class="term">-user=<em class="replaceable"><code>user</code></em></span></dt><dd><p>
Set <span><strong class="command">couriertcpd</strong></span>'s user
ID. Also, the group ID is set to the user's group ID. Using both
<code class="option">-group</code> and <code class="option">-user</code> is not necessary. Only the
superuser can specify <code class="option">-user</code>.</p></dd></dl></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id325713" shape="rect"> </a><h2>MULTIPLE PORT LIST</h2><a id="list" shape="rect"> </a><p>
The <em class="replaceable"><code>list</code></em> argument can be a comma-separated list of
multiple port
numbers. <span><strong class="command">couriertcpd</strong></span> will create network connections on any
listed port. Each port number can be optionally specified as "address.port",
for example:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,999 <em class="replaceable"><code>program</code></em>
</pre></div><p>
This instance accepts network connections to either port 25 or port 999,
however connections on port 25 are created only on the IP address 127.0.0.1,
the loopback interface.</p><p>Whenever an IP address is not specified, network connections are
accepted
to any IP address (called "wildcarding"). On IPv6-capable systems,
<span><strong class="command">couriertcpd</strong></span> will attempt to create two incoming network
connection ports, if an IP address is not specified. After creating the first
port as an IPv6 wildcard port, couriertcpd will then attept to create an IPv4
wildcard port, with the same port number. Some BSD-derived systems must use
separate IPv6 and IPv4 wildcard ports to create incoming network connections.
Most other systems only need an IPv6 port to create both IPv6 and IPv4
incoming network connections. <span><strong class="command">couriertcpd</strong></span> quietly ignores a
failure to create an IPv4 wildcard port, as long as an IPv6 wildcard was
succesfully created.</p><p>
The <code class="option">-address</code> option can be used to default a specific IP
address for every listed port number. For example:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,127.0.0.1.999 <em class="replaceable"><code>program</code></em>
</pre></div><p>
and</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
couriertcpd -pid=/var/run/smtp.pid -address=127.0.0.1 25,999 <em class="replaceable"><code>program</code></em>
</pre></div><p>
will create network connections on ports 25 and 999 of the IP address
127.0.0.1.</p></div><div class="refsect1" lang="en" xml:lang="en"><a id="id325820" shape="rect"> </a><h2>ACCESS FILE</h2><p>
The access file lists IP addresses that <span><strong class="command">couriertcpd</strong></span> will
accept or reject connections from. An access file is optional. Without an
access file <span><strong class="command">couriertcpd</strong></span> accepts a connection from any IP
address.</p><p>
Both IPv4 and IPv6 addresses can be specified, if IPv6 support is
available. A non-standard syntax is currently used to specify IPv6 addresses.
This is subject to change in the near future. IPv6 support is currently
considered to be experimental.</p><p>
The access file is a binary database file that's usually created by a
script, such as
<a href="makesmtpaccess.html" target="_top" shape="rect"><span class="citerefentry"><span class="refentrytitle">makesmtpaccess</span>(8)</span></a>,
from one or more plain text
files. Blank lines in the text file are ignored. Lines that start with the #
character are also ignored.</p><div class="refsect2" lang="en" xml:lang="en"><a id="id325862" shape="rect"> </a><h3>Rejecting and accepting connections by IP address</h3><p>
The following line instructs <span><strong class="command">couriertcpd</strong></span> to reject all
connections from an IP address range:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
netblock<tab>deny
</pre></div><p><em class="replaceable"><code>netblock</code></em> is an IP address, such as
<code class="literal">192.68.0.2</code>. <span class="token"><tab></span>
is the ASCII tab character. There MUST be exactly one tab character after the
IP address and the word "deny".</p><p>
You can also block connections from an entire network C block:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
192.68.0<tab>deny
</pre></div><p>
This blocks connections from IP addresses <code class="literal">192.68.0.0</code>
through <code class="literal">192.68.0.255</code>.
Blocking connections from an entire B or A network block works the same
way.</p><p>
Use the word "<code class="literal">allow</code>" instead of "<code class="literal">deny</code>"
to explicitly allow connections
from that IP address or netblock. For example:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
192.68.0<tab>deny
192.68.0.10<tab>allow
</pre></div><p>
This blocks all connections from <code class="literal">192.68.0.0</code> to
<code class="literal">192.68.0.255</code> except for <code class="literal">192.68.0.10</code>.
