couriertcpd - Courier TCP server daemon

couriertcpd -pid=pidfile [ option ... ] list program arg ...

couriertcpd -pid=pidfile -stop

couriertcpd -pid=pidfile -restart

couriertcpd accepts incoming network connections, and runs program after establishing each network connection. The program's standard input and output are set to the network connection.

list is a comma-separated list of TCP port numbers where incoming connections are created. program is the program to run. If program requires any arguments, they are specified on the command line, after program itself.

Before running program, couriertcpd initializes several environment variables that describe the network connection. The environment inherited by program will be the environment inherited by couriertcpd, plus any additional environment variables initialized by couriertcpd. It is also possible to reject certain network connections. Several options are available to specify which network connections will be rejected.

-access=filename

Specifies an optional access file. The access file lists the IP addresses from which connections should be accepted or rejected. The access file is also used to initialize environment variables based on the IP address of the connection. filename is a GDBM or DB database file that's usually created by a script from one or more text files. See "ACCESS FILE" below for more information.

-address=n.n.n.n

Accept network connections only to IP address n.n.n.n. If not specified, couriertcpd accepts connections to any IP address that the system accepts connections on. If the system has multiple network interfaces with separate IP addresses, this option makes couriertcpd accept connections only to one specific IP address. Most systems have multiple network interfaces: the loopback interface, plus the local network interface, so that -address=127.0.0.1 accepts connections only from the local system. When multiple port numbers are specified, it is also possible to selectively bind different network addresses to each port number when list specifies more than one port number. See "Multiple port list" below for more information.

-block=zone[,var[/n.n.n.n][,msg]]

Initialize the environment variable var if both of the following conditions are true: var is not already initialized; the connecting IP address can be found in a DNS-based list. See DNS ACCESS LISTS, below. Multiple -block options can be used.

-denymsg=text

Specifies an optional message to be returned to the client if the -access option rejects them. The default is to drop the TCP connection without sending back any messages.

-group=group

Set couriertcpd's its group ID. group may be specified numerically, or by its name. Only the superuser may use -group.

-listen=n

Length of the queue which holds pending connections. n is a number. If not specified, the system default is used.

-maxperc=n

Maximum number of connections accepted from the same C network block. Using this option is recommended, because connection slots are limited. Without this option, the same C network block can potentially use up all available connection slots.

-maxperip=n

Maximum number of connections accepted from the same IP address. Use both the -maxperc and -maxperip options to fine tune connection limits. For example, when couriertcpd is listening on the SMTP port it makes sense to set an upper limit on the number of connections from the same C block. Domains that send a large amount of mail often have multiple servers sending outbound mail from the same C block, so it makes sense to set limits on individual C blocks. On the other hand, if couriertcpd is listening on the POP3 port it makes more sense to set limits on individual IP addresses. If a C block of addresses is assigned to a dialup modem pool, it is certainly possible to have many IP addresses within the same C block have connections to the POP3 server at the same time.

-maxprocs=n

Maximum number of connection slots, or the maximum number of processes started. This effectively specifies the maximum number of connections accepted at the same time. After the maximum number of connections has been opened, couriertcpd waits for an existing connection to close, before accepting any more connections.

-warn=n

Log a LOG_WARNING message to syslog when the number of active processes exceeds n. The default is 90% of maxprocs. couriertcpd logs a LOG_ALERT syslog message when the number of active processes reaches the maximum.

-nodnslookup

Do not look up the hostname associated with connecting IP address and the local addres, do not initialize the TCPREMOTEHOST or TCPLOCALHOST environment variables (see below).

-noidentlookup

Do not perform an ident lookup, and do not initialize the TCPREMOTEINFO environment variable.

-pid=filename

REQUIRED OPTION: name of a file where couriertcpd saves its process ID, usually somewhere in /var/run.

-restart

Send a SIGHUP to an existing couriertcpd process. Specify the same -pid argument as the one that was used to start couriertcpd. The process ID is read from the -pid file, and the couriertcpd receives a SIGHUP signal.

-stderr=socket

Set program's standard error to the network connection, just like its standard input and output.

-stderr=logfile

Set program's standard error to the specified file, logfile. The file is created, if necessary, and is opened in append mode.

