|
|
Fast algorithm to compare an IP address against a list of IP sections?
|
|
|
|
SYSTEM.ROOTDAEMONRC(1) General Commands Manual SYSTEM.ROOTDAEMONRC(1) NAME
system.rootdaemonrc, .rootdaemonrc - access control directives for ROOT daemons LOCATIONS
ROOTDAEMORC, $HOME/.rootdaemonrc /etc/root/system.rootdaemonrc, $ROOTSYS/etc/system.rootdaemonrc DESCRIPTION
This manual page documents the format of directives specifying access control directives for ROOT daemons. These directives are read from a text file whose full path is taken from the environment variable ROOTDAEMONRC. If such a variable in undefined, the daemon looks for a file named .rootdaemonrc in the $HOME directory of the user starting the daemon; if this file does not exists either, the file system.root- daemonrc, located under /etc/root or $ROOTSYS/etc, is used. If none of these file exists (or is readable), the daemon makes use of a default built-in directive derived from the configuration options of the installation. FORMAT
* lines starting with '#' are comment lines. * hosts can specified either with their name (e.g. pcepsft43), their FQDN (e.g. pcepsft43.cern.ch) or their IP address (e.g. 137.138.99.73). * host names can be followed by :rootd, :proofd or :sockd to define directives applying only to the given service; 'sockd' applies to servers run from interactive sessions (TServerSocket class) * directives applying to all host can be specified either by 'default' or '*' * the '*' character can be used in any field of the name to indicate a set of machines or domains, e.g. pcepsft*.cern.ch applies to all 'pcepsft' machines in the domain 'cern.ch'. (to indicate all 'lxplus' machines you should use 'lxplus*.cern.ch' because inter- nally the generic lxplus machine has a real name of the form lxplusnnn.cern.ch; you can also use 'lxplus' if you don't care about domain name checking). * a whole domain can be indicated by its name, e.g. 'cern.ch', 'cnaf.infn.it' or '.ch' * truncated IP address can also be used to indicate a set of machines; they are interpreted as the very first or very last part of the address; for example, to select 137.138.99.73, any of these is valid: '137.138.99', '137.138', '137`, '99.73'; or with wild cards: '137.13*' or '*.99.73`; however, '138.99' is invalid because ambiguous. * the information following the name or IP address indicates, in order of preference, the short names or the internal codes of authen- tication methods accepted for requests coming from the specified host(s); the ones implemented so far are: Method nickname code UsrPwd usrpwd 0 SRP srp 1 Kerberos krb5 2 Globus globus 3 SSH ssh 4 UidGid uidgid 5 (insecure) (The insecure method is intended to speed up access within a cluster protected by other means from outside attacks; should not be used for inter-cluster or inter-domain authentication). Methods non specified explicitly are not accepted. For the insecure method it is possible to give access only to a specific list of users by specifying the usernames after the method separated by colons (:) example: uidgid:user1:user2:user3 will allow uidgid access only to users user1, user2 and user3. This is useful to give easy access to data servers. It is also possi- ble to deny access to a user by using a '-' in front of the name: uidgid:-user4 * Lines ending with '' are followed by additional information for the host on the next line; the name of the host should not be repeated. EXAMPLES
Valid examples: default none All requests are denied unless specified by dedicated directives. default 0 ssh Authentication mechanisms allowed by default are 'usrpwd' (code 0) and 'ssh' 137.138. 0 4 Authentication mechanisms allowed from host in the domain 137.138. (cern.ch) are 'usrpwd' (code 0) and 'ssh' pceple19.cern.ch 4 1 3 2 5 0 All mechanisms are accepted for requests coming from host pceple19.cern.ch . lxplus*.cern.ch 4 1 globus 0:qwerty:uytre Requests from the lxplus cluster can authenticate using 'ssh', 'srp' and 'globus'; users 'qwerty' and 'uytre' can also use 'usrpwd' . pcep*.cern.ch:rootd 0:-qwerty 4 Requests from the pcep*.cern.ch nodes can authenticate using 'usrpwd' and 'ssh' when accessing the 'rootd' daemon ; user 'qwerty' can only use 'ssh'. SEE ALSO
rootd(1), proofd(1) For more information on the ROOT system, please refer to http://root.cern.ch/ . ORIGINAL AUTHORS
The ROOT team (see web page above): Rene Brun and Fons Rademakers COPYRIGHT
This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as pub- lished by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MER- CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foun- dation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA AUTHOR
This manual page was written by G. Ganis <g.ganis@cern.ch> . ROOT
Version 4 SYSTEM.ROOTDAEMONRC(1)
