ldirectord

package: ldirectord

title: ldirectord(8)

summary: Linux Director Daemon

text:
# ldirectord(8)

## NAME
ldirectord - Linux Director Daemon

Daemon to monitor remote services and control Linux Virtual Server

## SYNOPSIS
ldirectord [-d|--debug] [--] [configfile] start | stop | restart | try-restart | reload | force-reload | status

ldirectord [-h|-?|--help|-v|--version]

## DESCRIPTION
ldirectord is a daemon to monitor and administer real servers in a cluster of load balanced virtual servers. ldirectord typically is started from heartbeat but can also be run from the command line. On startup ldirectord reads the file /etc/ha.d/conf/configuration. After parsing the file, entries for virtual servers are created on the LVS. Now at regular intervals the specified real servers are monitored and if they are considered alive, added to a list for each virtual server. If a real server fails, it is removed from that list. Only one instance of ldirectord can be started for each configuration, but more instances of ldirectord may be started for different configurations. This helps to group clusters of services. Normally one would put an entry inside /etc/ha.d/haresources

nodename virtual-ip-address ldirectord::configuration

to start ldirectord from heartbeat.

## OPTIONS
configuration: This is the name for the configuration as specified in the file /etc/ha.d/conf/configuration

-d|--debug Don't start as daemon and log verbosely.

-h|--help Print user manual and exit.

-v|--version Print version and exit.

start the daemon for the specified configuration.

stop the daemon for the specified configuration. This is the same as sending a TERM signal to the running daemon.

restart the daemon for the specified configuration. The same as stopping and starting.

reload the configuration file. This is only useful for modifications inside a virtual server entry. It will have no effect on adding or removing a virtual server block. This is the same as sending a HUP signal to the running daemon.

status of the running daemon for the specified configuration.

## SYNTAX

### Description of how to write configuration files
virtual = (ip_address|hostname:portnumber|servicename)|firewall-mark

Defines a virtual service by IP-address (or hostname) and port (or servicename) or firewall-mark. A firewall-mark is an integer greater than zero. The configuration of marking packets is controlled using the "-m" option to ipchains(8). All real services and flags for a virtual service must follow this line immediately and be indented.

checktimeout = n

Timeout in seconds for connect, external, external-perl and ping checks. If the timeout is exceeded then the real server is declared dead.

If defined in a virtual server section then the global value is overridden.

If undefined then the value of negotiatetimeout is used. negotiatetimeout is also a global value that may be overridden by a per-virtual setting.

If both checktimeout and negotiatetimeout are unset, the default is used.

Default: 5 seconds

negotiatetimeout = n

Timeout in seconds for negotiate checks.

If defined in a virtual server section then the global value is overridden.

If undefined then the value of checktimeout is used. checktimeout is also a global value that may be overridden by a per-virtual setting.

If both negotiatetimeout and checktimeout are unset, the default is used.

Default: 30 seconds

checkinterval = n

Defines the number of second between server checks.

When fork=no this option defines the amount of time ldirectord sleeps between running all of the realserver checks in all virtual service pools.

When fork=yes this option defines the amount of time each forked child sleeps per virtual service pool after running all realserver checks for that pool.

If set in the virtual server section then the global value is overridden, but ONLY if using forking mode (fork = yes).

Default: 10 seconds

checkcount = n

This option is deprecated and slated for removal in a future version. Please see the 'failurecount' option.

The number of times a check will be attempted before it is considered to have failed. Only works with ping checks. Note that the checktimeout/negotiatetimeout is additive, so if a connect check is used, checkcount is 3 and checktimeout is 2 seconds, then a total of 6 seconds worth of timeout will occur before the check fails.

If defined in a virtual server section then the global value is overridden.

Default: 1

failurecount = n

The number of consecutive times a failure will have to be reported by a check before the realserver is considered to have failed. A value of 1 will have the realserver considered failed on the first failure. A successful check will reset the failure counter to 0.

If defined in a virtual server section then the global value is overridden.

Default: 1

autoreload = yes | no

Defines if <ldirectord> should continuously check the configuration file for modification. If this is set to 'yes' and the configuration file changed on disk and its modification time (mtime) is newer than the previous version, the configuration is automatically reloaded.

Default: no

callback = "/path/to/callback"

If this directive is defined, ldirectord automatically calls the executable /path/to/callback after the configuration file has changed on disk. This is useful to update the configuration file through scp on the other heartbeated host. The first argument to the callback is the name of the configuration.

This directive might also be used to restart ldirectord automatically after the configuration file changed on disk. However, if autoreload is set to yes, the configuration is reloaded anyway.

fallback = ip_address|hostname[:portnumber|sercvicename] [gate | masq | ipip]

the server onto which a webservice is redirected if all real servers are down. Typically this would be 127.0.0.1 with an emergency page.

If defined in a virtual server section then the global value is overridden.

fallbackcommand = "path to script"

If this directive is defined, the supplied script is executed whenever all real servers for a virtual service are down or when the first real server comes up again. In the first case, it is called with "start" as its first argument, in the latter with "stop". Additional parameters are vserver with vport (vserver:vport) as second param and protocol (tcp/udp) as third param to identify the virtual service within the fallback script.

If defined in a virtual server section then the global value is overridden.

logfile = "/path/to/logfile"|syslog_facility

An alternative logfile might be specified with this directive. If the logfile does not have a leading '/', it is assumed to be a syslog(3) facility name.

Default: log directly to the file /var/log/ldirectord.log.

emailalert = "emailaddress[, emailaddress]..."

A valid email address for sending alerts about the changed connection status to any real server defined in the virtual service. This option requires perl module MailTools to be installed. Automatically tries to send email using any of the built-in methods. See perldoc Mail::Mailer for more info on methods.

Multiple addresses may be supplied, comma delimited.

If defined in a virtual server section then the global value is overridden.

emailalertfrom = emailaddress

A valid email address to use as the from address of the email alerts. You can use a plain email address or any RFC-compliant string for the From header in the body of an email message (such as: "ldirectord Alerts" <alerts@example.com>) Do not quote this string unless you want the quotes passed in as part of the From header.

Default: unset, take system generated default (probably root@hostname)

emailalertfreq = n

Delay in seconds between repeating email alerts while any given real server in the virtual service remains inaccessible. A setting of zero seconds will inhibit the repeating alerts. The email timing accuracy of this setting is dependent on the number of seconds defined in the checkinterval configuration option.

If defined in a virtual server section then the global value is overridden.

Default: 0

emailalertstatus = all | none | starting | running | stopping | reloading,...

Comma delimited list of server states in which email alerts should be sent. all is a short-hand for "starting,running,stopping,reloading". If none is specified, no other option may be specified, otherwise options are ored with each other.

If defined in a virtual server section then the global value is overridden.

Default: all

smtp = ip_address|hostname"

A valid SMTP server address to use for sending email via SMTP.

If defined in a virtual server section then the global value is overridden.

execute = "configuration"

Use this directive to start an instance of ldirectord for the named configuration.

supervised = yes | no

If yes, then ldirectord does not go into background mode. All log-messages are redirected to stdout instead of a logfile. This is useful to run ldirectord supervised from daemontools. See http://untroubled.org/rpms/daemontools/ or http://cr.yp.to/daemontools.html for details.

Default: no

fork = yes | no

If yes, then ldirectord will spawn a child process for every virtual server, and run checks against the real servers from them. This will increase response times to changes in real server status in configurations with many virtual servers. This may also use less memory then running many separate instances of ldirectord. Child processes will be automatically restarted if they die.

Default: no

quiescent = yes | no

If yes, then when real or failback servers are determined to be down, they are not actually removed from the kernel's LVS table. Rather, their weight is set to zero which means that no new connections will be accepted.

This has the side effect, that if the real server has persistent connections, new connections from any existing clients will continue to be routed to the real server, until the persistent timeout can expire. See ipvsadm for more information on persistent connections.

This side-effect can be avoided by running the following:

echo 1 > /proc/sys/net/ipv4/vs/expire_quiescent_template

If the proc file isn't present this probably means that the kernel doesn't have LVS support, LVS support isn't loaded, or the kernel is too old to have the proc file. Running ipvsadm as root should load LVS into the kernel if it is possible.

If no, then the real or failback servers will be removed from the kernel's LVS table. The default is yes.

If defined in a virtual server section then the global value is overridden.

Default: yes

readdquiescent = yes | no

If yes, then when real or failback servers are determined to be down, they are readded to the kernel's LVS table with weight 0 if they do not exist in the table. Setting the value to no, allows manually removing the realserver to manually disable all persistent connections.

cleanstop = yes | no

If yes, then when ldirectord exits it will remove all of the virtual server pools that it is managing from the kernel's LVS table.

If no, then the virtual server pools it is managing and any real or failback servers listed in them at the time ldirectord exits will be left as-is. If you want to be able to stop ldirectord without having traffic to your realservers interrupted you will want to set this to no.

If defined in a virtual server section then the global value is overridden.

Default: yes

maintenancedir = directoryname

If this option is set ldirectord will look for a special file in the specified directory and, if found, force the status of the real server identified by the file to down, skipping the normal health check. This would be useful if you wish to force servers down for maintenance without having to modify the actual ldirectord configuration file.

For example, given a realserver with IP 172.16.1.2, service on port 4444, and a resolvable reverse DNS entry pointing to "realserver2.example.com" ldirectord will check for the existence of the following files:

172.16.1.2:4444

172.16.1.2

realserver2.example.com:4444

realserver2.example.com

realserver2:4444

realserver2

If any one of those files is found then ldirectord will immediately force the status of the server to down as if the check had failed.

Note: Since it checks for the IP/hostname without the port this means you can decide to place an entire realserver into maintenance across a large number of virtual service pools with a single file (if you were going to reboot the server, for instance) or include the port number and put just a particular service into maintenance.

This option is not valid in a virtual server section.

Default: disabled

### Section virtual
The following commands must follow a virtual entry and must be indented with a minimum of 4 spaces or one tab.

real = ip_address|hostname[->ip_address|hostname][:portnumber|servicename] gate | masq | ipip [weight] ["request", "receive"] [ "<l:l-threshold>" ] [ "<u:u-threshold>" ]

Defines a real service by IP-address (or hostname) and port (or servicename). If the port is omitted then a 0 will be used, this is intended primarily for fwmark services where the port for real servers is ignored. Optionally a range of IPv4 addresses (or two hostnames) may be given, in which case each IPv4 address in the range will be treated as a real server using the given port. The second argument defines the forwarding method, must be gate, ipip or masq. The third argument is optional and defines the weight for that real server. If omitted then a weight of 1 will be used. The next two arguments are also optional. They define a request-receive pair to be used to check if a server is alive. They override the request-receive pair in the virtual server section. These two strings must be quoted. If the request string starts with http://... the IP-address and port of the real server is overridden, otherwise the IP-address and port of the real server is used. The last two optionals arguments set lower and upper connection thresholds for real servers using -y and -x ipvsadm argument.

###  More than one of these entries may be inside a virtual section. The checktimeout, negotiatetimeout, checkcount, fallback, emailalert, emailalertfreq and quiescent options listed above may also appear inside a virtual section, in which case the global setting is overridden.
checktype = connect | external | external-perl | negotiate | off | on | ping | checktimeoutN

Type of check to perform. Negotiate sends a request and matches a receive string. Connect only attempts to make a TCP/IP connection, thus the request and receive strings may be omitted. If checktype is a number then negotiate and connect is combined so that after each N connect attempts one negotiate attempt is performed. This is useful to check often if a service answers and in much longer intervals a negotiating check is done. Ping means that ICMP ping will be used to test the availability of real servers. Ping is also used as the connect check for UDP services. Off means no checking will take place and no real or fallback servers will be activated. On means no checking will take place and real servers will always be activated. Default is negotiate.

service = dns | ftp | http | https | http_proxy | imap | imaps | ldap | ldaps | mysql | nntp | none | oracle | pgsql | pop | pops | radius | simpletcp | sip | smtp | submission

The type of service to monitor when using checktype=negotiate. None denotes a service that will not be monitored.

simpletcp sends the request string to the server and tests it against the receive regexp. The other types of checks connect to the server using the specified protocol. Please see the request and receive sections for protocol specific information.

