Mercurial > notdcc

comparison dccd.8.in @ 0:c7f6b056b673

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
First import of vendor version
author Peter Gervai <grin@grin.hu>
date Tue, 10 Mar 2009 13:49:58 +0100
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:c7f6b056b673
1 .\" Copyright (c) 2008 by Rhyolite Software, LLC
2 .\"
3 .\" This agreement is not applicable to any entity which sells anti-spam
4 .\" solutions to others or provides an anti-spam solution as part of a
5 .\" security solution sold to other entities, or to a private network
6 .\" which employs the DCC or uses data provided by operation of the DCC
7 .\" but does not provide corresponding data to other users.
8 .\"
9 .\" Permission to use, copy, modify, and distribute this software without
10 .\" changes for any purpose with or without fee is hereby granted, provided
11 .\" that the above copyright notice and this permission notice appear in all
12 .\" copies and any distributed versions or copies are either unchanged
13 .\" or not called anything similar to "DCC" or "Distributed Checksum
14 .\" Clearinghouse".
15 .\"
16 .\" Parties not eligible to receive a license under this agreement can
17 .\" obtain a commercial license to use DCC by contacting Rhyolite Software
18 .\" at sales@rhyolite.com.
19 .\"
20 .\" A commercial license would be for Distributed Checksum and Reputation
21 .\" Clearinghouse software. That software includes additional features. This
22 .\" free license for Distributed ChecksumClearinghouse Software does not in any
23 .\" way grant permision to use Distributed Checksum and Reputation Clearinghouse
24 .\" software
25 .\"
26 .\" THE SOFTWARE IS PROVIDED "AS IS" AND RHYOLITE SOFTWARE, LLC DISCLAIMS ALL
27 .\" WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
28 .\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL RHYOLITE SOFTWARE, LLC
29 .\" BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
30 .\" OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
31 .\" WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
32 .\" ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
33 .\" SOFTWARE.
34 .\"
35 .\" Rhyolite Software DCC 1.3.103-1.143 $Revision$
36 .\"
37 .Dd February 26, 2009
38 .ds volume-ds-DCC Distributed Checksum Clearinghouse
39 .Dt dccd 8 DCC
40 .Os " "
41 .Sh NAME
42 .Nm dccd
43 .Nd Distributed Checksum Clearinghouse Daemon
44 .Sh SYNOPSIS
45 .Bk -words
46 .Nm dccd
47 .Op Fl 64dVbfFQ
48 .Fl i Ar server-ID
49 .Op Fl n Ar brand
50 .Op Fl h Ar homedir
51 .Fl I Xo
52 .Sm off
53 .Op Ar host-ID
54 .Op Ar ,user
55 .Sm on
56 .Xc
57 .br
58 .Oo
59 .Fl a Xo
60 .Sm off
61 .Op Ar server-addr
62 .Op Ar ,server-port
63 .Xc
64 .Sm on
65 .Oc
66 .Op Fl q Ar qsize
67 .br
68 .Oo
69 .Fl G Xo
70 .Sm off
71 .Op Ar on,
72 .Op Ar weak-body,
73 .Op Ar weak-IP,
74 .Op Ar embargo
75 .Op Ar ,window
76 .Op Ar ,white
77 .Xc
78 .Sm on
79 .Oc
80 .br
81 .Oo
82 .Fl W Xo
83 .Sm off
84 .Op Ar rate
85 .Op Ar ,chg
86 .Op Ar ,dbsize
87 .Sm on
88 .Xc
89 .Oc
90 .Oo
91 .Fl K Xo
92 .Sm off
93 .Op Ar no-
94 .Ar type
95 .Sm on
96 .Xc
97 .Oc
98 .Op Fl T Ar tracemode
99 .Op Fl u Ar anon-delay Ns Op Ar *inflate
100 .Op Fl C Ar dbclean
101 .Op Fl L Ar ltype,facility.level
102 .br
103 .Oo
104 .Fl R Xo
105 .Sm off
106 .Op Ar RL_SUB ,
107 .Op Ar RL_ANON ,
108 .Op Ar RL_ALL_ANON ,
109 .Op Ar RL_BUGS
110 .Xc
111 .Sm on
112 .Oc
113 .Ek
114 .Sh DESCRIPTION
115 .Nm Dccd
116 receives reports of checksums related to mail received by DCC clients
117 and queries about the total number of reports of particular checksums.
