COURIERTCPD(1)              Double Precision, Inc.              COURIERTCPD(1)



NAME
       couriertcpd - the Courier mail server TCP server daemon

SYNOPSIS
       couriertcpd [-pid=pidfile] [option...] {list} {program} {arg...}

       couriertcpd {-pid=pidfile} {-stop}

       couriertcpd {-pid=pidfile} {-restart}

DESCRIPTION
       couriertcpd accepts incoming network connections, and runs program
       after establishing each network connection. The program's standard
       input and output are set to the network connection.

       list is a comma-separated list of TCP port numbers where incoming
       connections are created.  program is the program to run. If program
       requires any arguments, they are specified on the command line, after
       program itself.

       Before running program, couriertcpd initializes several environment
       variables that describe the network connection. The environment
       inherited by program will be the environment inherited by couriertcpd,
       plus any additional environment variables initialized by couriertcpd.
       It is also possible to reject certain network connections. Several
       options are available to specify which network connections will be
       rejected.

OPTIONS
       -access=filename
           Specifies an optional access file. The access file lists the IP
           addresses from which connections should be accepted or rejected.
           The access file is also used to initialize environment variables
           based on the IP address of the connection.  filename is a GDBM or
           DB database file that's usually created by a script from one or
           more text files. See "ACCESS FILE" below for more information.

       -accesslocal
           Lookup the local interface IP and port in the access file, in
           addition to looking up the remote IP. This gives a mechanism for
           setting environment variables depending on which IP address and/or
           port the client connected to. In the access file, "1.2.3.4.25"
           matches connections to IP address 1.2.3.4 port 25; "1.2.3.4"
           matches connections to IP address 1.2.3.4 on any port; and "*.25"
           matches connections to port 25 on any IP address.

       -address=n.n.n.n
           Accept network connections only to IP address n.n.n.n. If not
           specified, couriertcpd accepts connections to any IP address that
           the system accepts connections on. If the system has multiple
           network interfaces with separate IP addresses, this option makes
           couriertcpd accept connections only to one specific IP address.
           Most systems have multiple network interfaces: the loopback
           interface, plus the local network interface, so that
           -address=127.0.0.1 accepts connections only from the local system.
           When multiple port numbers are specified, it is also possible to
           selectively bind different network addresses to each port number
           when list specifies more than one port number. See "Multiple port
           list[1]" below for more information.

       -block=zone[,var[/n.n.n.n][,msg]]
           Initialize the environment variable var if both of the following
           conditions are true: var is not already initialized; the connecting
           IP address can be found in a DNS-based list. See DNS ACCESS LISTS,
           below. Multiple -block options can be used.

       -denymsg=text
           Specifies an optional message to be returned to the client if the
           -access option rejects them. The default is to drop the TCP
           connection without sending back any messages.

       -drop=var
           If the environment variable var is set to a nonempty value,
           terminate immediately. Do not run the program to handle the
           connection. See DNS ACCESS LISTS, below, for more information.  var
           defaults to "BLOCK", if not specified.

       -group=group
           Set couriertcpd's its group ID.  group may be specified
           numerically, or by its name. Only the superuser may use -group.

       -listen=n
           Length of the queue which holds pending connections.  n is a
           number. If not specified, the system default is used.

       -maxperc=n
           Maximum number of connections accepted from the same C network
           block. Using this option is recommended, because connection slots
           are limited. Without this option, the same C network block can
           potentially use up all available connection slots.

       -maxperip=n
           Maximum number of connections accepted from the same IP address.
           Use both the -maxperc and -maxperip options to fine tune connection
           limits. For example, when couriertcpd is listening on the SMTP port
           it makes sense to set an upper limit on the number of connections
           from the same C block. Domains that send a large amount of mail
           often have multiple servers sending outbound mail from the same C
           block, so it makes sense to set limits on individual C blocks. On
           the other hand, if couriertcpd is listening on the POP3 port it
           makes more sense to set limits on individual IP addresses. If a C
           block of addresses is assigned to a dialup modem pool, it is
           certainly possible to have many IP addresses within the same C
           block have connections to the POP3 server at the same time.

