| |
COURIERTCPD(1) COURIERTCPD(1)
NAME
couriertcpd - Courier TCP server daemon
SYNOPSIS
couriertcpd [ -pid=pidfile ] [ option ... ] list program arg ...
couriertcpd -pid=pidfile -stop
couriertcpd -pid=pidfile -restart
DESCRIPTION
couriertcpd accepts incoming network connections, and runs program
after establishing each network connection. The program's standard
input and output are set to the network connection.
list is a comma-separated list of TCP port numbers where incoming con-
nections are created. program is the program to run. If program
requires any arguments, they are specified on the command line, after
program itself.
Before running program, couriertcpd initializes several environment
variables that describe the network connection. The environment inher-
ited by program will be the environment inherited by couriertcpd, plus
any additional environment variables initialized by couriertcpd. It is
also possible to reject certain network connections. Several options
are available to specify which network connections will be rejected.
OPTIONS
-access=filename
Specifies an optional access file. The access file lists the IP
addresses from which connections should be accepted or rejected.
The access file is also used to initialize environment variables
based on the IP address of the connection. filename is a GDBM or
DB database file that's usually created by a script from one or
more text files. See "ACCESS FILE" below for more information.
-accesslocal
Lookup the local interface IP and port in the access file, in
addition to looking up the remote IP. This gives a mechanism for
setting environment variables depending on which IP address
and/or port the client connected to. In the access file,
"1.2.3.4.25" matches connections to IP address 1.2.3.4 port 25;
"1.2.3.4" matches connections to IP address 1.2.3.4 on any port;
and "*.25" matches connections to port 25 on any IP address.
-address=n.n.n.n
Accept network connections only to IP address n.n.n.n. If not
specified, couriertcpd accepts connections to any IP address
that the system accepts connections on. If the system has multi-
ple network interfaces with separate IP addresses, this option
makes couriertcpd accept connections only to one specific IP
address. Most systems have multiple network interfaces: the
loopback interface, plus the local network interface, so that
-address=127.0.0.1 accepts connections only from the local sys-
tem. When multiple port numbers are specified, it is also possi-
ble to selectively bind different network addresses to each port
number when list specifies more than one port number. See "Mul-
tiple port list" below for more information.
-block=zone[,var[/n.n.n.n][,msg]]
Initialize the environment variable var if both of the following
conditions are true: var is not already initialized; the con-
necting IP address can be found in a DNS-based list. See DNS
ACCESS LISTS, below. Multiple -block options can be used.
-denymsg=text
Specifies an optional message to be returned to the client if
the -access option rejects them. The default is to drop the TCP
connection without sending back any messages.
-group=group
Set couriertcpd's its group ID. group may be specified numeri-
cally, or by its name. Only the superuser may use -group.
-listen=n
Length of the queue which holds pending connections. n is a
number. If not specified, the system default is used.
-maxperc=n
Maximum number of connections accepted from the same C network
block. Using this option is recommended, because connection
slots are limited. Without this option, the same C network block
can potentially use up all available connection slots.
-maxperip=n
Maximum number of connections accepted from the same IP address.
Use both the -maxperc and -maxperip options to fine tune connec-
tion limits. For example, when couriertcpd is listening on the
SMTP port it makes sense to set an upper limit on the number of
connections from the same C block. Domains that send a large
amount of mail often have multiple servers sending outbound mail
from the same C block, so it makes sense to set limits on indi-
vidual C blocks. On the other hand, if couriertcpd is listening
on the POP3 port it makes more sense to set limits on individual
IP addresses. If a C block of addresses is assigned to a dialup
modem pool, it is certainly possible to have many IP addresses
within the same C block have connections to the POP3 server at
the same time.
-maxprocs=n
Maximum number of connection slots, or the maximum number of
processes started. This effectively specifies the maximum number
of connections accepted at the same time. After the maximum num-
ber of connections has been opened, couriertcpd waits for an
existing connection to close, before accepting any more connec-
tions.
-warn=n
Log a LOG_WARNING message to syslog when the number of active
processes exceeds n. The default is 90% of maxprocs. couri-
ertcpd logs a LOG_ALERT syslog message when the number of active
processes reaches the maximum.
-nodnslookup
Do not look up the hostname associated with connecting IP
address and the local addres, do not initialize the TCPREMOTE-
HOST or TCPLOCALHOST environment variables (see below).
-noidentlookup
Do not perform an ident lookup, and do not initialize the TCPRE-
MOTEINFO environment variable.
-pid=filename
If given, couriertcpd puts itself into the background and saves
its process ID in this file, usually somewhere in /var/run.
This option must also be present when using the -restart and
-stop options.
-restart
Send a SIGHUP to an existing couriertcpd process. Specify the
same -pid argument as the one that was used to start couri-
ertcpd. The process ID is read from the -pid file, and the
couriertcpd receives a SIGHUP signal.
-stderr=socket
Set program's standard error to the network connection, just
like its standard input and output.