Default:

- Virtual server port is 21: ftp

- Virtual server port is 25: smtp

- Virtual server port is 53: dns

- Virtual server port is 80: http

- Virtual server port is 110: pop

- Virtual server port is 119: nntp

- Virtual server port is 143: imap

- Virtual server port is 389: ldap

- Virtual server port is 443: https

- Virtual server port is 587: submission

- Virtual server port is 636 ldaps

- Virtual server port is 993: imaps

- Virtual server port is 995: pops

- Virtual server port is 1521: oracle

- Virtual server port is 1812: radius

- Virtual server port is 3128: http_proxy

- Virtual server port is 3306: mysql

- Virtual server port is 5432: pgsql

- Virtual server port is 5060: sip

- Otherwise: none

checkcommand = "path to script"

This setting is used if checktype is external or external-perl and is the command to be run to check the status of a real server. It should exit with status 0 if everything is ok, or non-zero otherwise.

Four parameters are passed to the script:

- virtual server ip/firewall mark

- virtual server port

- real server ip

- real server port

If the checktype is external-perl then the command is assumed to be a Perl script and it is evaluated into an anonymous subroutine which is called at check time, avoiding a fork-exec. The argument signature and exit code conventions are identical to checktype external. That is, an external-perl checktype should also work as an external checktype.

Default: /bin/true

checkport = n

Number of port to monitor. Sometimes check port differs from service port.

Default: port specified for each real server

request = "uri to requested object"

This object will be requested each checkinterval seconds on each real server. The string must be inside quotes. Note that this string may be overridden by an optional per real-server based request-string.

For an HTTP/HTTPS check, this should be a relative URI, while it has to be absolute for the 'http_proxy' check type. In the latter case, this URI will be requested through the proxy backend that is being checked.

For a DNS check this should the name of an A record, or the address of a PTR record to look up.

For a MySQL, Oracle or PostgeSQL check, this should be an SQL SELECT query. The data returned is not checked, only that the answer is one or more rows. This is a required setting.

For a simpletcp check, this string is sent verbatim except any occurrences of \n are replaced with a new line character.

receive = "regexp to compare"

If the requested result contains this regexp to compare, the real server is declared alive. The regexp must be inside quotes. Keep in mind that regexps are not plain strings and that you need to escape the special characters if they should as literals. Note that this regexp may be overridden by an optional per real-server based receive regexp.

For a DNS check this should be any one the A record's addresses or any one of the PTR record's names. In case of dynamic DNS answers (different answers on the same question) a regex to match multiple addresses or PTR record names could also defined.

For a MySQL check, the receive setting is not used.

httpmethod = GET | HEAD

Sets the HTTP method which should be used to fetch the URI specified in the request-string. GET is the method used by default if the parameter is not set. If HEAD is used, the receive-string should be unset.

Default: GET

virtualhost = "hostname"

Used when using a negotiate check with HTTP or HTTPS. Sets the host header used in the HTTP request. In the case of HTTPS this generally needs to match the common name of the SSL certificate. If not set then the host header will be derived from the request url for the real server if present. As a last resort the IP address of the real server will be used.

login = "username"

For FTP, IMAP, LDAP, MySQL, Oracle, POP and PostgreSQL, the username used to log in.

For RADIUS the username is used for the attribute User-Name.

For SIP, the username is used as both the to and from address for an OPTIONS query.

Default:

- FTP: Anonymous

- MySQL Oracle, and PostgreSQL: Must be specified in the configuration

- SIP: ldirectord\@<hostname>, hostname is derived as per the passwd option below.

- Otherwise: empty string, which denotes that case authentication will not be attempted.

passwd = "password"

Password to use to login to FTP, IMAP, LDAP, MySQL, Oracle, POP, PostgreSQL and SIP servers.

For RADIUS the passwd is used for the attribute User-Password.

Default:

- FTP: ldirectord\@<hostname>, where hostname is the environment variable HOSTNAME evaluated at run time, or sourced from uname if unset.

- Otherwise: empty string. In the case of LDAP, MySQL, Oracle, and PostgreSQL this means that authentication will not be performed.

database = "databasename"

Database to use for MySQL, Oracle and PostgreSQL servers, this is the database that the query (set by receive above) will be performed against. This is a required setting.

secret = "radiussecret"

Secret to use for RADIUS servers, this is the secret used to perform an Access-Request with the username (set by login above) and passwd (set by passwd above).

Default: empty string

scheduler = scheduler_name

Scheduler to be used by LVS for loadbalancing. For an information on the available sehedulers please see the ipvsadm(8) man page.

Default: "wrr"

persistent = n

Number of seconds for persistent client connections.

netmask = w.x.y.z | prefixlen

Netmask to be used for granularity of persistent client connections. IPv4 netmask should be specified in dotted quad notation. IPv6 netmask should be specified as a prefix length between 1 and 128.

protocol = tcp | udp | fwm

Protocol to be used. If the virtual is specified as an IP address and port then it must be one of tcp or udp. If a firewall mark then the protocol must be fwm.

Default:

- Virtual is an IP address and port, and the port is not 53: tcp

- Virtual is an IP address and port, and the port is 53: udp

- Virtual is a firewall mark: fwm

monitorfile = "/path/to/monitorfile"

File to continuously log the real service checks to for this virtual service. This is useful for monitoring when and why real services were down or for statistics.

The log format is: [timestamp|pid|real_service_id|status|message]

Default: no separate logging of service checks.

ops = yes | no

Specify that a virtual service uses one-packet scheduling. This option can be used only for UDP services. If this option is specified, all connections are created only to schedule one packet. Option is useful to schedule UDP packets from same client port to different real servers.

servicename = short name

A name for this service. This is for the sole purpose of making it easier to know which service is affected when e-mail notifications are sent out. It will be included in the e-mail subject and body.

comment = comment

Notes about this service to be included in e-mail notifications (for example, purpose of the service or relevant administrator to contact).

## IPv6
Directives for IPv6 are virtual6, real6, fallback6. IPv6 addresses specified for virtual6, real6, fallback6 and a file of maintenance directory should be enclosed by brackets ([2001:db8::abcd]:80).

Following checktype and service are supported.

checktype: connect | external | external-perl | negotiate | off | on | checktimeoutN

service: dns | http | https | nntp | none | simpletcp | sip

Note: When using a service type with http or https, you need to install perl module perl-Net-INET6Glue.

## FILES
/etc/ha.d/ldirectord.cf

/var/log/ldirectord.log

/var/run/ldirectord.configuration.pid

/etc/services

## SEE ALSO
ipvsadm, heartbeat

Ldirectord Web Page: http://www.vergenet.net/linux/ldirectord/

## AUTHORS
Horms <horms@verge.net.au>

Jacob Rief <jacob.rief@tiscover.com>


applyfilter

package: leafnode

title: applyfilter(8)

summary: apply filter settings to news spool

text:
# applyfilter(8)

## NAME
applyfilter - apply filter settings to news spool

## SYNOPSIS
applyfilter [-v] ... newsgroup

## DESCRIPTION
Leafnode is a USENET package intended for small sites, where there are few users and little disk space, but where a large number of groups is desired.

Applyfilter is the program to apply filter settings to your newsspool, particularly after changes that were not in effect at the time the articles were downloaded with fetchnews. Applyfilter is used if you want to remove postings from your spool matching a certain filter pattern (see FILES below). If the headers of an article match any of the filtering rules, the article is being deleted from the newsgroup.

Applyfilter sets its real and effective uid to "news".

## OPTIONS
-v

Be verbose.

newsgroup

is the newsgroup you want to apply the filter to.

## FILES
A file specified in the filterfile option of /etc/leafnode/config contains the set of filtering rules that are applied to the newsspool. Each rule must be on a separate line. Empty lines and comments (marked by a # which MUST be at the beginning of the line) are allowed and will be ignored.

Each line contains a regular expression that will be compiled with the PCRE_MULTILINE option set (unless it is a comment line or an empty line). Every regular expression applied to the whole message header (folded message headers are unfolded before the match is attempted). If any regular expression matches the header, the posting gets removed. For example, the following set of rules will delete all crosspostings to alt.flame.

^Newsgroups:.*[, ]alt.flame$

^Newsgroups:.*[, ]alt.flame,

^Newsgroups: indicates that the pattern should only be applied to the Newsgroups: header. After the header, an arbitrary number of characters may follow, ending in either a comma or a space. After that, alt.flame must be in the line, either at the end of the line (first entry) or in the middle of the line, followed by other newsgroups (second entry).

Unfortunately, regular expressions are a complex matter and outside the scope of this document. Please see the manual pages provided with the PCRE library for details.

Note that some leafnode programs (such as fetchnews) feed the header line by line to the regexp (after unfolding), others (such as applyfilter) feed the whole header in one large blob. This does not usually matter because patterns are compiled in multiline mode, but will matter if you are trying to match multiple headers in the same regexp – this would work with applyfilter, but not with fetchnews.

## ENVIRONMENT
LN_LOCK_TIMEOUT

This variable is parsed as an unsigned integer value and determines how many seconds applyfilter will wait when trying to obtain the lock file from another leafnode program. 0 means to wait indefinitely. This variable takes precedence over the configuration file.

## AUTHOR
Copyright 1999 by Cornelius Krasel <krasel@wpxx02.toxi.uni-wuerzburg.de>.

Copyright 2002 – 2006 by Matthias Andree <matthias.andree@gmx.de>.

Leafnode was originally written by Arnt Gulbrandsen <agulbra@troll.no> and is copyright 1995 – 1996 Troll Tech AS, Postboks 6133 Etterstad, 0602 Oslo, Norway, fax +47 22646949.

## SEE ALSO
pcre2pattern(3), leafnode(8), fetchnews(8), texpire(8).


checkgroups

title: checkgroups(8)

summary: update group descriptions

text:
# checkgroups(8)

## NAME
checkgroups - update group descriptions

## SYNOPSIS
checkgroups checkgroupsfile

## DESCRIPTION
Leafnode is a USENET package intended for small sites, where there are few users and little disk space, but where a large number of groups is desired.

Checkgroups is the program which parses checkgroup scripts to include new/updated group descriptions into the active file (which is usually /var/spool/news/leaf.node/groupinfo).

Checkgroups sets its real and effective uid to "news".

## OPTIONS
checkgroupsfile

is a file which contains the newsgroup name and the description on one line, separated by whitespace. Checkgroups scripts are sometimes sent out by news administrators (e.g., in the bionet.* hierarchy).

## ENVIRONMENT
LN_LOCK_TIMEOUT

This variable is parsed as an unsigned integer value and determines how many seconds checkgroups will wait when trying to obtain the lock file from another leafnode program. 0 means to wait indefinitely. This variable takes precedence over the configuration file.

## AUTHOR
Written by Cornelius Krasel <krasel@wpxx02.toxi.uni-wuerzburg.de>. Copyright 1997 – 1999.

Modified by Matthias Andree <matthias.andree@gmx.de>. Copyright 2002 – 2004.

Leafnode was originally written by Arnt Gulbrandsen <agulbra@troll.no> and is copyright 1995 – 1996 Troll Tech AS, Postboks 6133 Etterstad, 0602 Oslo, Norway, fax +47 22646949.

## SEE ALSO
leafnode(8), texpire(8), RFC 977.


fetchnews

title: fetchnews(8)

summary: fetch news via NNTP

text:
# fetchnews(8)

## NAME
fetchnews - fetch news via NNTP

## SYNOPSIS
fetchnews [-q] [-v] ... [-x number] [-l] [-n] [-f] [-P] [-w]

## DESCRIPTION
Leafnode is a USENET package intended for small sites, where there are few users and little disk space, but where a large number of groups is desired.

