table of contents
COURIERTCPD(1) | Double Precision, Inc. | COURIERTCPD(1) |
NAME¶
couriertcpd - the Courier mail server TCP server daemonSYNOPSIS¶
couriertcpd
[-pid= pidfile] [option...] {list} {program}
{arg...}
couriertcpd
{-pid= pidfile} {-stop}
couriertcpd
{-pid= pidfile} {-restart}
DESCRIPTION¶
OPTIONS¶
-access= filenameSpecifies an optional access file. The access
file lists the IP addresses from which connections should be accepted or
rejected. The access file is also used to initialize environment variables
based on the IP address of the connection. filename is a GDBM or DB
database file that´s usually created by a script from one or more text
files. See "ACCESS FILE" below for more information.
-accesslocal
Lookup the local interface IP and port in the
access file, in addition to looking up the remote IP. This gives a mechanism
for setting environment variables depending on which IP address and/or port
the client connected to. In the access file, "1.2.3.4.25" matches
connections to IP address 1.2.3.4 port 25; "1.2.3.4" matches
connections to IP address 1.2.3.4 on any port; and "*.25" matches
connections to port 25 on any IP address.
-address= n.n.n.n
Accept network connections only to IP address
n.n.n.n. If not specified, couriertcpd accepts connections to
any IP address that the system accepts connections on. If the system has
multiple network interfaces with separate IP addresses, this option makes
couriertcpd accept connections only to one specific IP address. Most
systems have multiple network interfaces: the loopback interface, plus the
local network interface, so that -address=127.0.0.1 accepts connections only
from the local system. When multiple port numbers are specified, it is also
possible to selectively bind different network addresses to each port number
when list specifies more than one port number. See " Multiple
port list[1]" below for more information.
-block= zone[,var[/n.n.n.n][,msg]]
Initialize the environment variable var
if both of the following conditions are true: var is not already
initialized; the connecting IP address can be found in a DNS-based list. See
DNS ACCESS LISTS, below. Multiple -block options can be used.
-denymsg= text
Specifies an optional message to be returned
to the client if the -access option rejects them. The default is to
drop the TCP connection without sending back any messages.
-drop= var
If the environment variable var is set
to a nonempty value, terminate immediately. Do not run the program to
handle the connection. See DNS ACCESS LISTS, below, for more information.
var defaults to “BLOCK”, if not specified.
-group= group
Set couriertcpd´s its group ID.
group may be specified numerically, or by its name. Only the superuser
may use -group.
-listen= n
Length of the queue which holds pending
connections. n is a number. If not specified, the system default is
used.
-maxperc= n
Maximum number of connections accepted from
the same C network block. Using this option is recommended, because connection
slots are limited. Without this option, the same C network block can
potentially use up all available connection slots.
-maxperip= n
Maximum number of connections accepted from
the same IP address. Use both the -maxperc and -maxperip options
to fine tune connection limits. For example, when couriertcpd is
listening on the SMTP port it makes sense to set an upper limit on the number
of connections from the same C block. Domains that send a large amount of mail
often have multiple servers sending outbound mail from the same C block, so it
makes sense to set limits on individual C blocks. On the other hand, if
couriertcpd is listening on the POP3 port it makes more sense to set
limits on individual IP addresses. If a C block of addresses is assigned to a
dialup modem pool, it is certainly possible to have many IP addresses within
the same C block have connections to the POP3 server at the same time.
-maxprocs= n
Maximum number of connection slots, or the
maximum number of processes started. This effectively specifies the maximum
number of connections accepted at the same time. After the maximum number of
connections has been opened, couriertcpd waits for an existing
connection to close, before accepting any more connections.
-warn= n
Log a LOG_WARNING message to syslog
when the number of active processes exceeds n. The default is 90% of
maxprocs. couriertcpd logs a LOG_ALERT syslog message
when the number of active processes reaches the maximum.
-nodnslookup
Do not look up the hostname associated with
connecting IP address and the local addres, do not initialize the
TCPREMOTEHOST or TCPLOCALHOST environment variables (see
below).
-noidentlookup
Do not perform an ident lookup, and do
not initialize the TCPREMOTEINFO environment variable.
-pid= filename
If given, couriertcpd puts itself into
the background and saves its process ID in this file, usually somewhere in
/var/run.
This option must also be present when using the -restart and -stop
options.
-restart
Send a SIGHUP to an existing
couriertcpd process. Specify the same -pid argument as the one
that was used to start couriertcpd. The process ID is read from the
-pid file, and the couriertcpd receives a SIGHUP signal.