118 A DCC server never receives
119 mail, address, headers, or other information from clients, but only
120 cryptographically secure checksums of such information.
121 A DCC server cannot determine the text or other information that corresponds
122 to the checksums it receives.
123 It only acts as a clearinghouse of total counts of checksums
124 computed by clients.
125 .Pp
126 Each DCC server or close cluster of DCC servers is identified by a numeric
127 .Ar server-ID .
128 Each DCC client is identified by a
129 .Ar client-ID ,
130 either explicitly listed in the
131 .Pa ids
132 file or
133 the special anonymous client-ID.
134 Many computers are expected to share a single
135 .Ar client-ID .
136 A
137 .Ar server-ID
138 is less than 32768 while a
139 .Ar client-ID
140 is between 32768 and 16777215.
141 DCC server-IDs need be known only to DCC servers and the people running
142 them.
143 The passwords associated with DCC server-IDs should be protected,
144 because DCC servers listen to commands authenticated with server-IDs
145 and their associated passwords.
146 Each client that does not use the anonymous ID must know the client-ID
147 and password used by each of its servers.
148 A single client computer can use different passwords with different
149 server computers.
150 See the
151 .Pa ids
152 file.
153 .Pp
154 A whitelist of known good (or bad) sources of email prevents
155 legitimate mailing lists from being seen as unsolicited bulk email
156 by DCC clients.
157 The whitelist used by a DCC server is built into
158 the database when old entries are removed by
159 .Xr dbclean 8 .
160 Each DCC client has its own, local whitelist, and in general,
161 whitelists work better in DCC clients than servers.
162 .Pp
163 The effectiveness of a Distributed Checksum Clearinghouse
164 increases as the number of subscribers increases.
165 Flooding reports of checksums among DCC servers increases
166 the effective number of subscribers to each server.
167 Each
168 .Nm
169 daemon tries to maintain TCP/IP connections to the other servers
170 listed in the
171 .Pa flod
172 file, and send them reports containing checksums with total
173 counts exceeding thresholds.
174 Changes in the
175 .Pa flod
176 file are noticed automatically within minutes.
177 .Pp
178 Controls on report flooding are specified in the
179 .Pa flod
180 file.
181 Each line specifies a hostname and port number to which reports
182 should be flooded,
183 a server-ID to identify and authenticate the output stream,
184 a server-ID to identify and authenticate an input stream from the
185 same server,
186 and flags with each ID.
187 The ability to delete reports of checksums is handy, but could
188 be abused.
189 If
190 .Ar del
191 is not present among the
192 .Ar in-opts
193 options for the incoming ID,
194 incoming delete requests are logged and then ignored.
195 Floods from DCC "brands" that count only mail to
196 spam traps and whose servers use the
197 .Fl Q
198 option to count extremely bulk mail
199 should be marked with
200 .Ar traps .
201 They can be seen as counting millions of targets, so the
202 .Ar traps
203 flag on their
204 .Pa flod
205 file entry changes their incoming flooded reports counts to
206 .Em many.
207 .Pp
208 .Nm Dccd
209 automatically checks its
210 .Pa flod
211 and
212 .Pa ids
213 files periodically.
214 .Xr Cdcc 8
215 has the commands
216 .Ic new ids
217 and
218 .Ic flood check
219 to tell
220 .Nm
221 to check those two files immediately.
222 Both files are also checked for changes after the SIGHUP signal.
223 .Ss OPTIONS
224 The following options are available:
225 .Bl -tag -width 3n
226 .It Fl 6
227 enable IPv6.