The design of leafnode is intended to self-repair after problems, and to require no manual maintenance.

Fetchnews (formerly called "fetch") is the program which submits and retrieves new articles to or from the upstream NNTP server.

## OPTIONS
-q

Be quiet. Suppresses some warnings. This flag cancels any previously encountered -v flags.

-v

Be verbose. This flag cancels any previously encountered -q flags. A maximum of four -v can be used (the more v, the more verbose):

-v

Warn about non-critical errors.

-vv

Be verbose whenever a group command occurs.

-vvv

Be verbose whenever an article command occurs.

-vvvv

For debugging purposes. Do not expect the additional output to make sense.

-w

Wait mode. This causes the XOVER update (which runs after the article fetch phase) to run in the foreground. By default, the XOVER update runs in the background, detached from the shell, on systems that offer a working fork(2) call. Helpful for debugging and to avoid terminal clobbering when fetchnews is run manually.

-x number

Go number articles back and try to re-fetch what's missing. This can be useful to pull data from broken servers that have either overview and group data out of synch or create articles out of article number order.

-l

Do not use supplementary servers (-l is supposed to mean "local"). This does speed up the operation quite a bit.

-n

Do not expire newsgroup subscriptions. Technically: do not unlink files in the interesting.groups directory.

-f

Erase the active.read file, thus force redownloading the whole active file from all upstream servers. This is usually occurring only very infrequently because it takes a long time. See timeout_active in leafnode(8). DO NOT use this option in cron jobs or otherwise regularly.

-P

Only post articles that have accumulated in the out.going directory but do not fetch articles from upstream servers.

## EXIT STATUS
fetchnews will exit with code 0 if it could connect to all servers and encountered no other errors. It exits with code 2 when it was unable to connect to at least one server, and it exits with code 1 on other errors.

## FILES AND CONFIGURATION
/var/spool/news/leaf.node/active.read

is a file to track when the active files have been successfully downloaded from the upstream servers the last time. If it is missing, this has the same effect as giving the -f option. It is only created after the active file of each upstream servers has been downloaded successfully.

See leafnode(8) for the list of other files affected, and for information on configuring fetchnews.

## ENVIRONMENT
LN_SKIP_GROUPS=pattern[,pattern[...]] (since v1.9.53)

If set, all groups that match one of the wildmat(3) patterns will be skipped during the fetch. This can be used as a quick way of skipping binary groups during daytime, for instance, example:

env 'LN_SKIP_GROUPS=*binary*,alt.*' /usr/sbin/fetchnews -nq

LN_LOCK_TIMEOUT

This variable is parsed as an unsigned integer value and determines how many seconds fetchnews will wait when trying to obtain the lock file from another leafnode program. 0 means to wait indefinitely. This variable takes precedence over the configuration file.

LN_SUPPRESS_DATE

(since v1.11.7) If this variable is defined (regardless of its value, including empty), leafnode will skip checking the upstream server's time by means of the NNTP DATE command.

## ALGORITHM
Here is a brief description of what fetchnews does.

First, after connecting to the upstream NNTP server, all articles that have the u+r permission (0400) flag set in /var/spool/news/out.going are posted using POST. If a posting fails, that article is moved to /var/spool/news/failed.postings which an administrator has to clean up once in a while. Moving a file back to /var/spool/news/out.going is sufficient to retry the post it. The u+r flag is checked to prevent posting an (incomplete) article that leafnode(8) is still receiving at the same time. If a posting succeeds, the article is removed from out.going in order to not post it twice into a moderated newsgroup on a different server (which would send multiple copies of the article to the moderator). Note: older fetchnews versions tried to post on all servers first, but failed to do so when one of the servers could not be reached. If you need to work around a dodgy upstream server that is fast but does not forward your posts reliably, prohibit posting to this server using the nopost server option in the configuration file, see leafnode(8).

Second, the upstream server's list of newsgroups (obtained using LIST and LIST NEWSGROUPS) is merged into leafnode's (if timeout_active has expired, the active.read file is not present or the active file is empty) or updated (with NEWGROUPS).

Third, fetchnews iterates over the list of newsgroups, performing a GROUP, an XOVER (if supported) or XHDR Message-ID and a number of HEAD and BODY or ARTICLE commands for each group which has been read recently. It assumes that for the particular group it is looking at, "maxage" was set to the groupexpire or global expire. As a consequence, it makes only sense to set maxage lower than or equal to expire.

## NOTES
Fetchnews does not use NEWNEWS. NEWNEWS is not used because it is often very expensive and therefore also disabled at many sites.

After some experiments, I decided that it was better to fetch all the articles in a group than to optimize away some; users would complain too loudly when the optmizer guessed wrongly.

The only way to control what newsgroups are accessible to local users is to control what the upstream server lets fetchnews read, and that will not keep out all crossposts (endemic in, e.g., the alt.sex groups). If your site is big enough that you need to control newsgroup access, consider using a news server which is designed for a big site.

Fetchnews sets its real and effective uid to "news" when started as root and refuses to run if it cannot get this user ID.

## BUGS
Fetchnews ignores the "Supersedes:" and "Control:" headers.

## HISTORY
Older versions of fetchnews posted any articles found in out.going. Since v1.9.23, fetchnews will only post article files that have their user executable bit set. Leafnode sets this bit after it has successfully received a post. This behaviour avoids posting incomplete articles when leafnode receives a post at the same time fetchnews is posting.

## AUTHOR
Written by Arnt Gulbrandsen <agulbra@troll.no> and copyright 1995\-–\-96 Troll Tech AS, Postboks 6133 Etterstad, 0602 Oslo, Norway, fax +47 22646949.

Modified by Cornelius Krasel <krasel@wpxx02.toxi.uni-wuerzburg.de>, Markus Enzenberger <enz@cip.physik.uni-muenchen.de> and Randolf Skerka <Randolf.Skerka@gmx.de>. Copyright of the modifications 1997\-–\-1999. Modified by Matthias Andree <matthias.andree@gmx.de>, copyright of the modifications 2001\-–\-2004.

## SEE ALSO
leafnode(8), texpire(8), newsq(1), /etc/leafnode/leafnode/filters.example.


leafnode

title: leafnode(8)

summary: NNTP server for small (dialup) sites

text:
# leafnode(8)

## NAME
leafnode - NNTP server for small (dialup) sites

## SYNOPSIS
leafnode

## DESCRIPTION
Leafnode is a USENET package intended for small sites, where there are few users and little disk space, but where a large number of groups is desired.

The design of leafnode is intended to self-repair after problems, and to require no manual maintenance.

The leafnode program itself is the NNTP server. It is run from inetd(8) or xinetd(8) when someone wants to read news. The other parts of the package, fetchnews and texpire, are responsible for fetching new news from another server, and for deleting old news.

## ACCESS CONTROL
No authentication or access control is supported. This is a deliberate omission: Implementing this is a job which should not be redone for each and every service.

It is mandatory that you use external access control mechanisms like tcpd, inetd/xinetd compiled with libwrap support option and the like and that these are in effect. tcpd and libwrap are components of Wietse Venema's fine tcp_wrappers package.

As a very rough last line of defense against abuse, leafnode will drop connections from outside your LANs by default. You can configure leafnode to let go of this restriction (look for the allowstrangers option), but do not do that unless tight access control is in place. Someone will abuse your computer sooner or later. Promised.

I recommend that either firewalling or tcpd be used for access control.

## FILES
All these files and directories must be readable by the user "news". It is recommended that, unless otherwise stated, that the user "news" be the only user in the group "news" and these files belong to "root:news" (user:group) so leafnode cannot modify your configuration or filter files.

/etc/leafnode should not be writable by the user "news", but it must be executable for at least any of the group that the user "news" is in. /etc/leafnode/config contains the configuration parameters for leafnode. It must not be writable by the user "news". Set this to owner root:news and mode 640. For details, see CONFIGURATION below.

/var/spool/news must also be readable and writable by the user "news". It contains the news articles; e.g., /var/spool/news/alt/fan/agulbra contains the articles in the alt.fan.agulbra group. Each directory contains articles in numbered files (decimal numbers, monotonically increasing), and a special file called .overview which contains the "Subject", "From", "Date", "Message-ID", "References", "Bytes" and "Lines" headers for each article in the group.

Several subdirectories are special:

/var/spool/news/leaf.node contains the files that leafnode creates during operation, for example the groupinfo file which contains information about each USENET newsgroup. This file is built by fetchnews (8). You can force a complete rebuild of the groupinfo file by calling fetchnews with the parameter -f (see fetchnews (8)).

/var/spool/news/out.going contains local postings that fetchnews(8) is to pass to the upstream NNTP server. After a posting has been successfully written to disk, its u+r permission flag is set. This flag is interpreted by fetchnews(8) as "you may post this article". This prevents fetchnews from posting articles that are still being received from newsreaders. (Note: versions 1.9.23 to 1.9.32 inclusively used u+x instead, which caused some "stuck post" problems with articles in the spool when a prior leafnode version was updated to one of these 10 versions. Updating to leafnode 1.9.33 or later fixes the problem.)

/var/spool/news/failed.postings contains local postings that the upstream server rejected. fetchnews(8) will create files in this directory, but none of the leafnode programs will delete anything in it.

/var/spool/news/message.id contains hard links to each message; this is used in place of the dbz database typically used by bigger servers. (A directory such as this is probably more efficient for the small servers leafnode is designed for but scales very badly.)

/var/spool/news/interesting.groups contains one file for each group an NNTP client has asked to read. leafnode will update the ctime (ls -l usually shows the mtime, try ls -lc) of the relevant file when a LISTGROUP, XOVER, XHDR, STAT, HEAD, BODY or ARTICLE command is issued, when a GROUP or LIST ACTIVE command (the latter only with a single group, not with patterns) is issued for an interesting group (to avoid unsubscribing low-traffic groups that are still read) and fetchnews(8) will retrieve all new articles in all groups whose files have been either

- touched during the past two days, or

- touched more than once, and at least once within the past week.

The timeout is configurable through the config file variables timeout_short and timeout_long. See also fetchnews(8) for the -n option.

/etc/inetd.conf or /etc/xinetd.conf contains the configuration which starts leafnode. It is strongly recommended to start leafnode as user news.

## ENVIRONMENT
LN_REJECT_POST_PRE

If this variable exists, all POST commands are rejected with a 400 code. Use only for debugging clients.

LN_REJECT_POST_POST

If this variable exists, the POST command is rejected with a 400 code after the article and CRLF.CRLF has been received. Use only for debugging clients.

## CONFIGURATION
All configuration is done using the file /etc/leafnode/config, which may include a filter description file, filterfile for short, as described below.

For the purposes of this section, whitespace shall be defined as an arbitrary sequence consisting of one or more SPACE or HTAB characters, ASCII positions 32 and 9, respectively.

The configuration file is strictly line-oriented with LF or CRLF as line terminator.

Empty lines and lines consisting of only whitespace, possibly followed by a comment (introduced by a hash mark (#) and extending through the end of the line), are skipped.

All other lines have exactly three mandatory fields, a plain text parameter, an assignment character (=) optionally surrounded by whitespace and a value. The value is either plain text or – new since leafnode v1.11 – a string in double quotes with trivial backslash escape (see below).

Plain text starts at the first non-whitespace character and extends through the last non-whitespace character on the line that is not a comment. A trailing comment on a line is skipped.

Quoted strings are enclosed in double quote characters ("). The backslash character (\) is skipped, but it copies the immediately following character verbatim, so that you can specify the backslash itself by doubling it (\\) or a double quote character as part of the string by preceding it with a backslash (\"); the hash mark has no special meaning as command introducer inside quoted strings. Text after the end of the string is silently ignored (this may change in future versions). Comments after quoted strings are ignored.