-stderr=logfile
Set program's standard error to the specified file, logfile.
The file is created, if necessary, and is opened in append mode.
-stderrlogger=logprogram
Set program's standard error to a pipe, which is read by logpro-
gram. Only one instance of logger is started, which receives
standard error from every instance of program. The specified
logger is executed with the output end of the stderr pipe con-
nected as standard input. logprogram is executed with one argu-
ment - program's name.
-stderrloggername=name
Use name as the argument to logprogram, instead of the program's
name.
-stop Stop (kill) an existing couriertcpd process. Specify the same
-pid argument as the one that was used to start couriertcpd. The
process ID is read from the -pid file, and the couriertcpd
process is killed. All child processes of couriertcpd will
receive a SIGTERM signal.
-user=user
Set couriertcpd's user ID. Also, the group ID is set to the
user's group ID. Using both -group and -user is not necessary.
Only the superuser can specify -user.
MULTIPLE PORT LIST
The list argument can be a comma-separated list of multiple port num-
bers. couriertcpd will create network connections on any listed port.
Each port number can be optionally specified as "address.port", for
example:
couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,999 program
This instance accepts network connections to either port 25 or port
999, however connections on port 25 are created only on the IP address
127.0.0.1, the loopback interface.
Whenever an IP address is not specified, network connections are
accepted to any IP address (called "wildcarding"). On IPv6-capable sys-
tems, couriertcpd will attempt to create two incoming network connec-
tion ports, if an IP address is not specified. After creating the first
port as an IPv6 wildcard port, couriertcpd will then attept to create
an IPv4 wildcard port, with the same port number. Some BSD-derived sys-
tems must use separate IPv6 and IPv4 wildcard ports to create incoming
network connections. Most other systems only need an IPv6 port to cre-
ate both IPv6 and IPv4 incoming network connections. couriertcpd qui-
etly ignores a failure to create an IPv4 wildcard port, as long as an
IPv6 wildcard was succesfully created.
The -address option can be used to default a specific IP address for
every listed port number. For example:
couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,127.0.0.1.999 program
and
couriertcpd -pid=/var/run/smtp.pid -address=127.0.0.1 25,999 program
will create network connections on ports 25 and 999 of the IP address
127.0.0.1.
ACCESS FILE
The access file lists IP addresses that couriertcpd will accept or
reject connections from. An access file is optional. Without an access
file couriertcpd accepts a connection from any IP address.
Both IPv4 and IPv6 addresses can be specified, if IPv6 support is
available. A non-standard syntax is currently used to specify IPv6
addresses. This is subject to change in the near future. IPv6 support
is currently considered to be experimental.
The access file is a binary database file that's usually created by a
script, such as makesmtpaccess(8), from one or more plain text files.
Blank lines in the text file are ignored. Lines that start with the #
character are also ignored.
REJECTING AND ACCEPTING CONNECTIONS BY IP ADDRESS
The following line instructs couriertcpd to reject all connections from
an IP address range:
netblockdeny
netblock is an IP address, such as 192.68.0.2. is the ASCII tab
character. There MUST be exactly one tab character after the IP address
and the word "deny".
You can also block connections from an entire network C block:
192.68.0deny
This blocks connections from IP addresses 192.68.0.0 through
192.68.0.255. Blocking connections from an entire B or A network block
works the same way.
Use the word "allow" instead of "deny" to explicitly allow connections
from that IP address or netblock. For example:
192.68.0deny
192.68.0.10allow
This blocks all connections from 192.68.0.0 to 192.68.0.255 except for
192.68.0.10. These two lines can occur in any order. couriertcpd
always uses the line with the most specific IP address.
If the IP address of the connection is not found in the access file the
connection is accepted by default. The following line causes unlisted
connections to be rejected:
*deny
IPV6 ADDRESSES
Note: IPv6 support in the access file is experimental, and is
subject to change in a future release. The following syntax is
subject to change at any time.
The access file can also specify IPv6 addresses, if IPv6 support is
available. The existing IPv4 address format is used for IPv6-mapped
IPv4 addresses, and no changes are required. For all other IPv6
addresses use the following format:
:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhhaction
The IPv6 address must begin with :. The initial : character is not
really a part of the IPv6 address, it is only used to designate this
record as an IPv6 address, allowing an access file to contain a mixture
of IPv4 and IPv6 addresses. The IPv6 address follows the initial :
character, and it must be spelled out using zero-padded lowercase hexa-
decimal digits. For example:
:0000:0000:0000:0000:0000:f643:00a2:9354deny
Netblocks must be specified using even-word boundaries only:
:0000:0000:0000:e240deny
This puts the entire ::e240/32 IPv6 CIDR into the access file.
SETTING ENVIRONMENT VARIABLES
allow can be optionally followed by a list of environment variable
assignments, separated by commas. The environment variables are set
before executing program or checking access lists (see below). For
example:
192.68.0allow,RELAYCLIENT
192.68.0.10allow,RELAYCLIENT,SIZELIMIT=1000000
This sets RELAYCLIENT environment variable for connections from the
192.68.0 block. In addition to that, the SIZELIMIT environment variable
is set to 1000000 if the connection comes from the IP address
192.68.0.10.
