Subject: lib/6836: fixes for librwrap hosts_access(5) manual page
To: None <firstname.lastname@example.org>
From: None <email@example.com>
Date: 01/18/1999 12:08:56
>Synopsis: fixes for librwrap hosts_access(5) manual page
>Responsible: lib-bug-people (Library Bug People)
>Arrival-Date: Mon Jan 18 09:20:00 1999
>Originator: Greg A. Woods
Planix, Inc.; Toronto, Ontario; Canada
System: NetBSD 1.3I
hosts_access(5) does not mention line length limitations.
There are also some minor formatting problems with the manual
line numbers may be off....
RCS file: /cvs/NetBSD/src/lib/libwrap/hosts_access.5,v
retrieving revision 188.8.131.52
diff -u -r184.108.40.206 hosts_access.5
--- lib/libwrap/hosts_access.5 1998/02/20 00:33:03 220.127.116.11
+++ lib/libwrap/hosts_access.5 1998/10/25 03:17:25
@@ -2,10 +2,7 @@
-request_set \- format of host access control files
+hosts.deny \- format of host access control files
This manual page describes a simple access control language that is
based on client (host name/address, user name), and server (process
@@ -26,7 +23,7 @@
network daemon process, and \fIclient\fR is the name and/or address of
a host requesting service. Network daemon process names are specified
in the inetd configuration file.
-.SH ACCESS CONTROL FILES
+.SH "ACCESS CONTROL FILES"
The access control software consults two files. The search stops
at the first match:
@@ -41,14 +38,15 @@
A non-existing access control file is treated as if it were an empty
file. Thus, access control can be turned off by providing no access
-.SH ACCESS CONTROL RULES
+.SH "ACCESS CONTROL RULES"
Each access control file consists of zero or more lines of text. These
lines are processed in order of appearance. The search terminates when a
match is found.
A newline character is ignored when it is preceded by a backslash
-character. This permits you to break up long lines so that they are
-easier to edit.
+character. This permits you to break up long lines so that they are
+easier to edit. \fBWARNING:\fP The total length of an entry can be no
+more than 2047 characters long including the final newline.
Blank lines or lines that begin with a `#\' character are ignored.
This permits you to insert comments and whitespace so that the tables
@@ -160,7 +162,7 @@
Characters in % expansions that may confuse the shell are replaced by
-.SH SERVER ENDPOINT PATTERNS
+.SH "SERVER ENDPOINT PATTERNS"
In order to distinguish clients by the network address that they
connect to, use patterns of the form:
@@ -179,7 +181,7 @@
The host_pattern obeys the same syntax rules as host names and
addresses in client_list context. Usually, server endpoint information
is available only with connection-oriented services.
-.SH CLIENT USERNAME LOOKUP
+.SH "CLIENT USERNAME LOOKUP"
When the client host supports the RFC 931 protocol or one of its
descendants (TAP, IDENT, RFC 1413) the wrapper programs can retrieve
additional information about the owner of a connection. Client username
@@ -223,7 +225,7 @@
would match members of the pc netgroup without doing username lookups,
but would perform username lookups with all other systems.
-.SH DETECTING ADDRESS SPOOFING ATTACKS
+.SH "DETECTING ADDRESS SPOOFING ATTACKS"
A flaw in the sequence number generator of many TCP/IP implementations
allows intruders to easily impersonate trusted hosts and to break in
via, for example, the remote shell service. The IDENT (RFC931 etc.)
@@ -257,7 +259,7 @@
The examples use host and domain names. They can be improved by
including address and/or network/netmask information, to reduce the
impact of temporary name server lookup failures.
-.SH MOSTLY CLOSED
+.SH "MOSTLY CLOSED"
In this case, access is denied by default. Only explicitly authorized
hosts are permitted access.
@@ -287,7 +289,7 @@
netgroup. The second rule permits access from all hosts in the
\fIfoobar.edu\fP domain (notice the leading dot), with the exception of
-.SH MOSTLY OPEN
+.SH "MOSTLY OPEN"
Here, access is granted by default; only explicitly specified hosts are
@@ -303,7 +305,7 @@
The first rule denies some hosts and domains all services; the second
rule still permits finger requests from other hosts and domains.
-.SH BOOBY TRAPS
+.SH "BOOBY TRAPS"
The next example permits tftp requests from hosts in the local domain
(notice the leading dot). Requests from any other hosts are denied.
Instead of the requested file, a finger probe is sent to the offending
@@ -354,15 +356,18 @@
/etc/hosts.deny, (daemon,client) pairs that are denied access.
-.SH SEE ALSO
+.SH "SEE ALSO"
-tcpdchk(8), tcpdmatch(8), test programs.
+hosts_options(5), tcpdchk(8), tcpdmatch(8), test programs.
If a name server lookup times out, the host name will not be available
to the access control software, even though the host is registered.
Domain name server lookups are case insensitive; NIS (formerly YP)
netgroup lookups are case sensitive.
+The total length of an entry can be no more than 2047 characters long,
+including the final newline.