1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
--- tcp_wrappers_7.6.orig/hosts_access.5 1995-01-30 19:51:47.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.5 2009-06-05 18:45:03.000000000 +0200
@@ -8,9 +8,9 @@ name, host name/address) patterns. Exam
impatient reader is encouraged to skip to the EXAMPLES section for a
quick introduction.
.PP
-An extended version of the access control language is described in the
-\fIhosts_options\fR(5) document. The extensions are turned on at
-program build time by building with -DPROCESS_OPTIONS.
+The extended version of the access control language is described in the
+\fIhosts_options\fR(5) document. \fBNote that this language supersedes
+the meaning of \fIshell_command\fB as documented below.\fR
.PP
In the following text, \fIdaemon\fR is the the process name of a
network daemon process, and \fIclient\fR is the name and/or address of
@@ -40,7 +40,7 @@ A newline character is ignored when it i
character. This permits you to break up long lines so that they are
easier to edit.
.IP \(bu
-Blank lines or lines that begin with a `#\' character are ignored.
+Blank lines or lines that begin with a `#' character are ignored.
This permits you to insert comments and whitespace so that the tables
are easier to read.
.IP \(bu
@@ -69,26 +69,33 @@ checks are case insensitive.
.SH PATTERNS
The access control language implements the following patterns:
.IP \(bu
-A string that begins with a `.\' character. A host name is matched if
+A string that begins with a `.' character. A host name is matched if
the last components of its name match the specified pattern. For
-example, the pattern `.tue.nl\' matches the host name
-`wzv.win.tue.nl\'.
+example, the pattern `.tue.nl' matches the host name
+`wzv.win.tue.nl'.
.IP \(bu
-A string that ends with a `.\' character. A host address is matched if
+A string that ends with a `.' character. A host address is matched if
its first numeric fields match the given string. For example, the
-pattern `131.155.\' matches the address of (almost) every host on the
+pattern `131.155.' matches the address of (almost) every host on the
Eind\%hoven University network (131.155.x.x).
.IP \(bu
-A string that begins with an `@\' character is treated as an NIS
+A string that begins with an `@' character is treated as an NIS
(formerly YP) netgroup name. A host name is matched if it is a host
member of the specified netgroup. Netgroup matches are not supported
for daemon process names or for client user names.
.IP \(bu
-An expression of the form `n.n.n.n/m.m.m.m\' is interpreted as a
-`net/mask\' pair. A host address is matched if `net\' is equal to the
-bitwise AND of the address and the `mask\'. For example, the net/mask
-pattern `131.155.72.0/255.255.254.0\' matches every address in the
-range `131.155.72.0\' through `131.155.73.255\'.
+An expression of the form `n.n.n.n/m.m.m.m' is interpreted as a
+`net/mask' pair. A host address is matched if `net' is equal to the
+bitwise AND of the address and the `mask'. For example, the net/mask
+pattern `131.155.72.0/255.255.254.0' matches every address in the
+range `131.155.72.0' through `131.155.73.255'.
+.IP \(bu
+A string that begins with a `/' character is treated as a file
+name. A host name or address is matched if it matches any host name
+or address pattern listed in the named file. The file format is
+zero or more lines with zero or more host name or address patterns
+separated by whitespace. A file name pattern can be used anywhere
+a host name or address pattern can be used.
.SH WILDCARDS
The access control language supports explicit wildcards:
.IP ALL
@@ -115,19 +122,19 @@ without -DPARANOID when you want more co
.ne 6
.SH OPERATORS
.IP EXCEPT
-Intended use is of the form: `list_1 EXCEPT list_2\'; this construct
+Intended use is of the form: `list_1 EXCEPT list_2'; this construct
matches anything that matches \fIlist_1\fR unless it matches
\fIlist_2\fR. The EXCEPT operator can be used in daemon_lists and in
client_lists. The EXCEPT operator can be nested: if the control
-language would permit the use of parentheses, `a EXCEPT b EXCEPT c\'
-would parse as `(a EXCEPT (b EXCEPT c))\'.
+language would permit the use of parentheses, `a EXCEPT b EXCEPT c'
+would parse as `(a EXCEPT (b EXCEPT c))'.
.br
.ne 6
.SH SHELL COMMANDS
If the first-matched access control rule contains a shell command, that
command is subjected to %<letter> substitutions (see next section).
The result is executed by a \fI/bin/sh\fR child process with standard
-input, output and error connected to \fI/dev/null\fR. Specify an `&\'
+input, output and error connected to \fI/dev/null\fR. Specify an `&'
at the end of the command if you do not want to wait until it has
completed.
.PP
@@ -159,7 +166,7 @@ depending on how much information is ava
.IP %u
The client user name (or "unknown").
.IP %%
-Expands to a single `%\' character.
+Expands to a single `%' character.
.PP
Characters in % expansions that may confuse the shell are replaced by
underscores.
@@ -243,9 +250,9 @@ A positive IDENT lookup result (the clie
less trustworthy. It is possible for an intruder to spoof both the
client connection and the IDENT lookup, although doing so is much
harder than spoofing just a client connection. It may also be that
-the client\'s IDENT server is lying.
+the client's IDENT server is lying.
.PP
-Note: IDENT lookups don\'t work with UDP services.
+Note: IDENT lookups don't work with UDP services.
.SH EXAMPLES
The language is flexible enough that different types of access control
policy can be expressed with a minimum of fuss. Although the language
@@ -285,7 +292,7 @@ ALL: LOCAL @some_netgroup
.br
ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
.PP
-The first rule permits access from hosts in the local domain (no `.\'
+The first rule permits access from hosts in the local domain (no `.'
in the host name) and from members of the \fIsome_netgroup\fP
netgroup. The second rule permits access from all hosts in the
\fIfoobar.edu\fP domain (notice the leading dot), with the exception of
@@ -322,8 +329,8 @@ in.tftpd: LOCAL, .my.domain
/etc/hosts.deny:
.in +3
.nf
-in.tftpd: ALL: (/some/where/safe_finger -l @%h | \\
- /usr/ucb/mail -s %d-%h root) &
+in.tftpd: ALL: (/usr/sbin/safe_finger -l @%h | \\
+ /usr/bin/mail -s %d-%h root) &
.fi
.PP
The safe_finger command comes with the tcpd wrapper and should be
@@ -349,7 +356,7 @@ control rule; when the length of an acce
capacity of an internal buffer; when an access control rule is not
terminated by a newline character; when the result of %<letter>
expansion would overflow an internal buffer; when a system call fails
-that shouldn\'t. All problems are reported via the syslog daemon.
+that shouldn't. All problems are reported via the syslog daemon.
.SH FILES
.na
.nf
|