228 The default is equivalent to
229 .Fl 4 .
230 See also the IPv4 and IPv6 options in the
231 .Pa flod
232 file description below and the
233 .Em IPv6 on
234 .Xr cdcc 8
235 command.
236 .It Fl 4
237 disable IPv6.
238 See also
239 .Fl 6 .
240 .It Fl d
241 enables debugging output.
242 Additional
243 .Fl d
244 options increase the number of messages.
245 .It Fl V
246 displays the version of the DCC server daemon.
247 .It Fl b
248 causes the server to not detach itself from the controlling tty
249 or put itself into the background.
250 .It Fl F
251 uses write() instead of mmap() in some cases to modify the DCC database.
252 It is the default on Solaris.
253 .It Fl f
254 turns off
255 .Fl F .
256 .It Fl Q
257 causes the server to treat reports of checksums as queries
258 except from DCC clients marked trusted in the
259 .Pa ids
260 file with
261 .Ar rpt-ok .
262 See
263 .Fl u
264 to turn off access by anonymous or unauthenticated clients
265 .It Fl i Ar server-ID
266 specifies the ID of this DCC server.
267 Each server identifies itself as responsible for checksums
268 that it forwards to other servers.
269 .It Fl n Ar brand
270 is an arbitrary string of letters and numbers that
271 identifies the organization running the DCC server.
272 The brand is required, and appears in the SMTP
273 .Em X-DCC
274 headers generated by the DCC.
275 .It Fl h Ar homedir
276 overrides the default DCC home directory,
277 .Pa @prefix@ .
278 .It Fl I Xo
279 .Sm off
280 .Op Ar host-ID
281 .Op Ar ,user
282 .Sm on
283 .Xc
284 changes the server's globally unique identity for flooding
285 from the default value
286 consisting of the first 16 characters of the host name.
287 or changes the UID and GID of the process
288 .Ar Host-ID
289 is a string of up to 16 characters that replaces the first
290 16 characters of the system's hostname in assertions
291 of the server-ID that are flooded to peers.
292 .Ar User
293 must be valid user name.
294 .It Fl a Xo
295 .Sm off
296 .Op Ar server-addr
297 .Op Ar ,server-port
298 .Sm on
299 .Xc
300 adds an hostname or IP address to the list of local IP addresses
301 that the server answers.
302 Multiple
303 .Fl a
304 options can be used to specify a subset of the available network
305 interfaces or to use more than one port number.
306 The default without any
307 .Fl a
308 options is to listen on all local IP addresses.
309 It can be useful to list some of the IP addresses of
310 multi-homed hosts to deal with firewalls.
311 By default
312 .Ar server-port
313 is 6277 for DCC servers and 6276 for Greylist servers.
314 It is the UDP port at which DCC
315 requests are received and the TCP port for incoming floods of reports.
316 .Pp
317 If
318 .Ar server-addr
319 is absent
320 and if the
321 .Xr getifaddrs 8
322 function is supported,
323 separate UDP sockets are bound to each configured network interface so
324 that each DCC clients receives replies from the
325 IP addresses to which corresponding request are sent.
326 If
327 .Nm
328 is started before all network interfaces are turned on or
329 there are interfaces that are turned on and off or change their addresses
330 such as PPP interfaces,
331 then the special string
332 .Ar @
333 should be used to tell
334 .Nm
335 to bind to an IN_ADDRANY UDP socket.
336 .Pp
337 Outgoing TCP connections to flood checksum reports to other DCC servers
338 used the IP address of a single
339 .Fl a
340 option,
341 but only if there is single option that is not localhost.
342 See also the
343 .Pa flod
344 file.
345 .It Fl q Ar qsize
346 specifies the maximum size of the queue of requests from anonymous or
347 unauthenticated clients.