These two lines can occur in any order. <span><strong class="command">couriertcpd</strong></span>
always uses the line with the most specific IP address.</p><p>
If the IP address of the connection is not found in the access file the
connection is accepted by default. The following line causes unlisted
connections to be rejected:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
*<tab>deny
</pre></div></div><div class="refsect2" lang="en" xml:lang="en"><a id="id326001" shape="rect"> </a><h3>IPv6 addresses</h3><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
IPv6 support in the access file is experimental, and is subject to
change in a future release. The following syntax is subject to change at any
time.</p></div><p>
The access file can also specify IPv6 addresses, if IPv6 support is
available. The existing IPv4 address format is used for IPv6-mapped IPv4
addresses, and no changes are required. For all other IPv6 addresses use the
following format:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh<tab><em class="replaceable"><code>action</code></em>
</pre></div><p>
The IPv6 address must begin with :. The initial : character is not really
a part of the IPv6 address, it is only used to designate this record as an
IPv6 address, allowing an access file to contain a mixture of IPv4 and IPv6
addresses. The IPv6 address follows the initial : character, and it must be
spelled out <span class="emphasis"><em>using zero-padded lowercase hexadecimal
digits</em></span>.
For example:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
:0000:0000:0000:0000:0000:f643:00a2:9354<tab>deny
</pre></div><p>
Netblocks must be specified using even-word boundaries only:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
:3ffe<tab>deny
</pre></div><p>
This will deny entire 3ffe::/16 (6bone network, which is phased out).
</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
:2002:c0a8<tab>deny
</pre></div><p>
This will deny 2002:c0a8::/32 (6to4 addresses derived from private
address space).</p></div><div class="refsect2" lang="en" xml:lang="en"><a id="id326083" shape="rect"> </a><h3>Setting environment variables</h3><p>
<code class="literal">allow</code> can be optionally followed by a list of environment
variable
assignments, separated by commas. The environment variables are set before
executing <span><strong class="command">program</strong></span> or checking
access lists (see below). For example:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
192.68.0<tab>allow,RELAYCLIENT
192.68.0.10<tab>allow,RELAYCLIENT,SIZELIMIT=1000000
</pre></div><p>
This sets <code class="envar">RELAYCLIENT</code> environment variable for connections
from the <code class="literal">192.68.0</code> block. In addition to that, the <code class="envar">SIZELIMIT</code>
environment variable is set to <code class="literal">1000000</code> if the connection comes from the IP
address <code class="literal">192.68.0.10</code>.</p><p>
Note that <code class="envar">RELAYCLIENT</code> must be explicitly specified for the IP
address <code class="literal">192.68.0.10</code>. The first line is NOT used for
connections from this IP
address. <span><strong class="command">couriertcpd</strong></span> only reads one entry from the access
file, the entry for the most specific IP address.</p></div><div class="refsect2" lang="en" xml:lang="en"><a id="id326166" shape="rect"> </a><h3>DNS ACCESS LISTS</h3><p>An alternative to listing banned IP addresses is to use an external
DNS-based IP access list.</p><p>
There is no provision to support IPv6-based lists, because none yet
exist. IPv6-based access list support will be added in the future.</p><p>
<span><strong class="command">couriertcpd</strong></span> does not automatically reject connections from
any IP address listed on a DNS-based list. If the connecting IP address is
listed couriertcpd simply sets an environment variable. It's up to the
<span><strong class="command">program</strong></span>, run by <span><strong class="command">couriertcpd</strong></span>,
to read the environment
variable and choose what to do if the environment variable is set.</p><p>Please note that if the environment variable is already set,
<span><strong class="command">couriertcpd</strong></span> will NOT search the access list. This can be used
to override the access list where <span><strong class="command">program</strong></span> only recognizes the
access list if the environment variable is not empty. By setting the
environment variable to an empty string in the access file (see above), you
can override access lists for selected IP addresses.</p><p>
The <code class="option">-block</code> option queries a DNS list for each connecting IP
address. The only required argument to <code class="option">-block</code> is the DNS zone
that is used to publish thelist. The name of the zone can optionally be
followed by a comma and the name of the environment variable to set if the
DNS list includes the IP address. <span><strong class="command">couriertcpd</strong></span> sets the
environment variable <code class="envar">BLOCK</code> if you do not specify the name
yourself.</p><p>
The name of the environment variable can be optionally followed by a slash
and an IP address. Normally <span><strong class="command">couriertcpd</strong></span> sets the environment
variable if the access list includes any A record entry for the specified IP
address. Some access lists may offer additional information by returning one of
several possible A records. If the name of the environment variable is
followed by a slash and an IP address, the environment variable will be
initialized only if the access list includes an A record containing the
indicated IP address.</p><p>