MANDATORY PARAMETERS

These parameters must be specified for leafnode to work.

server = news02.example.com

"server" is used by fetchnews (8) to select what NNTP server(s) to retrieve news from and to post your articles to. You can specify more than one news server; in that case, the servers will be queried from the top down. If you want to post articles, at least one of your servers should allow you to post. In the example above, news02.example.com is the news server. This parameter can be given more than once. Each server starts with a fresh set of default configuration options, no inheritance takes place from the previous server definition. Only options explicitly marked "server-specific" can be set on a per server basis, "general" options are set for all servers at the same time.

expire = 5

"expire" is the number of days an article should be kept around. In the example, five days after the article has last been read, it is deleted by texpire (8). This value MUST be at least 1. This parameter is global, see the introductory paragraph of the following GENERAL OPTION PARAMETERS section to find out what this means.

GENERAL OPTIONAL PARAMETERS

These options can only be configured once in the configuration file, and take effect for leafnode as a whole. It does not matter where these are specified relative to server= options, but for clarity, you are encouraged to place these before the first server= line. Specifying each of the global options more than once lets the last copy take effect, but may cause errors in the future.

hostname = host.domain.country

By default, leafnode tries hard to figure the host name of your computer, skipping inadequate (non-unique) names if possible. It will look up your computer's host name with gethostname(3) and then try to qualify the name with gethostbyname(3) if necessary. Common sources for the full name therefore are /etc/hosts, NIS and DNS, but consult your system documentation for details. If leafnode fails to determine the host name, this is usually a hint that your system is not configured properly, or it has a hostname that is unsuitable for the domain part of a Message-ID, for example, "localhost.localdomain", and you should fix the name service configuration. Adding a unique fully-qualified host name to /etc/hosts is usually sufficient. Please see README-FQDN for more details.

You can configure the unique fully-qualified host name here as well, but this is not recommended and discouraged.

create_all_links = 1

Normally, fetchnews will store articles only in the newsgroups which it considers interesting. With this option set, fetchnews will create hardlinks for all newsgroups in the Newsgroups: header that it knows about. This may be of interest if you want to apply a score- or killfile to the local Xref: line.

maxfetch = 1000

"maxfetch" specifies the maximum number of articles fetchnews (8) should fetch from the upstream server in each group. Its use is not advised, because if you use it you will not see all the traffic in a group. By default there is no limit.

initialfetch = 1

"initialfetch" defines how many articles from a newly subscribed group should be fetched. The default is to fetch all old articles, which can get quite time-consuming when subscribing to a very busy group. This is equivalent to setting initialfetch to zero. If you want to get no old articles when subscribing to a new group, you should set initialfetch to one, as in the example above.

groupexpire very.crowded.group = 1

groupexpire very.crowded.hierarchy.* = 1

"groupexpire" makes it possible to adjust expiry times for individual groups. Expiry times are given in days. 0 means "use the default", negative values prevent the expire process for this group altogether (you can consider this an archive mode). This value is used by texpire (8). You can specify as many groupexpire lines as you like. It is possible to specify glob (7)-like wildcard expressions.

maxage = 10

If an article turns up on your upstream news server which is older than "maxage" days it will not been fetched even if you do not have it yet. This is useful if your upstream server gets occasional "hiccups". The default is set to 10. If you want to switch this feature off, set maxage to some very large value, such as 20000 (this is equivalent to roughly 54 years).

maxold = 10

Is synonymous to maxage, see above.

maxlines = 2000

If you want to avoid receiving very large articles, you may set the "maxlines" parameter to the maximal number of lines an article should have. By default, this feature is switched off.

minlines = 2

Sometimes newsgroups are spammed with empty postings. To reject these postings, you can set the "minlines" parameter. Setting minlines to a value larger 4 is probably not a good idea since you will also start to kill "real" postings then. By default, this feature is switched off.

maxbytes = 100000

If you want to avoid receiving very large articles, instead of using the "maxlines" parameter you can also use the "maxbytes" parameter. By default, this feature is switched off.

maxcrosspost = 5

If you want to combat spam, you can filter out all postings that are posted to more than a certain number of newsgroups. The number is defined by setting "maxcrosspost". Setting this parameter to very low values is probably a bad idea. This feature is switched off by default.

maxgroups = 5

Synonymous for maxcrosspost. See above.

filterfile = /etc/leafnode/filters

Leafnode can filter the input headers for arbitrary regular expressions. These are stored in a file designated "filterfile". The format of "filterfile" is very simple: one perl-compatible regular expression per line. If one of the regular expressions fits to a header to be downloaded, the body of that article will be rejected. This feature is switched off by default. The format of the regular expressions is described in pcre(3).

timeout_short = 2

By default, a group that has been accidentally touched is being fetched for two days. You can change this time by changing timeout_short.

timeout_long = 7

By default, a group that has not been read at all is being fetched for seven days before being unsubscribed. This interval can be changed by setting timeout_long to a different value.

timeout_active = 90

By default, active files from the upstream servers are re-read every 90 days. This interval can be changed by setting timeout_active to a different value. Be aware that reading an active file transfers about one MB of information if the server that you are using carries a reasonable number of groups (i. e. around 20,000).

timeout_client = 900 (since v1.9.23)

By default, leafnode will drop the connection 900 seconds (15 minutes) after seeing the last command from the client. You can change the timeout here. Setting it too low (like below 5 minutes) will annoy your users and consume more system resources for re-reading all the files.

timeout_fetchnews = 300 (since v1.9.52)

Fetchnews will, since v1.9.52, assume the upstream server has become wedged after waiting for a reply for 300 seconds. You can change the timeout here.

timeout_lock = 5 (since v1.9.54)

Configure how many seconds the leafnode programs (applyfilter, checkgroups, fetchnews, texpire) will wait for the lock file before aborting. Setting this to 0 means to wait indefinitely. NOTE: you can override this by setting the environment variable LN_LOCK_TIMEOUT (note it is not LN_TIMEOUT_LOCK). The default is 5 seconds.

delaybody = 1

With this option set, fetchnews (8) fetches only the headers of an article for visual inspection. Only when the headers have been read, the bodies of the articles will be retrieved the next time fetchnews (8) is called. This can save a huge amount of download time and disk space.

delaybody_in_situ = 1 (since v1.9.41)

This is only applicable with delaybody=1. By default, leafnode will give the full downloaded article a new article number so they appear as new in your newsreader. This does not work for all newsreaders. With this option set, leafnode will retain the original article number. You'll have to figure out how to tell your newsreader to show old articles. This option defaults to 0. It is highly recommended to leave it unset.

debugmode = 1

With this option set, fetchnews (8), texpire (8) and leafnode (8) will start to log lots of debugging output via syslog (8) at facility news and priority debug. Use it for tracking down problems with your feed. debugmode should be left at 0 for regular use because it can log enormous amounts of data. The higher the number, the more will be logged. Choosing a figure greater than 3 will not make a difference at the moment.

allow_8bit_headers = 1 (since v1.9.25)

By default, leafnode rejects local posts that have 8-bit characters in their headers, because they violate relevant standards, particularly RFC-2822 (which RFC-1036 is based on) that demands that Usenet news headers (as mail headers) must be pure 7-bit US-ASCII, with only whitespace allowed from the control characters. However, as UTF-8 is to come, and some national hierarchies, particularly the Norwegian and Danish (no.*, dk.*) seem to have agreed on preferring just-send-eight over RFC-2047, you can set this option to allow 8-bit data in headers. Leafnode will however add a warning header if 8-bit data is present, stating that the site administrator allowed this.

There is no way to make leafnode accept non-whitespace control characters in headers.

allowSTRANGERS = MAGIC (since v1.9.23)

By default, leafnode refuses connections from outside your LANs. Check config.example for how to use this parameter to let strangers connect to your leafnode. Instead of MAGIC, you have to write a number as mentioned in config.example. Note that capitalization matters.

linebuffer = 1

By default, stdout and sometimes stderr of applications are set to "fully buffered" unless connected to terminals. Use this option to explicitly request line buffered mode for stdout and stderr.

clamp_maxage = 0

By default, leafnode will derive a "maxage" argument from the expire time that is applicable to the group (groupexpire if set, expire otherwise), to prevent fetching articles again that were once there and then cleared by texpire(8). Set clamp_maxage=0 to get rid of this behaviour.

article_despite_filter = 1 (since v1.9.33)

By default, fetchnews will request HEAD and BODY separately if a filter file is defined and delaybody is off. For high latency, high throughput links (such as interleaved DSL or satellite links), it may be faster to request head and body together with an ARTICLE command and ignore the body if the filters apply (though it may not be cheaper if you pay per MByte), enabling this option will force leafnode to use the ARTICLE command in spite of filters being defined. (Note that in delaybody mode, HEAD and BODY will ALWAYS be requested separately.)

newsadmin = news@leafnode.example.org (since v1.9.47)

This option sets the From: address for the placeholder article, it should be the news administrator's mail address. It defaults to news@HOSTNAME, where HOSTNAME is leafnode's hostname.

SERVER-SPECIFIC OPTIONAL PARAMETERS

These options can only be placed after the server= line of the server to which you would like these to apply, and they always pertain to the preceding server= line. Specifying them before the first server= line is an error.

username = myname

If any of your news servers requires authentication, you can enter your username on that server here. This field may occur multiple times, once after each server definition. See the introduction of this CONFIGURATION section for information on how to quote myname.

password = mypassword

If any of your news servers requires authentication, you can enter your password on that server here. This field may occur multiple times, once after each server definition. Since the password is available in clear text, it is recommended that you set the rights on the config file as restrictive as possible, otherwise other users of your computer will be able to get your password(s) from that file. See the introduction of this CONFIGURATION section for information on how to quote mypassword.

port = 8000

By default, fetchnews tries to connect to its upstream news servers on the NNTP port (119). If your servers run on a different port, you can specify those here. This field may occur multiple times, once after each server definition.

Note: to modify the port your own leafnode servers listens on, change the inetd.conf or xinetd.conf configuration file. leafnode does not set up its listen port itself.

timeout = 30

By default, leafnode tries to connect for 10 seconds to a server and then gives up. If you have a slow server, you can try for a longer time by setting the timeout higher (in this example, 30 seconds). The timeout can be tuned individually for each server.

noactive = ANYTHING (v1.9.25 ... v1.11.4)

noactive = 1 (since v1.11.5)

If this parameter is set, the active file is never downloaded from this server. Use this for very slow servers unless they carry groups that other servers do not offer. Leafnode versions 1.9.25 to 1.11.4 would always assume that "ANYTHING" had been 1. "noactive = 0" is supported since v1.11.5.

nodesc = ANYTHING (until v1.11.4)

nodesc = 1 (since v1.11.5)

Some servers do not deliver news groups descriptions correctly because they cannot parse the XGTITLE and LIST NEWSGROUPS commands. In that case, put this line after the "server" line. Leafnode versions up to v1.11.4 would always assume that "ANYTHING" had been 1. "nodesc = 0" is supported since v1.11.5.

nopost = 1 (since v1.9.23)

Prevent posting to this server. You can use this if the upstream will not let you post but still greet leafnode with 200 or if the upstream does not forward your postings reliably.

noread = 1 (since v1.9.33)

Prevent fetching news articles or active files from this server. You can use this if the upstream is good to post, but too slow to fetch news from.

noxover = 1 (since v1.9.47)

Prevent the use of XOVER on the current server. Fetchnews will use XHDR instead.

only_groups_match_all = 1 (since v1.9.52)

Usually, when cross-posting an article, fetchnews will post the article if ANY group listed in the Newsgroups: header is matched by the PCRE. With this option on, ALL groups listed in the Newsgroups: header must match. This can be used to avoid "poison" groups when you have multiple upstream servers.

only_groups_pcre = PCRE (since v1.9.28)

This parameter lists the Perl-compatible regular expression of groups that are fetched or posted to this server. The PCRE is automatically anchored at the left hand side, so you can omit the leading ^. Remember to escape dots, as in:

de\.comp\.|de\.comm\.