Note that RELAYCLIENT must be explicitly specified for the IP address
192.68.0.10. The first line is NOT used for connections from this IP
address. couriertcpd only reads one entry from the access file, the
entry for the most specific IP address.
DNS ACCESS LISTS
An alternative to listing banned IP addresses is to use an external
DNS-based IP access list.
There is no provision to support IPv6-based lists, because none yet
exist. IPv6-based access list support will be added in the future.
couriertcpd does not automatically reject connections from any IP
address listed on a DNS-based list. If the connecting IP address is
listed couriertcpd simply sets an environment variable. It's up to the
program, run by couriertcpd, to read the environment variable and
choose what to do if the environment variable is set.
Please note that if the environment variable is already set, couri-
ertcpd will NOT search the access list. This can be used to override
the access list where program only recognizes the access list if the
environment variable is not empty. By setting the environment variable
to an empty string in the access file (see above), you can override
access lists for selected IP addresses.
The -block option queries a DNS list for each connecting IP address.
The only required argument to -block is the DNS zone that is used to
publish thelist. The name of the zone can optionally be followed by a
comma and the name of the environment variable to set if the DNS list
includes the IP address. couriertcpd sets the environment variable
BLOCK if you do not specify the name yourself.
The name of the environment variable can be optionally followed by a
slash and an IP address. Normally couriertcpd sets the environment
variable if the access list includes any A record entry for the speci-
fied IP address. Some access lists may offer additional information by
returning one of several possible A records. If the name of the envi-
ronment variable is followed by a slash and an IP address, the environ-
ment variable will be initialized only if the access list includes an A
record containing the indicated IP address.
The contents of the environment variable will be the contents of any
TXT record for the listed IP address. var[/n.n.n.n] can be optionally
followed by a comma and a text message, which will be used instead of
the TXT record. The text message may include a single @ character some-
where in it, which will be replaced by the listed IP address.
MULTIPLE DNS LISTS
Multiple -block options can be used. The connecting IP address will be
looked up in multiple access lists. This is implemented as follows.
couriertcpd processes all -block options one at a time. If the indi-
cated environment variable is already set, couriertcpd skips the DNS
list lookup (this is also true if only one -block option is specified).
Therefore, if multiple -block options are used, and an IP address is
found in the first access list, the remaininglists that use the same
environment variable will not be checked. But other lists that use a
different environment variable WILL be checked.
The same zone can be specified more than once, with different environ-
ment variables and different IP addresses. For example:
couriertcpd -block=block.example.org,BLOCK1/127.0.0.2 \
-block=block.example.org,BLOCK2/127.0.0.3
If the specified access list contains an A record for the listed
address, and the A record contains the IP address 127.0.0.2, couri-
ertcpd initializes the BLOCK1 environment variable. If the A record
contains the IP address 127.0.0.3, couriertcpd initializes BLOCK2. If
both records are present, both variables are initialized.
couriertcpd uses the following logic to determine what kind of DNS
query to issue:
If neither the IP address, nor msg is specified, couriertcpd will query
for existence of TXT records, for the IP address.
If only msg is specified, couriertcpd looks up the existence of A
records, for the IP address.
If /n.n.n.n is used, and msg is not specified for at least one -block
option for this same zone, couriertcpd will query for existence of ANY
records, which should return both TXT and all the A records for this IP
address.
If /n.n.n.n is used, and msg is specified for every -block option for
this same zone, couriertcpd will query for existence of A records only.
ENVIRONMENT VARIABLES
couriertcpd also initializes the following environment variables prior
to running program:
TCPLOCALHOST
The name of the host on the local end of the network connection,
looked up in DNS. TCPLOCALHOST will not be set if the IP address
of the network connection's local end cannot be found in DNS, or
if -nodnslookup option is specified. TCPLOCALHOST will be set
to the string softdnserr if the DNS lookup fails with a tempo-
rary error (so you cannot tell if the IP address has a valid
host name associated with it), or if the reverse and forward DNS
lookups do not match. TCPLOCALHOST will not be set if the
reverse DNS lookup fails completely.
TCPLOCALIP
The IP address of the local end of the network connection.
TCPLOCALPORT
Rhe number of the port of the local end of the network connec-
tion.
TCPREMOTEHOST
The hostname of the connecting host. Like TCPLOCALHOST, but for
the connecting IP address.
TCPREMOTEIP
Connecting IP address.
TCPREMOTEINFO
Identification string received from the IDENT server on the
remote IP address. Not set if the IDENT server returned an
error, or if the -noidentlookup option was specified.
TCPREMOTEPORT
TCP port of the remote end of the network connection.
SEE ALSO
courier(8).
Double Precision, Inc. 02 July 2005 COURIERTCPD(1)
|