-stderrlogger=logprogram

Set program's standard error to a pipe, which is read by logprogram. Only one instance of logger is started, which receives standard error from every instance of program. The specified logger is executed with the output end of the stderr pipe connected as standard input. logprogram is executed with one argument - program's name.

-stderrloggername=name

Use name as the argument to logprogram, instead of the program's name.

-stop

Stop (kill) an existing couriertcpd process. Specify the same -pid argument as the one that was used to start couriertcpd. The process ID is read from the -pid file, and the couriertcpd process is killed. All child processes of couriertcpd will receive a SIGTERM signal.

-user=user

Set couriertcpd's user ID. Also, the group ID is set to the user's group ID. Using both -group and -user is not necessary. Only the superuser can specify -user.

The list argument can be a comma-separated list of multiple port numbers. couriertcpd will create network connections on any listed port. Each port number can be optionally specified as "address.port", for example:

couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,999 program

This instance accepts network connections to either port 25 or port 999, however connections on port 25 are created only on the IP address 127.0.0.1, the loopback interface.

Whenever an IP address is not specified, network connections are accepted to any IP address (called "wildcarding"). On IPv6-capable systems, couriertcpd will attempt to create two incoming network connection ports, if an IP address is not specified. After creating the first port as an IPv6 wildcard port, couriertcpd will then attept to create an IPv4 wildcard port, with the same port number. Some BSD-derived systems must use separate IPv6 and IPv4 wildcard ports to create incoming network connections. Most other systems only need an IPv6 port to create both IPv6 and IPv4 incoming network connections. couriertcpd quietly ignores a failure to create an IPv4 wildcard port, as long as an IPv6 wildcard was succesfully created.

The -address option can be used to default a specific IP address for every listed port number. For example:

couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,127.0.0.1.999 program

and

couriertcpd -pid=/var/run/smtp.pid -address=127.0.0.1 25,999 program

will create network connections on ports 25 and 999 of the IP address 127.0.0.1.

The access file lists IP addresses that couriertcpd will accept or reject connections from. An access file is optional. Without an access file couriertcpd accepts a connection from any IP address.

Both IPv4 and IPv6 addresses can be specified, if IPv6 support is available. A non-standard syntax is currently used to specify IPv6 addresses. This is subject to change in the near future. IPv6 support is currently considered to be experimental.

The access file is a binary database file that's usually created by a script, such as makesmtpaccess(8), from one or more plain text files. Blank lines in the text file are ignored. Lines that start with the # character are also ignored.

REJECTING AND ACCEPTING CONNECTIONS BY IP ADDRESS

netblock<tab>deny

192.68.0<tab>deny

192.68.0<tab>deny
192.68.0.10<tab>allow

*<tab>deny

IPV6 ADDRESSES

:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh<tab>action

:0000:0000:0000:0000:0000:f643:00a2:9354<tab>deny

:0000:0000:0000:e240<tab>deny

SETTING ENVIRONMENT VARIABLES

192.68.0<tab>allow,RELAYCLIENT
192.68.0.10<tab>allow,RELAYCLIENT,SIZELIMIT=1000000

DNS ACCESS LISTS

MULTIPLE DNS LISTS

couriertcpd -block=block.example.org,BLOCK1/127.0.0.2 \
            -block=block.example.org,BLOCK2/127.0.0.3

couriertcpd also initializes the following environment variables prior to running program:

TCPLOCALHOST

The name of the host on the local end of the network connection, looked up in DNS. TCPLOCALHOST will not be set if the IP address of the network connection's local end cannot be found in DNS, or if -nodnslookup option is specified. TCPLOCALHOST will be set to the string softdnserr if the DNS lookup fails with a temporary error (so you cannot tell if the IP address has a valid host name associated with it), or if the reverse and forward DNS lookups do not match. TCPLOCALHOST will not be set if the reverse DNS lookup fails completely.

TCPLOCALIP

The IP address of the local end of the network connection.

TCPLOCALPORT

Rhe number of the port of the local end of the network connection.

TCPREMOTEHOST

The hostname of the connecting host. Like TCPLOCALHOST, but for the connecting IP address.

TCPREMOTEIP

Connecting IP address.

TCPREMOTEINFO

Identification string received from the IDENT server on the remote IP address. Not set if the IDENT server returned an error, or if the -noidentlookup option was specified.

TCPREMOTEPORT

TCP port of the remote end of the network connection.

courier(8).