       -maxprocs=n
           Maximum number of connection slots, or the maximum number of
           processes started. This effectively specifies the maximum number of
           connections accepted at the same time. After the maximum number of
           connections has been opened, couriertcpd waits for an existing
           connection to close, before accepting any more connections.

       -warn=n
           Log a LOG_WARNING message to syslog when the number of active
           processes exceeds n. The default is 90% of maxprocs.  couriertcpd
           logs a LOG_ALERT syslog message when the number of active processes
           reaches the maximum.

       -nodnslookup
           Do not look up the hostname associated with connecting IP address
           and the local addres, do not initialize the TCPREMOTEHOST or
           TCPLOCALHOST environment variables (see below).

       -noidentlookup
           Do not perform an ident lookup, and do not initialize the
           TCPREMOTEINFO environment variable.

       -pid=filename
           If given, couriertcpd puts itself into the background and saves its
           process ID in this file, usually somewhere in /var/run.

           This option must also be present when using the -restart and -stop
           options.

       -restart
           Send a SIGHUP to an existing couriertcpd process. Specify the same
           -pid argument as the one that was used to start couriertcpd. The
           process ID is read from the -pid file, and the couriertcpd receives
           a SIGHUP signal.

       -stderr=socket
           Set program's standard error to the network connection, just like
           its standard input and output.

       -stderr=logfile
           Set program's standard error to the specified file, logfile. The
           file is created, if necessary, and is opened in append mode.

       -stderrlogger=logprogram
           Set program's standard error to a pipe, which is read by
           logprogram. Only one instance of logger is started, which receives
           standard error from every instance of program. The specified logger
           is executed with the output end of the stderr pipe connected as
           standard input.  logprogram is executed with one argument -
           program's name.

       -stderrloggername=name
           Use name as the argument to logprogram, instead of the program's
           name.

       -stop
           Stop (kill) an existing couriertcpd process. Specify the same -pid
           argument as the one that was used to start couriertcpd. The process
           ID is read from the -pid file, and the couriertcpd process is
           killed. All child processes of couriertcpd will receive a SIGTERM
           signal.

       -user=user
           Set couriertcpd's user ID. Also, the group ID is set to the user's
           group ID. Using both -group and -user is not necessary. Only the
           superuser can specify -user.

MULTIPLE PORT LIST
       The list argument can be a comma-separated list of multiple port
       numbers.  couriertcpd will create network connections on any listed
       port. Each port number can be optionally specified as "address.port",
       for example:

           couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,999 program

       This instance accepts network connections to either port 25 or port
       999, however connections on port 25 are created only on the IP address
       127.0.0.1, the loopback interface.

       Whenever an IP address is not specified, network connections are
       accepted to any IP address (called "wildcarding"). On IPv6-capable
       systems, couriertcpd will attempt to create two incoming network
       connection ports, if an IP address is not specified. After creating the
       first port as an IPv6 wildcard port, couriertcpd will then attept to
       create an IPv4 wildcard port, with the same port number. Some
       BSD-derived systems must use separate IPv6 and IPv4 wildcard ports to
       create incoming network connections. Most other systems only need an
       IPv6 port to create both IPv6 and IPv4 incoming network connections.
       couriertcpd quietly ignores a failure to create an IPv4 wildcard port,
       as long as an IPv6 wildcard was succesfully created.

       The -address option can be used to default a specific IP address for
       every listed port number. For example:

           couriertcpd -pid=/var/run/smtp.pid 127.0.0.1.25,127.0.0.1.999 program

       and

           couriertcpd -pid=/var/run/smtp.pid -address=127.0.0.1 25,999 program

       will create network connections on ports 25 and 999 of the IP address
       127.0.0.1.

ACCESS FILE
       The access file lists IP addresses that couriertcpd will accept or
       reject connections from. An access file is optional. Without an access
       file couriertcpd accepts a connection from any IP address.

       Both IPv4 and IPv6 addresses can be specified, if IPv6 support is
       available. A non-standard syntax is currently used to specify IPv6
       addresses. This is subject to change in the near future. IPv6 support
       is currently considered to be experimental.

       The access file is a binary database file that's usually created by a
       script, such as makesmtpaccess(8)[2], from one or more plain text
       files. Blank lines in the text file are ignored. Lines that start with
       the # character are also ignored.