-stderr=socket
Set program´s standard error to
the network connection, just like its standard input and output.
-stderr= logfile
Set program´s standard error to
the specified file, logfile. The file is created, if necessary, and is opened
in append mode.
-stderrlogger= logprogram
Set program´s standard error to a
pipe, which is read by logprogram. Only one instance of logger
is started, which receives standard error from every instance of
program. The specified logger is executed with the output end of
the stderr pipe connected as standard input. logprogram is executed
with one argument - program´s name.
-stderrloggername=name
Use name as the argument to
logprogram, instead of the program´s name.
-stop
Stop (kill) an existing couriertcpd
process. Specify the same -pid argument as the one that was used to
start couriertcpd. The process ID is read from the -pid file,
and the couriertcpd process is killed. All child processes of
couriertcpd will receive a SIGTERM signal.
-user= user
Set couriertcpd´s user ID. Also,
the group ID is set to the user´s group ID. Using both -group and
-user is not necessary. Only the superuser can specify
-user.
MULTIPLE PORT LIST¶
The list argument can be a comma-separated list of multiple port numbers. couriertcpd will create network connections on any listed port. Each port number can be optionally specified as "address.port", for example:couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,999 program
couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,127.0.0.1.999 program
couriertcpd -pid=/var/run/smtp.pid -address=127.0.0.1 25,999 program
ACCESS FILE¶
The access file lists IP addresses that couriertcpd will accept or reject connections from. An access file is optional. Without an access file couriertcpd accepts a connection from any IP address. Both IPv4 and IPv6 addresses can be specified, if IPv6 support is available. A non-standard syntax is currently used to specify IPv6 addresses. This is subject to change in the near future. IPv6 support is currently considered to be experimental. The access file is a binary database file that´s usually created by a script, such as makesmtpaccess(8)[2], from one or more plain text files. Blank lines in the text file are ignored. Lines that start with the # character are also ignored.Rejecting and accepting connections by IP address¶
The following line instructs couriertcpd to reject all connections from an IP address range:netblock<tab>deny
192.68.0<tab>deny
192.68.0<tab>deny 192.68.0.10<tab>allow
*<tab>deny
IPv6 addresses¶
:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh<tab> action
:0000:0000:0000:0000:0000:f643:00a2:9354<tab>deny
:3ffe<tab>deny
:2002:c0a8<tab>deny
Setting environment variables¶
192.68.0<tab>allow,RELAYCLIENT 192.68.0.10<tab>allow,RELAYCLIENT,SIZELIMIT=1000000
DNS ACCESS LISTS¶
An alternative to listing banned IP addresses is to use an external DNS-based IP access list. There is no provision to support IPv6-based lists, because none yet exist. IPv6-based access list support will be added in the future.MULTIPLE DNS LISTS¶
Multiple -block options can be used. The connecting IP address gets looked up in multiple access lists. This is implemented as follows.couriertcpd -block=block.example.org,BLOCK1/127.0.0.2 \ -block=block.example.org,BLOCK2/127.0.0.3
ENVIRONMENT VARIABLES¶
The name of the host on the local end of the
network connection, looked up in DNS. TCPLOCALHOST will not be set if
the IP address of the network connection´s local end cannot be found in
DNS, or if -nodnslookup option is specified. TCPLOCALHOST will
be set to the string softdnserr if the DNS lookup fails with a
temporary error (so you cannot tell if the IP address has a valid host name
associated with it), or if the reverse and forward DNS lookups do not match.
TCPLOCALHOST will not be set if the reverse DNS lookup fails
completely.
TCPLOCALIP
The IP address of the local end of the network
connection.
TCPLOCALPORT
Rhe number of the port of the local end of the
network connection.
TCPREMOTEHOST
The hostname of the connecting host. Like
TCPLOCALHOST, but for the connecting IP address.
TCPREMOTEIP
Connecting IP address.
TCPREMOTEINFO
Identification string received from the IDENT
server on the remote IP address. Not set if the IDENT server returned an
error, or if the -noidentlookup option was specified.
TCPREMOTEPORT
TCP port of the remote end of the network
connection.
SEE ALSO¶
AUTHOR¶
Sam VarshavchikAuthor
NOTES¶
- 1.
- Multiple port list
[set
$man.base.url.for.relative.links]/#list
[set
$man.base.url.for.relative.links]/makesmtpaccess.html
- 3.
- courier(8)
[set
$man.base.url.for.relative.links]/courier.html
04/04/2011 | Courier Mail Server |