348 The default value is the maximum DCC RTT in seconds times 200 or 1000.
349 .It Fl G Xo
350 .Sm off
351 .Op Ar on,
352 .Op Ar weak-body,
353 .Op Ar weak-IP,
354 .Op Ar embargo
355 .Op Ar ,window
356 .Op Ar ,white
357 .Xc
358 .Sm on
359 changes
360 .Nm
361 to a Greylist server for
362 .Xr dccm 8
363 or
364 .Xr dccifd 8 .
365 Greylisting consists of temporarily rejecting or embargoing mail from
366 unfamiliar combinations of SMTP client IP address, SMTP envelope sender,
367 and SMTP envelope recipient.
368 If the SMTP client persists for
369 .Ar embargo seconds
370 and so is probably not an open proxy, worm-infected personal computer,
371 or other transient source of spam, the triple of
372 .Em (IP\ address,sender,recipient)
373 is added to a database similar to the usual DCC database.
374 If the SMTP client does not try again after
375 .Ar embargo
376 seconds and before
377 .Ar window
378 seconds after the first attempt,
379 the triple is forgotten.
380 If the SMTP client persists past the embargo,
381 the triple is added to the database and becomes familiar
382 and the message is accepted.
383 Familiar triples are remembered for
384 .Ar white
385 seconds after the last accepted mail message.
386 The triple is forgotten if it is ever associated with unsolicited bulk email.
387 .Pp
388 All three durations can be a number of minutes, hours, days, or
389 weeks followed by
390 .Ar MINUTES ,
391 .Ar M ,
392 .Ar HOURS ,
393 .Ar H ,
394 .Ar DAYS ,
395 .Ar D ,
396 .Ar WEEKS
397 or
398 .Ar W .
399 The default is
400 .Fl G Ar 270seconds,7days,63days .
401 The first duration or the
402 .Ar embargo
403 should be longer than open proxies can linger retransmitting.
404 The second
405 .Ar window
406 time should be as long as legitimate mail servers persist in retransmitting
407 to recognize embargoed messages whose retransmissions were not
408 received because of network or other problems.
409 The
410 .Ar white
411 time should be long enough to recognize and not embargo messages from
412 regular senders.
413 .Pp
414 Usually the DCC greylist system requires that an almost
415 identical copy of the message be retransmitted during the
416 .Ar embargo .
417 If
418 .Ar weak-body
419 is present,
420 any message with the same triple of sender IP address, sender mail
421 address, and target mail address ends the embargo,
422 even if the body of the message differs.
423 .Pp
424 If
425 .Ar weak-IP
426 is present,
427 all mail from an SMTP client at an IP address is accept
428 after any message from the same IP address has been accepted.
429 .Pp
430 Unlike DCC checksums, the contents of
431 greylist databases are private and do not benefit from broad sharing.
432 However, large installations can use more two or more greylist servers
433 flooding triples among themselves.
434 Flooding among greylist servers is controlled by the
435 .Pa grey_flod
436 file.
437 .Pp
438 All greylist cooperating or flooding greylist servers
439 .Em must
440 use the same
441 .Fl G
442 values.
443 .Pp
444 Clients of greylist servers cannot be anonymous and must have
445 client-IDs and passwords assigned in the
446 .Pa ids
447 file.
448 This implies that
449 .Xr cdcc
450 commands directed to greylist servers must specify the server-ID.
451 .Pp
452 White- and blacklists are honored by the DCC clients.
453 whitelisted messages are embargoed or checked with a greylist server.
454 The greylist triples of blacklisted messages, messages whose DCC counts make
455 them spam, and other messages known to be spam are sent to a greylist
456 server to be removed from the greylist database and cause an embargo
457 on the next messages with those triples.
458 .Pp
459 Messages whose checksums match greylist server whitelists
460 are not embargoed and the checksums of their triples are not
461 added to the greylist database.
462 .Pp
463 The target counts of embargoed messages are reported to the DCC network
464 to improve the detection of bulk mail.
465 .It Fl W Xo
466 .Sm off
467 .Op Ar rate
468 .Op Ar ,chg
469 .Op Ar ,dbsize
470 .Sm on
471 .Xc
472 controls quick database cleaning.