   Rejecting and accepting connections by IP address
       The following line instructs couriertcpd to reject all connections from
       an IP address range:

           netblock<tab>deny

       netblock is an IP address, such as 192.68.0.2.  <tab> is the ASCII tab
       character. There MUST be exactly one tab character after the IP address
       and the word "deny".

       You can also block connections from an entire network C block:

           192.68.0<tab>deny

       This blocks connections from IP addresses 192.68.0.0 through
       192.68.0.255. Blocking connections from an entire B or A network block
       works the same way.

       Use the word "allow" instead of "deny" to explicitly allow connections
       from that IP address or netblock. For example:

           192.68.0<tab>deny
           192.68.0.10<tab>allow

       This blocks all connections from 192.68.0.0 to 192.68.0.255 except for
       192.68.0.10. These two lines can occur in any order.  couriertcpd
       always uses the line with the most specific IP address.

       If the IP address of the connection is not found in the access file the
       connection is accepted by default. The following line causes unlisted
       connections to be rejected:

           *<tab>deny

   IPv6 addresses
           Note
           IPv6 support in the access file is experimental, and is subject to
           change in a future release. The following syntax is subject to
           change at any time.

       The access file can also specify IPv6 addresses, if IPv6 support is
       available. The existing IPv4 address format is used for IPv6-mapped
       IPv4 addresses, and no changes are required. For all other IPv6
       addresses use the following format:

           :hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh<tab>action

       The IPv6 address must begin with :. The initial : character is not
       really a part of the IPv6 address, it is only used to designate this
       record as an IPv6 address, allowing an access file to contain a mixture
       of IPv4 and IPv6 addresses. The IPv6 address follows the initial :
       character, and it must be spelled out using zero-padded lowercase
       hexadecimal digits. For example:

           :0000:0000:0000:0000:0000:f643:00a2:9354<tab>deny

       Netblocks must be specified using even-word boundaries only:

           :3ffe<tab>deny

       This will deny entire 3ffe::/16 (6bone network, which is phased out).

           :2002:c0a8<tab>deny

       This will deny 2002:c0a8::/32 (6to4 addresses derived from private
       address space).

   Setting environment variables
       allow can be optionally followed by a list of environment variable
       assignments, separated by commas. The environment variables are set
       before executing program or checking access lists (see below). For
       example:

           192.68.0<tab>allow,RELAYCLIENT
           192.68.0.10<tab>allow,RELAYCLIENT,SIZELIMIT=1000000

       This sets RELAYCLIENT environment variable for connections from the
       192.68.0 block. In addition to that, the SIZELIMIT environment variable
       is set to 1000000 if the connection comes from the IP address
       192.68.0.10.

       Note that RELAYCLIENT must be explicitly specified for the IP address
       192.68.0.10. The first line is NOT used for connections from this IP
       address.  couriertcpd only reads one entry from the access file, the
       entry for the most specific IP address.

   DNS ACCESS LISTS
       An alternative to listing banned IP addresses is to use an external
       DNS-based IP access list.

       There is no provision to support IPv6-based lists, because none yet
       exist. IPv6-based access list support will be added in the future.

       couriertcpd's default configuration does not automatically reject
       connections from any IP address listed on a DNS-based list. If the
       connecting IP address is listed couriertcpd simply sets an environment
       variable. It's up to the program, run by couriertcpd, to read the
       environment variable and choose what to do if the environment variable
       is set.

       Please note that if the environment variable is already set,
       couriertcpd will NOT search the access list. This can be used to
       override the access list where program only recognizes the access list
       if the environment variable is not empty. By setting the environment
       variable to an empty string in the access file (see above), you can
       override access lists for selected IP addresses.

       The -block option queries a DNS list for each connecting IP address.
       The only required argument to -block is the DNS zone that is used to
       publish thelist. The name of the zone can optionally be followed by a
       comma and the name of the environment variable to set if the DNS list
       includes the IP address.  couriertcpd sets the environment variable
       BLOCK if you do not specify the name yourself.

       The name of the environment variable can be optionally followed by a
       slash and an IP address. Normally couriertcpd sets the environment
       variable if the access list includes any A record entry for the
       specified IP address. Some access lists may offer additional
       information by returning one of several possible A records. If the name
       of the environment variable is followed by a slash and an IP address,
       the environment variable will be initialized only if the access list
       includes an A record containing the indicated IP address.

