SOCKD.CONF(5)

NAME
sockd.conf - Dante server configuration file syntax

DESCRIPTION
The configuration file for the Dante server controls both access controls and logging. It is divided into two parts, server settings and rules. A line can be commented using the standard comment character #.

SERVER SETTINGS
The server settings control the generic behaviour of the server. Each keyword is separated from it's value by a ':' character.

logouput
    This value controls where the server sends logoutput. It can be either syslog[/facility], stdout, stderr, a filename, or a combination.

internal
    The internal address. Connections will only be accepted on this address. Multiple internal lines may be given.

external
    The address to be used for outgoing connections.

method
    A list of acceptable authentication methods, in order of preference. Supported values are username, none and rfc931. This list is used as the default for all coming rules until changed. Then the changed list is used as the default for the next rules. If a method is not set in this list it will never be selected.

user.privileged
    Username which will be used for doing privileged operations.

user.notprivileged
    User which the server runs as most of the time.

user.libwrap
    User used to execute libwrap commands.

compatibility
    With the sameport keyword, the server attempts to use the same port on the server and the client. This functionality is the default, but when this option is given it will also be done with privileged ports. The reuseaddr keyword might solve problems when the bind extension is used but the effects of enabling reuseaddr is currently unknown, do not enable it unless you understand the effects.

srchost
    With the nomismatch keyword, the server will not accept connects from addresses having a mismatch between DNS address and hostname. Default is to accept them. With the nounknown keyword, the server will not accept connects from addresses without a DNS record. Default is to accept them.

connecttimeout
    The number of seconds a client has to send the request after a connect. Set it to 0 for forever.

iotimeout
    The number of seconds an established connection can be idle. Set it to 0 for forever.

RULES
There are two sets of rules and they work at different levels. Rules prefixed with client are checked first and are used to see if the client is allowed to connect to the Dante server. We will call them "client-rules". It is especially important that these do not use hostnames but only IP addresses, both for security and performance reasons. These rules work at the TCP/IP level. The other rules, which we will call "socks-rules" are a level higher and are checked after the client connection has been accepted by the client-rules. The socks-rules are used to evaluate the socks request that the client sends. They thus work at the socks protocol level. Both set of rules start with a pass/deny keyword (the client-rules have "client" prefixed to the pass/deny keyword) which determines if connections matching the rule are to pass or be blocked. Both set of rules also specify a from/to address pair which gives the addresses the rule will match. In both contexts, from means the clients address. In the client-rule context, to means the address the request is accepted on, i.e. the address the Dante server listens on. In the socks-rule context, to means the client's destination address, as formulated in the client's proxy request. In addition to the addresses there is a set of optional keywords which can be given. There are two forms of keywords, conditions and actions. For each rule, all conditions are checked and if they match the request, the actions are executed. The list of condition keywords is: from, to, command, method, protocol, proxyprotocol, user. The list of actions keywords is: libwrap, log. The format and content of the rules is identical, but client-rules may contain only a subset of the socks-rules. More concrete, they may not contain any keywords related to the socks protocol.

    The contents of the client-rule is be:

from
    The rule applies to requests coming from the address given as value.

to  The rule applies to requests going to the address given as value.

port
    Parameter to from, to and via. Accepts the keywords eq/=, neq/!=, ge/>=, le/<=, gt/>, lt/< followed by a number. A portrange can also be given as "port <start #> - <end #>", which will match all port numbers within the range <start #> and <end #>.

libwrap
    The server will pass the line to libwrap for execution.

log Used to control logging. Accepted keywords are connect, disconnect, data, error and iooperation.

user
    The server will only accept connections from users matching one of the names given as value. If no user value is given, everyone in the passwordfile will be matched. The rule must also allow usernamebased methods.

method
    Require that the connection be "authenticated" using one of the given methods. For client-rules only authenticationmethods that do not depend on the socksprotocol can be used.

    The contents of the socks-rules is:

from
    The rule applies to requests coming from the address given as value.

to  The rule applies to requests going to or using the address given as value. Note that the meaning of this address is affected by command.

port
    Parameter to from, to and via. Accepts the keywords eq/=, neq/!=, ge/>=, le/<=, gt/>, lt/< followed by a number. A portrange can also be given as "port <start #> - <end #>", which will match all port numbers within the range <start #> and <end #>.

command
    The rule applies to the given commands. Valid commands are bind, bindreply, connect, udpassociate and udpreply. Can be used instead of, or to complement, protocol.

libwrap
    The server will pass the line to libwrap for execution.

log Used to control logging. Accepted keywords are connect, disconnect, data and iooperation.

method
    Require that the connection be established using one of the given methods. method always refers to the source part of the rule. Valid values are the same as in the global method line.

protocol
    The rule applies to the given protocols. Valid values are tcp and udp. It is recommended that the command form is used since it provides more accuracy in defining rules.

proxyprotocol
    The rule applies to requests using the given proxyprotocol. Valid proxyprotocols are socks_v4 and socks_v5.

user
    The server will accept connections from users matching one of the names given as value. If no user value is given, everyone in the passwordfile will be matched. The rule must also allow usernamebased methods.

EXAMPLES
See the example directory in the distribution.

FILES
/etc/sockd.conf	Dante server configuration file.
/etc/passwd	file used when checking username/passwords.

AUTHORS
For Inferno Nettverk A/S, Norway:
 Michael Shuldman <michaels@inet.no>: Design and implementation.
 Karl-Andre' Skevik <karls@inet.no>: Autoconf and porting.

SEE ALSO
sockd(8), hosts_access(5)