473 If the database is larger than
474 .Ar dbsize ,
475 it seems that the database has not recently and is not about to be cleaned,
476 .Nm
477 is receiving fewer than
478 .Ar rate
479 requests per second,
480 and if telling DCC clients that the database is about to be cleaned
481 reduces that rate by
482 .Ar chg Ns %,
483 then
484 .Nm
485 starts
486 .Xr dbclean 8
487 for a quick database cleaning.
488 The cleaning is abandoned if it takes too long.
489 The default values are equivalent to
490 .Bk -words
491 .Fl W Ar 1.0,40.0,RSS
492 where
493 .Ar RSS
494 is the maximum dccd resident set
495 displayed the system log by
496 .Fl d
497 when
498 .Nm starts .
499 .Ek
500 .It Fl K Xo
501 .Sm off
502 .Op Ar no-
503 .Ar type
504 .Sm on
505 .Xc
506 marks checksums of
507 .Ar type
508 (not) be kept
509 or counted in the database unless they appear in the whitelist.
510 Explicit settings add to or remove from the initial contents of the list,
511 which is equivalent to
512 .Fl K Ar Body
513 .Fl K Ar Fuz1
514 .Fl K Ar Fuz2 .
515 .It Fl T Ar tracemode
516 causes the server to trace or record some operations.
517 .Ar tracemode
518 must be one of the following:
519 .Bl -tag -width FLOOD2 -offset 2n -compact
520 .It Ar ADMN
521 administrative requests from the control program,
522 .Xr cdcc 8
523 .It Ar ANON
524 errors by anonymous clients
525 .It Ar CLNT
526 errors by authenticated clients
527 .It Ar RLIM
528 rate-limited messages
529 .It Ar QUERY
530 all queries and reports
531 .It Ar RIDC
532 some messages concerning the report-ID cache that is used
533 to detect duplicate reports from clients
534 .It Ar FLOOD
535 messages about inter-server flooding connections
536 .It Ar FLOOD2
537 messages about flooded reports
538 .It Ar IDS
539 unknown server-IDs in flooded reports
540 .It Ar BL
541 requests from clients in the
542 .Pa blacklist
543 file.
544 .It Ar DB
545 odd database events including long chains of duplicate checksums
546 .It Ar WLIST
547 reports of whitelisted checksums from authenticated, not anonymous DCC clients
548 .El
549 The default is
550 .Ar ANON CLNT .
551 .It Fl u Ar anon-delay Ns Op Ar *inflate
552 changes the number of milliseconds anonymous or unauthenticated clients
553 must wait for answers to their queries and reports.
554 The purpose of this delay is to discourage large anonymous clients.
555 The
556 .Ar anon-delay
557 is multiplied by 1 plus the number of recent anonymous requests from
558 an IP address divided by the
559 .Ar inflate
560 value.
561 .Pp
562 The string
563 .Ar FOREVER
564 turns off all anonymous or unauthenticated access not only
565 for checksum queries and reports but also
566 .Xr cdcc 8
567 .Ic stats
568 requests.
569 A missing value for
570 .Ar inflate
571 turns off inflation.
572 .Pp
573 The default value is
574 .Ar 50,none ,
575 except when
576 .Fl G
577 is used in which case
578 .Ar FOREVER
579 is assumed and required.
580 .It Fl C Ar dbclean
581 changes the default name or path of the program used to rebuild
582 the hash table when it becomes too full.
583 The default value is
584 .Pa @libexecdir@/dbclean
585 in the
586 .Pa @libexecdir@
587 directory.
588 The value can include arguments as in
589 .Ar -C '$DCC_LIBEXEC/dbclean -F' .
590 .Pp
591 Dbclean
592 .Em should not
593 be run by
594 .Nm
595 except in emergencies such as database corruption or hash table overflow.
596 .Xr Dbclean 8
597 should be run daily with the @libexecdir@/cron-dccd cron script
598 .It Fl L Ar ltype,facility.level
599 specifies how messages should be logged.
