---
name: "netacl"
section: "8"
platform: "linux"
package: "fwtk"
version: "1.3-1"
release: "Debian 1.3 (Bo)"
platforms: ["linux"]
url: "https://new.carta.tech/netacl"
---

# netacl(8)

TCP network access control

## NAME

netacl - TCP network access control

## SYNOPSIS

**netacl servicename** \[invoked from inetd\]

## DESCRIPTION

**netacl** provides a degree of access control for TCP-based services invoked from **[inetd(8)](/inetd/8.md).** When a server is started, **inetd** invokes netacl with the name of the service requested, instead of the actual server. **netacl** then searches its permissions information (read from **netperm-table** ) to see if the host initiating the connection is authorized. If the host is authorized, the real server process is invoked. Otherwise, **netacl** exits. Acceptance or rejection of the service is logged via the **syslog** facility.

**netacl** duplicates functionality found in other tools such as **log\_tcp** by Wietse Venema, but is included with the toolkit because it is a simpler implementation, contains no  support for UDP services, and shares a common configuration file with the rest of the toolkit components.

## OPTIONS

**netacl** takes one parameter: the name of the service it is to provide. This service name is appended to the string "netacl-" to generate the name by which rules are read from the **netperm-table** configuration file. If invoked with no parameters, the service is assumed to be the program name - in case one needs to replace the executable of some daemon with a copy of **netacl.** For example, if **netacl** is invoked as:\
 *netacl in.telnetd*\
 it will retrieve all the configuration rules for *netacl-in.telnetd.*

The following configuration rules are recognized:

- **hosts \[options\]**

  specifies a host permission rule. Host permission rules are in the form of:

  netacl-in.telnet permit-hosts host1 host2 -options netacl-in.telnet deny-hosts host1 host2 -options

  Following the **permit-hosts** or **deny-hosts** clause is a list of host names or IP-addresses, which can contain wildcards. Host names are searched in order until the first option (starting with a '-') is encountered, at which point, if there is a match for that rule, it will be accepted. If the rule is a deny-hosts rule, the program will log the denial of service and exit. If it is a permit-hosts rule, the options will be processed and executed in order. If there is no rule explicitly permitting or deny a service, the service is denied. Options are:

-

  **-exec executable \[args\]** specifies a program to invoke to handle the service. This option **must** be the final option in the rule. A -exec option **must** be present in every rule.

-

  **-user userid** where userid is the numeric UID or the name from a login in **/etc/passwd which the program should be invoked as.**

-

  **-chroot rootdir** specifies a directory to which **netacl** should [chroot(2)](/chroot/2.md) prior to invoking the service program. This requires that the service program be present, and the pathname for the executable be relative to the new root.

## EXAMPLES

In this example, the \\ line wraps have been added to fit lines on the page. \\-escapes are not permitted in  **netperm-table,** they are here as part of the example only

netacl-in.telnetd: permit-hosts 192.33.112.\* \\\
        \-exec /usr/etc/in.telnetd\
 netacl-in.ftpd: permit-hosts unknown \\\
        \-exec /bin/cat /usr/local/etc/noftp.txt\
 netacl-in.ftpd: permit-hosts 192.33.112.\* \\\
        \-exec /usr/etc/in.ftpd\
 netacl-in.ftpd: permit-hosts \* -chroot /home/ftp \\\
        \-exec /bin/ftpd -f

In the example above, **netacl** is configured to permit telnet only for hosts in a particular subnet. **ftpd** is configured to accept all connections from systems that do not have a valid DNS name ("unknown") and to invoke **cat** to display a file when a connection is made. This provides an easy and flexible means of politely informing someone that they are not permitted to use a service. Hosts in the specified subnet are connected to the real FTP server in **/usr/etc/in.ftpd** but all connections from other networks are connected to a version of the FTP server that is already chrooted to the FTP area, effectively making all FTP activity "captive".

## INSTALLATION

To install **netacl** first place the executable in a system area, then modify **/etc/inetd.conf** as desired, replacing entries for the servers that will be controlled via **netacl.** For example (syntax may differ slightly depending on O/S version) the FTP service might be configured as:

```
ftp stream tcp nowait root /usr/local/etc/netacl in.ftpd
```

Once inetd.conf has been modified, restart or reload **inetd.** Verify installation by attempting a connection, and monitoring the system logs.

## FILES

- **/etc/inetd.conf**

  **netperm-table**

## SEE ALSO

[**netperm-table**(5)](/netperm-table/5.md) [**inetd**(8)](/inetd/8.md)

## BUGS