The contents of the environment variable will be the contents of any TXT
record for the listed IP address. <em class="replaceable"><code>var</code></em>[/<em class="replaceable"><code>n.n.n.n</code></em>] can be
optionally followed by a comma and a text message, which will be used instead
of the TXT record. The text message may include a single @ character
somewhere in it, which will be replaced by the listed IP address.</p></div><div class="refsect2" lang="en" xml:lang="en"><a id="id326272" shape="rect"> </a><h3>MULTIPLE DNS LISTS</h3><p>
Multiple <code class="option">-block</code> options can be used. The connecting IP address
will be looked up in multiple access lists. This is implemented as
follows.</p><p>
<span><strong class="command">couriertcpd</strong></span> processes all <code class="option">-block</code> options
one at
a time. If the indicated environment variable is already set,
<span><strong class="command">couriertcpd</strong></span> skips the DNS list lookup (this is also true if
only one <code class="option">-block</code> option is specified). Therefore, if multiple
<code class="option">-block</code> options are used, and an IP address is found in the
first
access list, the remaininglists that use the same environment variable
will not be checked. But other lists that use a different environment
variable WILL be checked.</p><p>
The same <em class="replaceable"><code>zone</code></em> can be specified more than once,
with different
environment variables and different IP addresses. For example:</p><div class="informalexample"><pre class="programlisting" xml:space="preserve">
couriertcpd -block=block.example.org,BLOCK1/127.0.0.2 \
-block=block.example.org,BLOCK2/127.0.0.3
</pre></div><p>
If the specified access list contains an A record for the listed address,
and the A record contains the IP address 127.0.0.2,
<span><strong class="command">couriertcpd</strong></span>
initializes the <code class="envar">BLOCK1</code> environment variable. If the A record
contains the IP address 127.0.0.3, <span><strong class="command">couriertcpd</strong></span> initializes
<code class="envar">BLOCK2</code>. If both records are present, both variables are
initialized.</p><p>
<span><strong class="command">couriertcpd</strong></span> uses the following logic to determine what kind
of DNS query to issue:</p><p>
If neither the IP address, nor <em class="replaceable"><code>msg</code></em> is specified,
<span><strong class="command">couriertcpd</strong></span> will query for existence of TXT records, for the
IP address.</p><p>
If only <em class="replaceable"><code>msg</code></em> is specified,
<span><strong class="command">couriertcpd</strong></span> looks up the
existence of A records, for the IP address.</p><p>
If <em class="replaceable"><code>/n.n.n.n</code></em> is used, and
<em class="replaceable"><code>msg</code></em> is not specified for at least
one <code class="option">-block</code> option for this same zone,
<span><strong class="command">couriertcpd</strong></span>
will query for existence of ANY records, which should return both TXT and all
the A records for this IP address.</p><p>
If <em class="replaceable"><code>/n.n.n.n</code></em> is used, and
<em class="replaceable"><code>msg</code></em> is specified for every
<code class="option">-block</code> option for this same zone,
<span><strong class="command">couriertcpd</strong></span> will
query for existence of A records only.</p></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id326439" shape="rect"> </a><h2>ENVIRONMENT VARIABLES</h2><p>
<span><strong class="command">couriertcpd</strong></span> also initializes the following environment
variables prior to running <span><strong class="command">program</strong></span>:</p><div class="variablelist"><dl><dt><span class="term">TCPLOCALHOST</span></dt><dd><p>
The name of the host on the local end of
the network connection, looked up in DNS. <code class="envar">TCPLOCALHOST</code> will
not be set if the IP address of the network connection's local end cannot
be found in DNS, or if <code class="option">-nodnslookup</code> option is specified.
<code class="envar">TCPLOCALHOST</code> will be set to the string
<span class="errorcode">softdnserr</span> if the DNS lookup fails with a temporary
error
(so you cannot tell if the IP address has a valid host name associated
with it), or if the reverse and forward DNS lookups do not match.
<code class="envar">TCPLOCALHOST</code> will not be set if the reverse DNS lookup fails
completely.</p></dd><dt><span class="term">TCPLOCALIP</span></dt><dd><p>
The IP address of the local end of the network connection.</p></dd><dt><span class="term">TCPLOCALPORT</span></dt><dd><p>
Rhe number of the port of the local end of the network connection.</p></dd><dt><span class="term">TCPREMOTEHOST</span></dt><dd><p>
The hostname of the connecting host. Like
<code class="envar">TCPLOCALHOST</code>, but for the connecting IP address.</p></dd><dt><span class="term">TCPREMOTEIP</span></dt><dd><p>
Connecting IP address.</p></dd><dt><span class="term">TCPREMOTEINFO</span></dt><dd><p>
Identification string received from the
IDENT server on the remote IP address. Not set if the IDENT server
returned an error, or if the <code class="option">-noidentlookup</code> option was
specified.</p></dd><dt><span class="term">TCPREMOTEPORT</span></dt><dd><p>
TCP port of the remote end of the network connection.</p></dd></dl></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id326592" shape="rect"> </a><h2>SEE ALSO</h2><p>
<a href="courier.html" target="_top" shape="rect"><span class="citerefentry"><span class="refentrytitle">courier</span>(8)</span></a>.</p></div></div></body></html>
|