600 .Ar Ltype
601 must be
602 .Ar error ,
603 .Ar info ,
604 or
605 .Ar off
606 to indicate which of the two types of messages are being controlled or
607 to turn off all
608 .Xr syslog 3
609 messages from
610 .Nm .
611 .Ar Level
612 must be a
613 .Xr syslog 3
614 level among
615 .Ar EMERG ,
616 .Ar ALERT ,
617 .Ar CRIT , ERR ,
618 .Ar WARNING ,
619 .Ar NOTICE ,
620 .Ar INFO ,
621 and
622 .Ar DEBUG .
623 .Ar Facility
624 must be among
625 .Ar AUTH ,
626 .Ar AUTHPRIV ,
627 .Ar CRON ,
628 .Ar DAEMON ,
629 .Ar FTP ,
630 .Ar KERN ,
631 .Ar LPR ,
632 .Ar MAIL ,
633 .Ar NEWS ,
634 .Ar USER ,
635 .Ar UUCP ,
636 and
637 .Ar LOCAL0
638 through
639 .Ar LOCAL7 .
640 The default is equivalent to
641 .Dl Fl L Ar info,MAIL.NOTICE Fl L Ar error,MAIL.ERR
642 .It Fl R Xo
643 .Sm off
644 .Op Ar RL_SUB ,
645 .Op Ar RL_ANON ,
646 .Op Ar RL_ALL_ANON ,
647 .Op Ar RL_BUGS
648 .Xc
649 .Sm on
650 sets one or more of the four rate-limits.
651 .Ar RL_SUB
652 limits the number of DCC transactions per second from subscribers
653 or DCC clients with known client-IDs and passwords.
654 This limit applies to each IP address independently.
655 .Pp
656 .Ar RL_ANON
657 limits the number of DCC transactions per second from anonymous DCC clients.
658 This limit applies to each IP address independently.
659 It is better to use
660 .Fl u
661 than to change this value to exclude anonymous clients.
662 .Pp
663 .Ar RL_ALL_ANON
664 limits the number of DCC transactions per second from all anonymous DCC clients.
665 This limit applies to all anonymous clients as a group, regardless of their
666 IP addresses.
667 .Pp
668 .Ar RL_BUGS
669 limits the number of complaints or error messages per second for all
670 anonymous DCC clients as a group as well as for each DCC client by IP
671 address.
672 .Pp
673 The default is equivalent to
674 .Fl R Ar 400,50,600,0.1
675 .El
676 .Sh FILES
677 .Bl -hang -width @prefix@ -compact
678 .It Pa @prefix@
679 is the DCC home directory containing data and control files.
680 .It Pa dcc_db
681 is the database of mail checksums.
682 .It Pa dcc_db.hash
683 is the mail checksum database hash table.
684 .It Pa grey_db
685 is the database of greylist checksums.
686 .It Pa grey_db.hash
687 is the greylist database hash table.
688 .It Pa flod
689 contains lines controlling DCC flooding of the form:
690 .br
691 .Bd -ragged -compact
692 .Ar host Ns Xo
693 .Sm off
694 .Op Ar ,rport
695 .Op Ar ;src Op Ar ,lport
696 .Sm on
697 .Xc
698 .Ar rem-ID
699 .Op Ar passwd-ID Op Ar o-opt Op Ar i-opt
700 .Ed
701 where absent optional values are signaled with "-" and
702 .Bl -hang -offset 1n -width 2n -compact
703 .It Ar host
704 is the IP address or name of a DCC server and
705 .Ar rport
706 is the name or number of the TCP port used by the remote server.
707 .It Ar src
708 and
709 .Ar lport
710 are the IP address or host name and TCP port
711 from which the outgoing flooding connection should come.
712 Incoming flooding connections must arrive at an address and port
713 specified with
714 .Fl a .
715 .It Ar rem-id
716 is the server-ID of the remote DCC server.
717 .It Ar passwd-ID
718 is a server-ID that is not assigned to a server,
719 but whose first password is used to sign
720 checksum reports sent to the remote system.