If this parameter is omitted, all groups are fetched from and posted to this server.

Note: you must run fetchnews with the -f option after changing, adding or removing any only_groups_pcre option.

Hint: you can use something like this to check your only_groups_pcre settings:

cut -f1 -d" " @spooldir@/leaf.node/groupinfo \

| pcregrep 'PATTERN'

post_anygroup = 1 (since v1.9.37)

This parameter makes leafnode post on this server without checking if it carries the group an article is posted to. The default is post_anygroup = 0, which means that leafnode will check with a "GROUP" command if the server carries the group the articles is posted into. Use this on post-only servers that do not allow the "GROUP" command. Note: inconsiderate use of this parameter may cause articles to end up in the failed.postings directory.

OBSOLETE PARAMETERS

supplement

is synonymous to server. Do not use it on new installations.

fqdn

is synonymous to hostname. Do not use it on new installations.

## PROTOCOL
Here are the NNTP commands supported by this server:

ARTICLE, BODY, DATE, GROUP, HDR, HEAD, HELP, LAST, LIST, LIST ACTIVE, LIST ACTIVE.TIMES, LIST EXTENSIONS, LIST NEWSGROUPS, LIST OVERVIEW.FMT, LISTGROUP, MODE, NEWGROUPS, NEXT, POST, OVER, SLAVE, STAT, XHDR, XOVER. These commands follow RFC-977 and RFC-2980, except HDR and OVER which are recognized in anticipation of current NNTP drafts.

Note that the syntax of HDR and OVER may change.

## BUGS
Leafnode is totally unaware of UTF-8 and will reject a client that posts UTF-8 characters in the header. Current Usefor drafts claim all article headers UTF-8 encoded Unicode. Leafnode still expects RFC-2047 instead which may eventually be phased out in favour of UTF-8.

Leafnode stops reading a line at the first NUL character.

Leafnode may not cope well with crosspostings that cross hierarchies if you have multiple upstream feeds and use the only_groups_pcre configuration option.

Leafnode will only bother to determine the time zone offset for generated Date: headers for posts that lack them on systems that offer the tm_gmtoff member in struct tm (commonly BSD and GNU systems).

## AUTHOR
Written by Arnt Gulbrandsen <agulbra@troll.no> and copyright 1995 Troll Tech AS, Postboks 6133 Etterstad, 0602 Oslo, Norway, fax +47 22646949.

Modified by Cornelius Krasel <krasel@wpxx02.toxi.uni-wuerzburg.de>, Randolf Skerka <Randolf.Skerka@gmx.de> and Markus Enzenberger <enz@cip.physik.uni-muenchen.de>. Copyright of the modifications 1997 – 1999.

Modified by Matthias Andree <matthias.andree@gmx.de>, Copyright 1999 – 2002. Modified by Ralf Wildenhues <ralf.wildenhues@gmx.de>, Copyright 2002.

Jonathan Larmour <jifl@jifvik.org> contributed the timeout_client feature.

Andreas Meininger <a.meininger@gmx.net> contributed the code to let texpire ignore groupexpire = -1 groups.

Mark Brown <broonie@debian.org> added the noactive option.

Numerous contributions by other people.

The initial development of leafnode has been paid for by Uninett AS (http://www.uninett.no/).

## SEE ALSO
applyfilter(8), checkgroups(8), fetchnews(8), newsq(1), texpire(8).

tcpd(8), hosts_access(5), glob(7), pcre2(3), RFC 977, RFC 2980.


texpire

title: texpire(8)

text:
# texpire(8)

## NAME
texpire - delete old news articles and repair leafnode news spool

## SYNOPSIS
texpire [-v[...]] [-q] [-f] [-h] [-r]

## DESCRIPTION
Leafnode is a USENET package intended for small sites, where there are few users and little disk space, but where a large number of groups is desired.

Texpire is the program which deletes old articles from the local news spool and repairs most problems of the news spool. It can restore broken hard links, re-sort message.id links into the right directories (necessary when the spool has been moved to a different path) and update overview data. It can not repair loss of @spooldir@/news/group/* files.

Archive feature: If a groupexpire parameter is set to -1 for a particular group (or pattern), texpire will skip this (these) groups.

## OPTIONS
-v

Be verbose. A maximum of four -v can be used (the more v, the more verbose). Do not expect all the output to make sense. Cancels preceding -q options.

-f

Force expire. Expire will be made regardless of the access time of the file. Especially useful if you regularly backup your news spool or do other things to it where you open files in there.

-q

Quiet. Print no messages unless problems occur. Cancels preceding -v options.

-r

Repair (since v1.9.54). Runs a more thorough yet slower check to detect broken hard links between articles and message.id files.

-h

Help. Print short usage message and exit with code 0.

## FILES
See leafnode(8) for the list of files affected.

## NOTES
Texpire sets its real and effective uid to "news" (if it can), because almost all of the problems I have had with leafnode are due to files which are not writable for user "news".

## BUGS
Texpire may not delete an article as soon as it should in certain circumstances, for instance after backing up or restoring data; eventually it will.

Texpire ignores "Expires" headers.

Texpire is unable to delete articles in groups which have non-consecutive numbers with huge gaps.

Texpire does not delete thread-based, but is only looking at individual articles, although the leafnode documentation of previous versions claimed otherwise.

Texpire only removes the innermost empty directory when all articles expire from a group. On the next run, it will remove the parent, which then is empty again, so eventually, empty directories will be deleted after some texpire runs.

## ENVIRONMENT
LN_LOCK_TIMEOUT

This variable is parsed as an unsigned integer value and determines how many seconds texpire will wait when trying to obtain the lock file from another leafnode program. 0 means to wait indefinitely. This variable takes precedence over the configuration file.

## AUTHOR
Written by Arnt Gulbrandsen <agulbra@troll.no> and copyright 1995 Troll Tech AS, Postboks 6133 Etterstad, 0602 Oslo, Norway, fax +47 22646949.

Modified by Cornelius Krasel <krasel@wpxx02.toxi.uni-wuerzburg.de>. Copyright of the modifications 1997 – 1999.

Modified Ralf Wildenhues <ralf.wildenhues@gmx.de>. Copyright of the modifications 2002.

Modified by Matthias Andree <matthias.andree@gmx.de>. Copyright of the modifications 2002 – 2004.

The archive feature was contributed by Andreas Meininger <a.meininger@gmx.net>.

## SEE ALSO
tcpd(8), hosts.allow(5), leafnode(8), fetchnews(8), RFC 977.


ledctl

package: ledmon

title: ledctl(8)

text:
# ledctl(8)

?▀????????м[{sш8▓Ъ÷÷?╚╨]K[?Мx&╥┴w<╣┼,е╙СCg:·≥:]e)?▓╦╕H? МХФЖ>ШЩ╨?╬$:ыd╡U⌡╙и┬@ёъХ?─╦Ё▌ХЪ╠/жi(OE╕реБо"Hц(Y·┼<[Т_я╢Ц?l░gИзо╒ю▐Ц╜XйD*?⌠║≤oе4OO╞ЭD╪t▐_┬.?zяz?KЯ²ШЩк?╜g?^Ф'║╞B╠Qр_оcyйцgъХ▐Ц├Rx??■ВR1╚BoЭ@┼НсJ&БI┼юO?2▒k)эИ?▄E?▒ Wo└ШР▒©?Зr\[u2248]qщо в?╧▄?Я(у?Б╞E&?f▌╩хдП'гM?ЬO┼ыЛъ^■▀$-?%aк▓[Э?1 @f?Л?Ъ*═?Чu |%е┤<м╓?═≈░1?E▓f+X┐F23╡H??П?e+1ЭАG ▀$Ь·Щ:s\[u2502]?║?юшИT_?Тu0WЁ©;╝▄⌡─5╗?дZk╓??#┘?Ы╦нY?e╟=T⌡)Li╠PИZ,┴╧?-ч%?ЭG┌Y?я`umь⌡%]w)\[u2591]?|?Ё╝Ъ│??Ф▐?=( O`■∙?c║═yb"рБгЦC?П ▌Kъ?/║Э(d?>юY ─ёP*E?b<Y■е≤Х╨w?╫C╠▓>fИсёO²о╣?╡(Mxхц?ДZсгd┐?╡??`T?▒╣╞?ЮТ╛Ш÷?Ь▒т1╫9┤ o?ь7╧рРPlс°ь\[u042B]▐PC _O?╘5┴д╗р<шД?A?:^? ²╝╔XK?│>?y,?╬^│1╥тхЮ1█@уW?QS╦ПГ@'rП╧┬?0VjЛ`|`эqР3Ш[╒└?▀cЖqk?Эб░²yа3]L╘Яi≈!нн▌{╫й╜xА╦Зf╥1Ь▀оl-&╓╡Sз?Ёl6K~?к:Ь8И0???PЩ?╦ннN ХХ?ьЫ=Я╧36?'у?9iЯ?ЗO▒?ъ8■░Ф'?▀;Р!я┴e?d╠x┘а╩?Q|┴н∙©?'г'ъuDГrt>╪╩╓хёa;qЛ╬Ч⌠юП$иdэ╫М!"?q╙slr@┼a ▐Jc1ьlb?*РCcЙ1╤╥щШY╝?AVЧ[╝Ёhaа Ы ~Р╥╨ _m7┬o<Шgx1╪ТAjф?8Ь`┼▒d+жp А`"┐Uб?2L┐|Ъжn??ЩPдП≤∙┐²"╝?W#г <К▀R??"╟BЬ∙??·|ЛдTЫK┴}c┘&ЛюФЩr}3У&?КЖ┌w╓Х?┐?gЖ┤ыБ█!6[э┼Ъ -&7с╩им╣┤оЪ?ЬэЬ?э;y÷Ьk┴╠3?е?К}╨x?йг?;█?╨╝!w>Р├╥?фп═X?О8w┬5V@д?╓1DWe?G]╡PЙhI⌡?⌡╨░?Zю?╜с Бlх│AЗайяq ▒╒│╞T┌`щ└*Bd≤Ш[W?iF▒.└e_░8▓b▐h∙м║4║eFP■Y"╛ZZ4д│?9[ ▒@,ц0P░С─?эгuч▒юk8≥ Z*?К?p?еr ▌@┴???▒╝+?*·NI{юф?÷юяv#Y?╫у?MOеи╛о4М─Х??t?ёlK╛?RI░Е ~В?БТ╩O┐_╕?E~Ч=Ж#6@╞d╓0cщj:ъlR∙1 з?ПJРvБ▒тГ╪#op7`5M┤?ИXву?╚g√K╙Yр,рX?╜e╤J▒╢хуw╟B?╖Лi^≥^Юъ_▌┐┌о?┴r·▀Ом╝ПFч╛?бlzWS2,-?Ш┘Ц?Н-a╪H=$█HQ█?ОМtrS╜╫?Л/╨©:g"всяU?Iz1Й0╛?фЩ╩?M?РпфA╔R([├?zl84 ?cЮы9еЦ}╔|О?в╠R2М√^y÷фП┘:gГ°╨{█бЗЧЖf(╨╢РЗЧJ┼шаД╪'Ч3GtGI╩qп8,╒e╝?м╥y└?л≤?▓Г┴NА?в╗Ъtgоew╕÷ыV&чО:3∙■╕di╚3у▓=щi?ЭMeYOA╠о{²ж©bV'╗ЗпnЯ(╦к) TEъ^╘]Uю╕ ЙЙ·ьц▌?zяN│f *i┌ю[#е∙╠е⌠PУ?ОБ0ёеЗ╙▓5╔i?}(u<┐╤┘╞]├*╛▄╗▌╦дт?*Х∙P╠iч└r╘пХ└?И4╟?┼@┼Ы▌s?Иэ7q?²*BИ??÷шб│RЧ╤S?А▓e%Гy?┤╩lшА&б[;ьDбэ.jэ. ⌠?ъШDp÷Ц?s\[u2524]iАzлсоЯ╪J3tsjок┼Я&б▀bt?офp]G│║ФЙ╘▓a?░??╕? Bou╓[т╟0 5цEЗА╫▒uO??≤МW│5╘[ Ш╛k╘ъШs■P╩?■?²"Жч?щ┼а⌡⌡шСЗзgл^⌡╙ж▐ч╪⌡\[u00B7]?щ▌╝?с:▌h_}v╦;╧?Ца└°{p{;Ь╔╠:h_?4Vё╚©ш_▀2 ?╜dПп├╒ -1o╝=1╪?Ъё▌Ф9?╙о∙(.nН└7?э▌?jт▐!УР╜z╢s∙"╫Шsq>╨÷??8рV!р┼Ы⌡?сх?I╚уy╒рщЫХЗ╝аЙ╨∙иuмнW7Вн╒Dкv?335Cyёш?╣uд╔eшZ;U.╬ xчДЗm}u≤╗╤∙?.W²ъ┬kXd÷i÷н?ZMjfJ?┐Ащ╓╧T&Ч<√ОГС╤уЕd┴`t=@K.чЭ2?oзпЬ÷BЦ╥║?4■ ?[РI5S╘┌]Jэ▄гУЕ??▐[mг?ЕБЯЮщeцr??R$j[i╖й╣сшsзщ█2E▀;шo⌡?пЖje?Й'ЙG?л[дE7?QГ▒pшgй?:E╚zZ©╦бr╡ ?- KS╙'Р?╛KХ?dR│?Eyjют1[ъ{_V▌т░?═m?Чo▐B╖Q╘≤▄b?tZЙ??╗ХМ╛⌡|┌p?└~kЯа└Кk'╣╣о+∙?ЭёУ?с╗?=┤╣?ЫVE┼▒╝├c╡┐Цy ?u ?_╫0╔:ьs┬k0÷╚i?╖²|?]╣У©mEц╢w1M ≤·e╙┬c&й[u00A0]O?Lёур?М?Л·Е?²░о?СУ┐z╨EyJ┘9≥тФ┬q?)²9fх°MП*НU┌t╫Ж?═`?ФYфрэ╩ПJp■"tу√нлZ░ r┘V`╝|"Km@╠T≤к─?Ц|k╝-4лRх▐>щаК╡I÷KТqэ╬┘2┐"Мyх═?√Ф,┘з*┬?E?М#Lб< 8R╣Е?;?Й╜> #F=TSуАй?чh┬╤?Г▀n4?ИЖ≈├┼ЁП²+?ям⌠≤.agЩYъ╟3КS?Е╓⌡" 0ы·╧7╡≈N█;#;ж)}?≤*?gдИр^I▒?Вэ╫о!╥O`g?─╪(Ё╨й)ФгЬ{ийwм=88╚x╢=49<)*NГf│цж?АёG_?aЮхТТ╝a╘8·о5÷?√Э╞ Э╞d╪ыГze╦╕и▌3UQбг?╢ЩДг▄nЁ█G~▄Ь?╠дЩьдЩh╝EВя??Тv╬Ц°Gz?сМ╕?!G*?(ЬJ╬╨ 0≈ъ╓ ЛV┴?Ё²⌠к?+аЭЁ~МДt÷╖Kk(@ж?KЯКLtмM∙1"я╖+╟?qMЧX?═е╕⌠│ы╕NqЗзфО╢█_╨NДмbG+дЁ>Q╢▌W?ё;╒Mk╒1N|Л,:шЫ.е&│л?┼!╓Вз 9A"Нп╜'?F┬Л²И????нhбСe?°(O╒?9??╗TК=∙ыK:██o?П?ьy┴ъpRч?ЛРcБc(u═╒9)·?Ю╘Цчz╛■ф1²9ь?ё▐?E│Б?rLЦ|Y\[u0442]?йs╨╦U╛?{I╠w┌╦┐Е<}JtF▐²д?? ??i??▄ Ш??р??┌??3Ч3д²≈?lзО_EФy┼ е?щЩs<╥Mn?ЭкиptМ█?Яч▌║`L7[е▐г╨AO°??©·УO▌ONлК?Т╒ █nЦЯ-┼╝█J≈ ?&u ?Щё▄yNE?Щё?с3╒Ю[≈╫ТшКwБ-Ъ?┼XLС9? ╦4╖'▌?4╒W&?Р?б═╜Б╔▀Л┴╙┼q ╛6?р?#k?рf(v?²?Я©╫(╩??$/k┤3╕╝ю╬?7Ot?·d[⌠?;чh$?≈чM╖Ы6╪?-ч├╞Ы?iЖ©щW╫CQ?╧┬D?3NЪЮ???ОН.nn?хлPг╗-w??lХ?щ?D?R?JЦ└??(d;ЯSЗ╥ z??ЬТЕ>Яв_ХIi?bК?м3J?КлeY9П┴╓v²Ъ?╚s╒?X5??