       The contents of the environment variable will be the contents of any
       TXT record for the listed IP address.  var[/n.n.n.n] can be optionally
       followed by a comma and a text message, which will be used instead of
       the TXT record. The text message may include a single @ character
       somewhere in it, which will be replaced by the listed IP address.

       When the -drop option is given in addition to -block, couriertcpd drops
       the connection, rather than running the program. First, all -block
       options are processed and the environment variables are set, based on
       the results of any matching DNS lookups. The -drop gets processed after
       all DNS lookups.  -drop takes a list of comma-separated environment
       variables (if not specified, BLOCK is the default list). If any
       environment variable named by the -drop option is set to a non-empty
       string, couriertcpd drops the connection instead of executing the
       program.

   MULTIPLE DNS LISTS
       Multiple -block options can be used. The connecting IP address gets
       looked up in multiple access lists. This is implemented as follows.

       couriertcpd processes all -block options one at a time. If the
       indicated environment variable is already set, couriertcpd skips the
       DNS list lookup (this is also true if only one -block option is
       specified). Therefore, if multiple -block options are used, and an IP
       address is found in the first access list, the remaining lists that use
       the same environment variable will not be checked. But other lists that
       use a different environment variable WILL be checked.

       The same zone can be specified more than once, with different
       environment variables and different IP addresses. For example:

           couriertcpd -block=block.example.org,BLOCK1/127.0.0.2 \
                       -block=block.example.org,BLOCK2/127.0.0.3

       If the specified access list contains an A record for the listed
       address, and the A record contains the IP address 127.0.0.2,
       couriertcpd initializes the BLOCK1 environment variable. If the A
       record contains the IP address 127.0.0.3, couriertcpd initializes
       BLOCK2. If both records are present, both variables are initialized.

       couriertcpd uses the following logic to determine what kind of DNS
       query to issue:

       If neither the IP address, nor msg is specified, couriertcpd will query
       for existence of TXT records, for the IP address.

       If only msg is specified, couriertcpd looks up the existence of A
       records, for the IP address.

       If /n.n.n.n is used, and msg is not specified for at least one -block
       option for this same zone, couriertcpd will query for existence of ANY
       records, which should return both TXT and all the A records for this IP
       address.

       If /n.n.n.n is used, and msg is specified for every -block option for
       this same zone, couriertcpd will query for existence of A records only.

ENVIRONMENT VARIABLES
       couriertcpd also initializes the following environment variables prior
       to running program:

       TCPLOCALHOST
           The name of the host on the local end of the network connection,
           looked up in DNS.  TCPLOCALHOST will not be set if the IP address
           of the network connection's local end cannot be found in DNS, or if
           -nodnslookup option is specified.  TCPLOCALHOST will be set to the
           string softdnserr if the DNS lookup fails with a temporary error
           (so you cannot tell if the IP address has a valid host name
           associated with it), or if the reverse and forward DNS lookups do
           not match.  TCPLOCALHOST will not be set if the reverse DNS lookup
           fails completely.

       TCPLOCALIP
           The IP address of the local end of the network connection.

       TCPLOCALPORT
           Rhe number of the port of the local end of the network connection.

       TCPREMOTEHOST
           The hostname of the connecting host. Like TCPLOCALHOST, but for the
           connecting IP address.

       TCPREMOTEIP
           Connecting IP address.

       TCPREMOTEINFO
           Identification string received from the IDENT server on the remote
           IP address. Not set if the IDENT server returned an error, or if
           the -noidentlookup option was specified.

       TCPREMOTEPORT
           TCP port of the remote end of the network connection.

SEE ALSO
       courier(8)[3].

AUTHOR
       Sam Varshavchik
           Author

NOTES
        1. Multiple port list
           [set $man.base.url.for.relative.links]/#list

        2. makesmtpaccess(8)
           [set $man.base.url.for.relative.links]/makesmtpaccess.html

        3. courier(8)
           [set $man.base.url.for.relative.links]/courier.html



Courier Mail Server               04/04/2011                    COURIERTCPD(1)