721 Either of its passwords are required with incoming reports.
722 If it is absent or "-", outgoing floods are signed with the first
723 password of the local server in the
724 .Pa ids
725 file and incoming floods must be signed with either password of
726 the remote server-ID.
727 .It Ar i-opt Li and Ar o-opt
728 are comma separated lists of
729 .Bl -hang -offset 1n -width 2n -compact
730 .It Ar off
731 turns off flooding to the remote or local system.
732 .It Ar traps
733 indicates that
734 the remote sending or local receiving system has only spam traps.
735 .It Ar no-del
736 says checksum delete requests are refused by the remote or local server
737 and so turns off sending or accepting delete requests, respectively.
738 By default, delete requests are sent to remote servers and accepted
739 in incoming floods if and only if the peers are exchanging DCC reputations.
740 .It Ar del
741 says delete requests are accepted by the remote or local server.
742 .It Ar no-log-del
743 turns off logging of incoming requests to delete checksums.
744 .It Ar passive
745 is used to tell a server outside a firewall to expect a peer
746 inside to create both of the pair
747 of input and output TCP connections used for flooding.
748 The peer inside the firewall should use
749 .Ar SOCKS
750 or
751 .Ar NAT
752 on its
753 .Pa flod
754 file entry for this system.
755 .It Ar SOCKS
756 is used to tell a server inside a firewall that it should create both
757 of the TCP connections used for flooding and that SOCKS protocol should
758 be used.
759 The peer outside the firewall should use
760 .Ar passive
761 on its
762 .Pa flod
763 file entry for this system.
764 .It Ar NAT
765 differs from
766 .Ar SOCKS
767 only by not using the SOCKS protocol.
768 .It Ar ID1->ID2
769 converts server-ID
770 .Ar ID1
771 in flooded reports to server-ID
772 .Ar ID2 .
773 Either
774 .Ar ID1
775 or
776 .Ar ID2
777 may be the string
778 .Sq self
779 to specify the server's own ID.
780 .Ar ID1
781 can be the string
782 .Sq all
783 to specify all server-IDs
784 or a pair of server-IDs separated by a dash to specify an inclusive range.
785 .Ar ID2
786 can be the string
787 .Sq ok
788 to send or receive reports without translation
789 or the string
790 .Sq reject
791 to not send outgoing or refuse incoming reports.
792 Only the first matching conversion is applied.
793 For example, when
794 .Sq self->ok,all->reject
795 is applied to a locally generated report,
796 the first conversion is applied and the second is ignored.
797 .It Ar leaf=path-len
798 does not send reports with paths longer than
799 .Ar path-len
800 server-IDs.
801 .It Ar IPv4
802 overrides a
803 .Fl 6
804 setting for this flooding peer.
805 .It Ar IPv6
806 overrides the
807 default or an explicit
808 .Fl 4
809 setting.
810 .It Ar vers
811 specifies the version of the DCC flooding protocol used by the remote
812 DCC server with a string such as
813 .Sq version2 .
814 .It Ar trace
815 sends information about a single peer like the
816 .Xr cdcc 8
817 command
818 .Ic trace FLOOD on
819 does for all peers.
820 .It Ar trace2
821 sends information about individual flooded reports like the
822 .Xr cdcc 8
823 command
824 .Ic trace FLOOD2 on
825 does for all peers.
826 .El
827 .El
828 .It Pa grey_flod
829 is the equivalent of
830 .Pa flod
831 used by
832 .Nm
833 when it is a greylist server.
834 .It Pa flod.map
835 is an automatically generated file in which
836 .Nm
837 records its progress sending or flooding reports to DCC peers.
838 .It Pa grey_flod.map
839 is the equivalent of
840 .Pa flod.map used by
841 .Nm
842 when it is a greylist server.
843 .It Pa ids
844 contains the IDs and passwords known by the DCC server.
845 An
846 .Pa ids
847 file that can be read by others cannot be used.