ledmon

title: ledmon(8)


lft

package: lft

title: lft(8)

text:
# lft(8)

## NAME
lft — display the route packets take to a network host/socket using one of several layer-4 protocols and methods; optionally show heuristic network information in transitu

## SYNOPSIS
lft

[-d dport] [-s sport] [-m retry min] [-M retry max] [-a ahead] [-c scatter ms] [-t timeout ms] [-l min ttl] [-H max ttl] [-L length] [-q ISN] [-D device] [-f device] [-G icons path] [-ACEINPRSTUVbeghinpruvxyz] [<gateway> <...>] target:dport

## DESCRIPTION
The Internet is a large and complex aggregation of network hardware, connected together by gateways. Tracking the route one's packets follow (or finding the miscreant gateway that's discarding your packets) can be difficult. (from traceroute(8))

lft was developed to automate a solution to the above, taking into account that modern networks contain many configurations of load balancers, proxies, and stateful firewalls.

lft implements numerous network tracing methods and strategies. Generally, lft sends various types of layer-4 probes utilizing the IP protocol `time to live' field and attempts to elicit an ICMP `time exceeded in transit' response from each gateway along the path to some host. RFC 1393 Traceroute Using an IP Option is also available as one of several tracing methods.

lft additionally listens for various messages along the way to assist network managers in ascertaining per-protocol heuristic routing information. lft can optionally retrieve various information about the networks it traverses using a variety of sources such as registries, routing arbiters, etc.

The only mandatory parameter is the target host name or IP number. Options toggle the display of more interesting data or change the variables of the trace itself. The (-E/-e) adaptive option tries several combinations of TCP states (changing flags inside the probes it sends) in order to improve the chances of a successful trace and expose stateful packet filters.

Other options are:

-d dport

Set dport as the destination TCP port of the probes LFT generates. Default is 80. This option is useful to see if packets follow a different route based on protocol destination, a likely scenario when load balancers or proxies are involved. This option may also bypass less sophisticated packet filter configurations.

-s sport

Set sport as the origin TCP port of the probes LFT generates. Default is 53. This option is useful to see if packets follow a different route based on protocol source. This option may also bypass less sophisticated packet filter configurations.

-z

Automatically select a pseudo-random source port. This option may be useful if your local packet filter or proxy doesn't allow you to use source ports outside of the dymanic range allocation.

-m min

Set min as the minimum number of re-attempts to send per host. Default is 1 unless adaptive (-E) mode is used.

-M max

Set max as the maximum number of re-attempts to send per host. Default is 3.

-a ahead

Set ahead as the number of hops forward to query before waiting for a response. Default is 5.

-c scatter ms

Set scatter ms as the minimum number of milliseconds to wait between sending probes. Default is 20.

-t timeout ms

Set timeout ms as the maximum number of milliseconds to wait before assuming a probe was lost/discarded. Default is 1000.

-l min ttl

Set min tll as the minimum TTL (time-to-live) on outgoing probes (essentially, the first hop in the line that you want to display). Default is 1.

-q ISN

Set ISN as the ISN (initial sequence number) of the first probe. If unset, one will be automatically generated using a pseudo-random, time-seeded algorithm.

-L length

Set length as the size of probe packets in bytes. This includes layer-3 and layer-4 headers, but does not include layer-2 headers. For example, setting the length to 1500 would create a 1500-byte probe packet which would result in a 1514-byte frame on an Ethernet network.

-D device

Set device as the network device or address to receive traffic. (e.g., "en1" or "1.2.3.4") If unset, lft will attempt to determine and acquire the appropriate interface based on routing.

-f device

Set device as the network device or address to transmit traffic. (e.g., "en1" or "1.2.3.4") If unset, lft will attempt to determine and acquire the appropriate interface based on routing. This serves to operate lft in a passive mode where you may transmit from a (potentially) spoofed IP address on one interface, yet receive on another. This allows you to trace from a different IP address whose traffic you can see in order to intercept replies.

-H ttl

Set ttl as the maximum TTL, essentially the maximum route traversal distance in hops. Default is 30.

-G icons path

Set icons path as the path to GraphViz icons in connection with GraphViz output.

-I

Set the ToS (Type of Serice) bit on outgoing IP datagrams. The ToS will be set to the differentiated services request minimize-delay.

-i

Disable "stop" on ICMP other than TTL expired.

-n

Print addresses numerically rather than symbolically and numerically. Disables use of the DNS resolver completely.

-h

Print addresses symbolically rather than symbolically and numerically. If the DNS resolver fails to resolve an address, the address is printed numerically.

-E/e

Enable use of the adaptive engine which tries several combinations of TCP states (changing flags inside the probes it sends) in order to improve the chances of a successful trace. The engine also displays other useful information such as stateful inspection firewalls or broken IP stacks encountered along the way.

-F

Enable use of TCP packets with the FIN flag set. This strategy fools unsophisticated packet filters that don't maintain a proper state table. Such devices will forward the packet to its destination rather than filter it, assuming a handshake has already taken place and the probes are part of an existing and valid TCP stream.

-u

Enable use of UDP-based probes instead of TCP-based probes. This strategy is similar to the traditional traceroute method, but many of LFT's other options (such as source and destination port selection) are still available. By default, LFT's UDP probes have a small payload (unlike LFT's TCP probes that carry no payload).

-N

Enable lookup and display of network or AS names (e.g., [GNTY-NETBLK-4]). This option queries Prefix WhoIs, RIPE NCC, or the RADB (as requested). In the case of Prefix WhoIs or RADB, the network name is displayed. In the case of RIPE NCC, the AS name is displayed.

-P

Enable RFC 1393 tracing method using ICMP and an IP option. While this strategy has been formalized in an RFC, few network equipment vendors support it.

-p

Enable use of ICMP-based probes instead of TCP-based probes. This strategy is sometimes the fastest, however firewalls commonly filter ICMP at network borders. ICMP probes are echo request (ping) packets.

-b

Enable TCP basic tracing method. Unlike the default method, the basic method generates TCP probes without relying upon sequence numbers being conveyed correctly. This makes LFT more comptabile with networks employing NAT, but is slower than the default method. TCP basic may also be used with adaptive mode (-E).

-A

Enable lookup and display of of AS (autonomous system) numbers (e.g., [1]). This option queries one of several whois servers (see options 'C' and 'r') in order to ascertain the origin ASN of the IP address in question. By default, LFT uses the pWhoIs service whose ASN data tends to be more accurate and more timely than using the RADB as it is derived from the Internet's global routing table. See www.pwhois.org

-r

Force use of the RIPE NCC RIS whois service to lookup ASNs. This is an alternative source of timely ASN-related information built using the Internet's global routing table. See www.ripe.net/projects/ris

-C

Force use of the Cymru whois service to lookup ASNs. This is an alternative source of timely ASN-related information built using the Internet's global routing table. See www.cymru.com

-R

Force use of the RADB whois service to lookup ASNs. This tends to be quick, but incomplete and usually inaccurate with regard to the 'actual' Internet routing table. See www.radb.net

-T

Enable display of LFT's execution timer. This option places timers on the trace itself and on lookups and name resolution to show where LFT is spending its time, waiting on resolvers, or processing trace packets. Use with -V (verbose) to display additional detail.

