netperm-table(5)

NAME

netperm-table - configuration file for firewall toolkit

SYNOPSIS

/etc/netperm-table

DESCRIPTION

The file netperm-table is the configuration and permissions database for components of the Trusted Firewall Toolkit. ( netacl, smap, smapd, ftp-gw, tn-gw, and plug-gw ) When an application in the toolkit starts up, it reads its configuration and permissions information from netperm-table and stores it in an in-memory database (to retain it even after a chroot(2) system call).

The permissions/configuration file is organized into rules, one rule per line of text. The first part of each rule is the name of the application that rule applies to, followed by a colon. Multiple applications can be targeted by a single rule, by separating the names with commas, or wildcarding them with an asterisk. When an application extracts its configuration information, it only extracts the rules that apply to it, preserving the order in which they appeared in the file. For example, if the application smap read its configuration rules, the following would all match:

# sample rules for smap
smap, smapd:  userid 4
smap, smapd:  directory /mail/inspool
smap:         timeout 3600

Commas can be inserted in the configuration file by starting the line with '#' as the first character.

Once an application has matched a rule, the rule is tokenized into whitespace-delimited strings for later application specific use. Typically, the application retrieves matching rules based on the first word in the rule; the remaining words serve as parameters to that clause. Special modifiers are recognized for each clause, if it begins with a permit- or deny- the rule is internally flagged as granting or revoking permission for that clause. I.e., if an application retrieves all of its configuration clauses for "hosts", the following will be returned:

netacl-in.ftpd: permit-hosts 192.33.112.117 -exec /usr/etc/in.ftpd
netacl-in.ftpd: permit-hosts 198.137.240.101 -exec /usr/etc/in.ftpd
netacl-in.ftpd: deny-hosts unknown
netacl-in.ftpd: deny-hosts *

CONVENTIONS

Much of the usage of the netperm-table is application specific, but where possible, several conventions are enforced. When a host name or host IP address is given to match against, matching is performed based on whether the pattern to match against is all digits and decimal points, or whether it contains other characters. If the pattern to match against is entirely digits and decimals, matching is performed against the IP address, otherwise it is performed against the hostname. Generally, to prevent being vulnerable to DNS spoofing, one should use configuration rules based on IP addresses. When matching, asterisk wildcards are supported, with syntax similar to the shell's, matching as many characters as possible. When resolving IP addresses to DNS names, if the reverse lookup fails, the host name is set to "unknown." When resolution is performed, a check is made to ensure that the IP address for the DNS name returned by the reverse lookup is the same. If it is not, the host name is set to "unknown" and a warning is logged. This permits rules to specifically operate on hosts that didn't have valid DNS mappings. Thus:

192.33.*   will match against IP address
*.tis.com  will match against host name
unknown    will match against hosts not in the DNS

Note that sites using NIS or other resolver systems where the gethostbyaddr library routine returns a non-fully-qualified domain name will have problems generating a matching rule using their domain name. In this case, the numeric IP address should be used. In general, using IP addresses will provide better security, by removing the threat of DNS spoofing attacks.

DIAGNOSTICS

Syslog error messages are generated by malformed lines, including lines that are missing the application name or colon, lines that are missing any clause following the colon, lines that have too many tokens, or a memory allocation error.

FILES

/etc/netperm-table

CAVEATS

The location of netperm-table is compiled into the components of the firewall toolkit. Its location may change, depending on compile time options.

Applications in the toolkit that attempt to open netperm-table and fail will exit with a warning in syslog.