848 It contains blank lines, comments starting
849 with "#" and lines of the form:
850 .Bd -ragged -compact -offset indent
851 .Sm off
852 .Ar id
853 .Op Ar ,rpt-ok
854 .Op Ar ,delay=ms Ns Op Ar *inflate
855 .Sm on
856 .Ar passwd1 Op Ar passwd2
857 .Ed
858 where
859 .Bl -hang -offset 1n -width 2n -compact
860 .It Ar id
861 is a DCC
862 .Ar client-ID
863 or
864 .Ar server-ID .
865 .It Ar Rpt-ok
866 if present overrides
867 .Fl Q
868 by saying that this client is trusted
869 to report only checksums for unsolicited bulk mail.
870 .It Ar delay=ms Ns Op Ar *inflate
871 delays answers to systems using the client
872 .Ar id .
873 The
874 .Ar delay
875 in milliseconds is multiplied by 1 plus the number of recent requests from
876 an IP address using
877 .Ar id
878 divided by the
879 .Ar inflate
880 value.
881 See
882 .Fl u .
883 .It Ar passwd1
884 is the password currently used by clients with identifier
885 .Ar id .
886 It is a 1 to 32 character string that does not contain
887 blank, tab, newline or carriage return characters.
888 .It Ar passwd2
889 is the optional next password that those clients will use.
890 A DCC server accepts either password if both are present in the file.
891 .El
892 Both passwords can be absent if the entry not used except to tell
893 .Nm
894 that server-IDs in the flooded reports are valid.
895 The string
896 .Em unknown
897 is equivalent to the null string.
898 .It Pa whitelist
899 contains the DCC server whitelist.
900 It is not used directly but is loaded into the database when
901 .Xr dbclean 8
902 is run.
903 .It Pa grey_whitelist
904 contains the greylist server whitelist.
905 It is not used directly but is loaded into the database when
906 .Xr dbclean 8
907 is run with
908 .Fl G .
909 .It Pa blacklist
910 if present, contains a list of IP addresses and blocks of IP addresses
911 DCC clients that are ignored.
912 Each line in the file should be blank, a comment starting with '#',
913 or an IP address or block of IP addresses in the form
914 .Bd -ragged -compact -offset indent
915 .Op Ar trace,
916 .Op Ar ok,
917 .Op Ar bad
918 .No xxx.xxx.xxx.xxx Ns Op /yy
919 .Ed
920 Changes to the file are automatically noticed and acted upon within
921 a few minutes.
922 Addresses or blocks of addresses can be preceded with
923 .Em ok
924 to "punch holes"
925 in blacklisted blocks or with
926 .Em trace
927 to log activity.
928 This mechanism is intended for no more than a few dozen blocks of addresses.
929 .It Pa dccd_clients
930 contains client IP addresses and activity counts.
931 .It Pa grey_clients
932 contains greylist client IP addresses and activity counts.
933 .El
934 .Sh EXAMPLES
935 .Nm
936 is usually started with other system daemons with something like the
937 script
938 .Pa @libexecdir@/rcDCC .
939 That scripts uses values in @prefix@/dcc_conf to start the server.
940 With the argument
941 .Em stop ,
942 .Pa @libexecdir@/rcDCC
943 can be used to stop the daemon.
944 .Pp
945 The database grows too large unless old reports are removed.
946 .Xr dbclean 8
947 should be run daily with the @libexecdir@/cron-dccd cron script
948 .Sh SEE ALSO
949 .Xr cdcc 8 ,
950 .Xr dcc 8 ,
951 .Xr dbclean 8 ,
952 .Xr dblist 8 ,
953 .Xr dccifd 8 ,
954 .Xr dccm 8 ,
955 .Xr dccproc 8 .
956 .Xr dccsight 8 ,
957 .Sh HISTORY
958 .Nm
959 is based on an idea from Paul Vixie.
960 It was designed and written at Rhyolite Software, starting in 2000.
961 This document describes version 1.3.103.