-U

Display all times in UTC/GMT0. This option also enables the -T option automatically.

-S

Suppress display of the real-time status bar. This option makes LFT show its completed trace output only, no-frills.

-x

Enable XML output and suppress all other output to stdout.

-g

Enable GraphViz output and suppress all other output to stdout.

-y

Enable network seam testing in connection with GraphViz output.

-V

Display verbose output. Use more V's for more info.

-v

Display version information, then exit(1).

Any hosts listed after these options and before the final host/target will comprise the loose source route. Since network operators have security concerns regarding the use of source routing, don't expect the LSRR options to do anything for you in most public networks.

## EXAMPLES
A sample use and output might be:

```
[edge.lax]$ lft -S 4.2.2.2

Hop  LFT trace to vnsc-bak.sys.gtei.net (4.2.2.2):80/tcp
 1   ln-gateway.centergate.com (206.117.161.1) 0.5ms
 2   isi-acg.ln.net (130.152.136.1) 2.3ms
 3   isi-1-lngw2-atm.ln.net (130.152.180.21) 2.5ms
 4   gigabitethernet5-0.lsanca1-cr3.bbnplanet.net (4.24.4.249) 3.0ms
 5   p6-0.lsanca1-cr6.bbnplanet.net (4.24.4.2) 3.4ms
 6   p6-0.lsanca2-br1.bbnplanet.net (4.24.5.49) 3.3ms
 7   p15-0.snjpca1-br1.bbnplanet.net (4.24.5.58) 10.9ms
 8   so-3-0-0.mtvwca1-br1.bbnplanet.net (4.24.7.33) 11.1ms
 9   p7-0.mtvwca1-dc-dbe1.bbnplanet.net (4.24.9.166) 11.0ms
10   vlan40.mtvwca1-dc1-dfa1-rc1.bbnplanet.net (128.11.193.67) 11.1ms
**   [neglected] no reply packets received from TTLs 11 through 20
**   [4.2-3 BSD bug] the next gateway may errantly reply with reused TTLs
21   [target] vnsc-bak.sys.gtei.net (4.2.2.2) 11.2ms
```

The (-S) option was used to suppress the real-time status bar for clean output. LFT's "**" notifiers in between hops 10 and 21 represent additional useful information: the first is a "[neglected]" indicator that lets us know that none of the probes sent with the TTLs indicated elicited responses. This could be for a variety of reasons, but the cause of this specific occurrence is described in the next informative message which indicates that this is likely the result of a bug in the 4.[23] BSD network code (and its derivatives): BSD 4.x (x < 3) sends an unreachable message using whatever TTL remains in the original datagram. Since, for gateways, the remaining TTL is zero, the ICMP "time exceeded" is guaranteed to not make it back to us. LFT does its best to identify this condition rather than print lots and lots of hops that don't exist (trying to reach a high enough TTL).

Now, using the adaptive engine option:

```
[edge.lax]$ lft -E -S 4.2.2.1

Hop  LFT trace to vnsc-pri.sys.gtei.net (4.2.2.1):80/tcp
 1   ln-gateway.centergate.com (206.117.161.1) 0.5/0.5ms
 2   isi-acg.ln.net (130.152.136.1) 2.1/2.3ms
 3   isi-1-lngw2-atm.ln.net (130.152.180.21) 2.6/7.1ms
 4   gigabitethernet5-0.lsanca1-cr3.bbnplanet.net (4.24.4.249) 6.1/3.9ms
**   [firewall] the next gateway may statefully inspect packets
 5   p0-0-0.lsanca1-csr1.bbnplanet.net (4.24.4.10) 155.4/3.7ms
 6   [target] vnsc-pri.sys.gtei.net (4.2.2.1) 22.6/3.7/*/*/*/*/*ms
```

In the scenario above, the adaptive engine was able to identify a stateful, packet-inspecting firewall in the path. Another example with more options:

```
[edge.lax]$ lft -S -A -T -m 2 -d 80 -s 53 www.yahoo.com

Hop  LFT trace to w9.scd.yahoo.com (66.218.71.88):80/tcp
 1   [226] ln-gateway.centergate.com (206.117.161.1)  1 ms
 2   [226] isi-acg.ln.net (130.152.136.1)  2 ms
 3   [226] isi-1-lngw2-atm.ln.net (130.152.180.21)  3 ms
 4   [1] gigether5-0.lsanca1-cr3.bbnplanet.net (4.24.4.249)  3 ms
 5   [1] p6-0.lsanca1-cr6.bbnplanet.net (4.24.4.2)  5 ms
 6   [1] p6-0.lsanca2-br1.bbnplanet.net (4.24.5.49)  3 ms
 7   [1] p1-0.lsanca2-cr2.bbnplanet.net (4.25.112.1)  3 ms
 8   [16852] pos4-0.core1.LosAngeles1.Level3.net (209.0.227.57)  3 ms
 9   [3356] so-4-0-0.mp1.LosAngeles1.Level3.net (209.247.10.193)  3 ms
10   [3356] so-3-0-0.mp2.SanJose1.Level3.net (64.159.1.130)  11 ms
11   [3356] gige10-0.ipcolo4.SanJose1.Level3.net (64.159.2.42)  11 ms
12   [3356] cust-int.level3.net (64.152.81.62)  52 ms
13   [10310] vl17.bas2.scd.yahoo.com (66.218.64.150)  53 ms
14   [10310] w9.scd.yahoo.com (66.218.71.88) [target]  54 ms

LFT's trace took 5.23 seconds.  Resolution required 3.58 seconds.
```

Note the -Ar above displays ASNs using the RADB as a whois source. A better option may have been to use the -A alone or perhaps -AC.

And why not request netblock lookups?

```
[edge.lax]$ lft -S -N www.microsoft.com

Hop  LFT trace to www.us.microsoft.com (207.46.197.113):80/tcp
 1   [LOS-NETTOS-BLK4] ln-gateway.centergate.com (206.117.161.1)  2 ms
 2   [LOS-NETTOS] isi-acg.ln.net (130.152.136.1)  3 ms
 3   [LOS-NETTOS] isi-1-lngw2-pos.ln.net (130.152.80.30)  5 ms
 4   [GNTY-4-0] gigether5-0.lsanca1-cr3.bbnplanet.net (4.24.4.249)  4 ms
 5   [GNTY-4-0] p6-0.lsanca1-cr6.bbnplanet.net (4.24.4.2)  3 ms
 6   [GNTY-4-0] p6-0.lsanca2-br1.bbnplanet.net (4.24.5.49)  3 ms
 7   [GNTY-4-0] p15-0.snjpca1-br1.bbnplanet.net (4.24.5.58)  10 ms
 8   [GNTY-4-0] p9-0.snjpca1-br2.bbnplanet.net (4.24.9.130)  11 ms
 9   [GNTY-4-0] so-1-0-0.sttlwa2-br1.bbnplanet.net (4.0.3.229)  27 ms
10   [GNTY-4-0] so-0-0-0.sttlwa1-hcr1.bbnplanet.net (4.24.11.202)  28 ms
11   [GNTY-4-0] so-7-0-0.sttlwa1-hcr2.bbnplanet.net (4.24.10.234)  28 ms
12   [GNTY-4-0] p1-0.sttlwa1-cr2.bbnplanet.net (4.24.10.241)  29 ms
13   [GNTY-4-0] p2-0.msseattle.bbnplanet.net (4.25.89.6)  32 ms
14   [MICROSOFT-GLOBAL-NET] 207.46.154.9  32 ms
15   [MICROSOFT-GLOBAL-NET] 207.46.155.17  33 ms
16   [MICROSOFT-GLOBAL-NET] 207.46.129.51 [prohibited]  35 ms
```

## TROUBLESHOOTING
If traces don't appear to go anywhere, there are a number of things to try. If you are receiving an error related to permissions, be sure the lft executable is set-uid root so it may execute with root-level permissions required to utilize raw sockets on most operating systems.

If you do not receive permissions-related errors, but traces still don't go anywhere, first activate verbose output by adding -VV to your command line options. Then, reading the verbose output, if you see trace probes going out, but no replies being detected (as indicated by "RCVD" tags), you may: Use the TCP basic (-b) method if you wish to use TCP probes and you fear NAT may be causing your trace to fail. Alternatively, select a different trace method and protocol such as UDP (-u) or ICMP (-p).

If you are attempting to use RFC 1393 (-P) and your trace is failing, this is likely because network equipment somewhere in the path does not conform to RFC 1393. Your only option is to select an alternative tracing method or protocol.

If you are attempting to utilize adaptive mode (-E/-e) and traces fail, first try enabling NAT compatibility using TCP basic (-b). If traces still fail, the most likely reason is a close-proximity stateful firewall in your network, which prevents this feature from working.

## AUTHORS
Victor Oppleman, Eugene Antsilevitch, Sergey Kondryukov and other helpers around the world.

## REPORTING BUGS
To report bugs, send e-mail to <lft@oppleman.com>

## SEE ALSO
traceroute(8), netstat(1), whois(1), whob(8)

## HISTORY
The lft command first appeared in 1998 as 'fft'. Renamed as a result of confusion with fast fourier transforms, lft stands for 'layer four traceroute.' Thanks also to Nils McCarthy for writing 'FFT', LFT's predecessor.


whob

title: whob(8)

text:
# whob(8)

## NAME
whob — display whois-type information of interest to Internet operators

## SYNOPSIS
whob

[-h whois-server] [-g] [-AaCcfhNnOopRrstuVv] query

## DESCRIPTION
whob queries various sources of whois information for data of interest to network operators and their tracing and debugging tools.

whob output is designed to be easily parsed, or better yet, its functionality can be added directly into your programs (see whois.h).

The only mandatory parameter is the target host name or IP number. Options toggle the display of more interesting data or change the sources used to obtain that data.

One key advantage of whob is its lookup of ASN information derived from the global Internet routing table itself, as opposed to relying solely on what has been registered in the RADB/IRR (see below). This data is, by default, sourced from the global pWhoIs service. See www.pwhois.org

Other options are:

-A ASN

Display all routing advertisements transiting the respective ASN. The ASN may be supplied as the target argument, or a hostname or IP address may be supplied and whob will resolve the ASN automatically.

-a ASN

Display all routing advertisements made by the respective Origin-AS. The Origin-AS may be supplied as the target argument, or a hostname or IP address may be supplied and whob will resolve the ASN automatically.

-P prefix

Display all routing advertisements related to the CIDR prefix supplied by the user.

-N ASN

Display all networks registered to the ASN supplied by the user.

-O ASN

Display all contact information on file for the ASN supplied by the user.

-g

Disable GIGO mode. By popular request, whob takes input directly from the command line and passes it without modification to pWhoIs or whatever whois server is requested (-h). The exact output is returned without any parsing. To enable parsing and the other useful switches, disable GIGO mode by passing this (-g) option.

-R

Display the Origin-AS on record at the RADB/IRR (Routing Arbiter Database/Internet Routing Registry) in addition the the Origin-AS provided by the prefix-based whois data source.

-n

Display the network name on record with the IP network allocation registry also such as ARIN, RIPE, or APNIC.

-o

Display the organization name on file at the registrar.

-p

Display the AS-Path from the perspective of the current pwhois server. The pwhois server may automatically exclude the initial, least specific ASN received from the operator of the network to which it is connected (unless that ASN is the only/origin ASN or unless it has multiple peers). Of course, this AS-Path is subjective. If you rely on this and want AS-Paths that correspond to *your* network infrastructure, you may want to install your own pwhois server. See the (-w) option and www.pwhois.org

-t

Display the date the route was last cached by the pWhoIs server.

-u

When possible, display dates in UTC/GMT instead of local time.

-h/w host

Change the source of prefix-based whois data from the default (pWhoIs) to any whois-compatible server of your choice (like your own).

-f file

Read from the specified file (or from stdin if the argument is '-') and submit its contents as bulk input to pwhois. The input will be buffered accordingly and subject to the constraints of the current pwhois server. Output is written to STDOUT (which may be redirected) and will not be parsed. Additional instructions to pwhois may be placed at the beginning of the file, however they will only apply to the first buffer of pwhois input. The first (left-most) field in each line of the file must be the IP address and lines may be up to 255 characters in length.

-c

Change the source of prefix-based whois data from the default (pWhoIs) to Cymru. See www.cymru.com for more details. When used with the -f option, this switch causes whob to use Cymru whois for bulk file resolution instead of pwhois.

-r

Display the Origin-AS and prefix according to RIPE NCC RIS (see www.ripe.net/projects/ris/). When used with the -f option, this switch causes whob to use RIPE NCC riswhois for bulk file resolution instead of pwhois.

-s

Show the status of the (respective) pWhoIs server and exit(0)

-V

Display verbose/debug output. Use multiple 'V's for additional verbosity.

-v

Display this client's version information and exit(1)

-me|whoami

Display this host's public IP address and exit(0)

## AUTHORS
Victor Oppleman and Eugene Antsilevitch

## REPORTING BUGS
To report bugs, send e-mail to <whob@oppleman.com>

## SEE ALSO
lft(8), whois(1)

## HISTORY
The whob command first appeared in 2004. This whois framework has been a component of LFT since 2002.


captest

package: libcap-ng-utils

title: captest(8)

summary: a program to demonstrate capabilities

text:
# captest(8)

## NAME
captest - a program to demonstrate capabilities

## SYNOPSIS
captest [ --ambient --drop-all | --drop-caps | --id ] [ --init-grp ] [ --lock ] [ --text ]

## DESCRIPTION
captest is a program that demonstrates and prints out the current process capabilities. Each option prints the same report. It will output current capabilities. then it will try to access /etc/shadow directly to show if that can be done. Then it creates a child process that attempts to read /etc/shadow and outputs the results of that. Then it outputs the capabilities that a child process would have.

You can also apply file system capabilities to this program to study how they work. For example, filecap /usr/bin/captest chown. Then run captest as a normal user. Another interesting test is to make captest suid root so that you can see what the interaction is between root's credentials and capabilities. For example, chmod 4755 /usr/bin/captest. When run as a normal user, the program will see if privilege escalation is possible. But do not leave this app setuid root after you are don testing so that an attacker cannot take advantage of it.

## OPTIONS
--ambient

This attempts to add CAP_CHOWN ambient capability.

--drop-all

This drops all capabilities including ambient and clears the bounding set.

--drop-caps

This drops just traditional capabilities.

--id

This changes to uid and gid 99, drops supplemental groups, and clears the bounding set.

--init-grp

This changes to uid and gid 99 and then adds any supplemental groups that comes with that account. You would have add them prior to testing because by default there are no supplemental groups on account 99.

--text

This option outputs the effective capabilities in text rather than numerically.

--lock

This prevents the ability for child processes to regain privileges if the uid is 0.

## SEE ALSO
filecap(8), capabilities(7)

## AUTHOR
Steve Grubb


filecap

title: filecap(8)

summary: a program to see capabilities

text:
# filecap(8)

## NAME
filecap - a program to see capabilities

## SYNOPSIS
filecap [ -a | -d | /dir | /dir/file [cap1 cap2 ...] ]

## DESCRIPTION
filecap is a program that prints out a report of programs with file based capabilities. If a file is not in the report or there is no report at all, no capabilities were found. For expedience, the default is to check only the directories in the PATH environmental variable. If the -a command line option is given, then all directories will be checked. If a directory is passed, it will recursively check that directory. If a path to a file is given, it will only check that file. If a file is given followed by capabilities, then the capabilities are written to the file.

## OPTIONS
-a

This tells the program to show all capabilities starting from the / directory. Normally the PATH environmental variable is used to show you capabilities on files you are likely to execute.

-d

This dumps all capabilities for reference.

## EXAMPLES

```
To check file capabilities in $PATH:
filecap
To check file capabilities of whole system:
filecap -a
To check file capabilities recursively in a directory:
filecap /usr
To check file capabilities of a specific program:
filecap /bin/passwd
To list all possible capabilities:
filecap -d
To set a file capability on a specific program:
filecap /bin/ping net_raw net_admin
To remove file capabilities on a specific program:
filecap /bin/ping none
```

## SEE ALSO
pscap(8), netcap(8), capabilities(7).

## AUTHOR
Steve Grubb


netcap

title: netcap(8)

summary: a program to see capabilities

text:
# netcap(8)

## NAME
netcap - a program to see capabilities

## SYNOPSIS
netcap

## DESCRIPTION
netcap is a program that prints out a report of process capabilities. If the application is using tcp, udp, raw, or packet family of sockets AND has any capabilities, it will be in the report. If the process has partial capabilities, it is further examined to see if it has an open-ended bounding set. If this is found to be true, a '+' symbol is added. If the process has ambient capabilities, a '@' symbols is added.

Some directories in the /proc file system are readonly by root. The program will try to access and report what it can. But if nothing comes out, try changing to the root user and re-run this program.

## SEE ALSO
pscap(8), filecap(8), capabilities(7), netstat(8).

## AUTHOR
Steve Grubb


pscap

title: pscap(8)

summary: a program to see capabilities

text:
# pscap(8)

## NAME
pscap - a program to see capabilities

## SYNOPSIS
pscap [ -a | -p pid ]

## DESCRIPTION
pscap is a program that prints out a report of process capabilities. If the application has any capabilities, it will be in the report with the exception of init. By giving the -a command line option, init will be included, too. By giving a pid with the -p command line option, only the process specified with the pid is reported. If a process is not in the report, it has dropped all capabilities. If the process has partial capabilities, it is further examined to see if it has an open-ended bounding set. If this is found to be true, a '+' symbol is added. If the process has ambient capabilities, a '@' symbols is added.

The command name in the output may be followed by an asterisk mark (*). This mark denotes processes which run in child user namespaces (relative to the user namespace of pscap itself).

## SEE ALSO
netcap(8), filecap(8), capabilities(7), ps(8).

## AUTHOR
Steve Grubb


captree

package: libcap-utils

title: captree(8)

summary: display tree of process capabilities

text:
# captree(8)

## NAME
captree - display tree of process capabilities

## SYNOPSIS
captree [OPTIONS] [(pid|glob-name) ...]

## DESCRIPTION
captree displays the capabilities on the mentioned processes indicated by pid or glob-name value(s) given on the command line. If no pid etc values are supplied, pid=1 is implied. A pid value of 0 displays all the processes known to the kernel.

The POSIX.1e capabilities are displayed in double quotes in the cap_from_text(3) format. The IAB tuple of capabilities is displayed between square brackets in the text format described in cap_iab(3). Note, the IAB tuple text is omitted if it contains empty A and B components. This is because the regular POSIX.1e text contains information about the Inheritable flag already. This behavior can be overridden with the --verbose command line argument.

Optional arguments (which must precede the list of pid|glob-name values):

--help

Displays usage information and exits. Note, modern Go runtimes exit with status 0 in this case, but older runtimes exit with status 2.

--verbose

Displays capability sets and IAB tuples even when they are empty, or redundant.

--depth=n

Displays the process tree to a depth of n. Note, the default value for this parameter is 0, which implies infinite depth.

--colo[u]r=false

Colo[u]rs the targeted PIDs, if stdout is a TTY, in red. This option defaults to true when running via a TTY. The --color=false argument will suppress this color. Piping the output into some other program will also suppress the use of colo[u]r.

## EXIT STATUS
If the supplied target cannot be found the exit status is 1. Should an unrecognized option be provided, the exit status is 2. Otherwise, captree exits with status 0.

## REPORTING BUGS
Please report bugs via:

https://bugzilla.kernel.org/buglist.cgi?component=libcap&list_id=1090757

## SEE ALSO
cap_from_text(3), capabilities(7), and cap_iab(3).

There is a longer article about captree, which includes some examples, here:

https://sites.google.com/site/fullycapable/captree

## AUTHOR
Andrew G. Morgan <morgan@kernel.org>


getcap

title: getcap(8)

summary: examine file capabilities

text:
# getcap(8)

## NAME
getcap - examine file capabilities

## SYNOPSIS
getcap [-v] [-n] [-r] [-h] filename [ ... ]

## DESCRIPTION
getcap displays the name and capabilities of each specified file.

## OPTIONS
-h

prints quick usage.

-n

prints any non-zero user namespace root user ID value found to be associated with a file's capabilities.

-r

enables recursive search.

-v

display all searched entries, even if the have no file-capabilities.

filename

One file per line.

## REPORTING BUGS
Please report bugs via:

https://bugzilla.kernel.org/buglist.cgi?component=libcap&list_id=1090757

## SEE ALSO
capsh(1), cap_get_file(3), cap_to_text(3), capabilities(7), user_namespaces(7), captree(8), getpcaps(8) and setcap(8).


getpcaps

title: getpcaps(8)

summary: display process capabilities

text:
# getpcaps(8)

## NAME
getpcaps - display process capabilities

## SYNOPSIS
getpcaps [optional args] pid...

## DESCRIPTION
getpcaps displays the capabilities on the processes indicated by the pid value(s) given on the command line. A pid of 0 displays the capabilities of the process that is running getpcaps itself.

The capabilities are displayed in the cap_from_text(3) format.

Optional arguments:

--help or --usage

Displays usage information and exits.

--ugly or --legacy

Displays output in a somewhat ugly legacy format.

--verbose

Displays usage in a legacy-like format but not quite so ugly in modern default terminal fonts.

--iab

Displays IAB tuple capabilities from the process. The output format here is the text format described in cap_iab(3). Double quotes encase the regular process capabilities and square brackets encase the IAB tuple. This format is also used by captree(8).

## REPORTING BUGS
Please report bugs via:

https://bugzilla.kernel.org/buglist.cgi?component=libcap&list_id=1090757

## SEE ALSO
capsh(1), cap_from_text(3), cap_iab(3), capabilities(7), captree(8), getcap(8), and setcap(8).

## AUTHOR
This manual page was originally written by Robert Bihlmeyer <robbe@debian.org>, for the Debian GNU/Linux system (but may be used by others).


setcap

title: setcap(8)

summary: set file capabilities

text:
# setcap(8)

## NAME
setcap - set file capabilities

## SYNOPSIS
setcap [-q] [-n <rootuid>] [-v] {capabilities|-|-r} filename [ ... capabilitiesN fileN ]

## DESCRIPTION
In the absence of the -v (verify) option setcap sets the capabilities of each specified filename to the capabilities specified. The optional -n <rootuid> argument can be used to set the file capability for use only in a user namespace with this root user ID owner. The -v option is used to verify that the specified capabilities are currently associated with the file. If -v and -n are supplied, the -n <rootuid> argument is also verified.

The capabilities are specified in the form described in cap_from_text(3).

The special capability string, '-', can be used to indicate that capabilities are read from the standard input. In such cases, the capability set is terminated with a blank line.

The special capability string, '-r', is used to remove a capability set from a file. Note, setting an empty capability set is not the same as removing it. An empty set can be used to guarantee a file is not executed with privilege in spite of the fact that the prevailing ambient+inheritable sets would otherwise bestow capabilities on executed binaries.

The -q flag is used to make the program less verbose in its output.

## EXIT CODE
The setcap program will exit with a 0 exit code if successful. On failure, the exit code is 1.

## REPORTING BUGS
Please report bugs via:

https://bugzilla.kernel.org/buglist.cgi?component=libcap&list_id=1090757

## SEE ALSO
capsh(1), cap_from_text(3), cap_get_file(3), capabilities(7), user_namespaces(7), captree(8), getcap(8) and getpcaps(8).