Questo contenuto non è disponibile nella lingua selezionata.
48.5.2.2.4. Expansions
Expansions, when used in conjunction with the
spawn
and twist
directives, provide information about the client, server, and processes involved.
The following is a list of supported expansions:
%a
— Returns the client's IP address.%A
— Returns the server's IP address.%c
— Returns a variety of client information, such as the username and hostname, or the username and IP address.%d
— Returns the daemon process name.%h
— Returns the client's hostname (or IP address, if the hostname is unavailable).%H
— Returns the server's hostname (or IP address, if the hostname is unavailable).%n
— Returns the client's hostname. If unavailable,unknown
is printed. If the client's hostname and host address do not match,paranoid
is printed.%N
— Returns the server's hostname. If unavailable,unknown
is printed. If the server's hostname and host address do not match,paranoid
is printed.%p
— Returns the daemon's process ID.%s
—Returns various types of server information, such as the daemon process and the host or IP address of the server.%u
— Returns the client's username. If unavailable,unknown
is printed.
The following sample rule uses an expansion in conjunction with the
spawn
command to identify the client host in a customized log file.
When connections to the SSH daemon (
sshd
) are attempted from a host in the example.com
domain, execute the echo
command to log the attempt, including the client hostname (by using the %h
expansion), to a special file:
sshd : .example.com \ : spawn /bin/echo `/bin/date` access denied to %h>>/var/log/sshd.log \ : deny
Similarly, expansions can be used to personalize messages back to the client. In the following example, clients attempting to access FTP services from the
example.com
domain are informed that they have been banned from the server:
vsftpd : .example.com \ : twist /bin/echo "421 %h has been banned from this server!"
For a full explanation of available expansions, as well as additional access control options, refer to section 5 of the man pages for
hosts_access
(man 5 hosts_access
) and the man page for hosts_options
.
Refer to Section 48.5.5, “Additional Resources” for more information about TCP Wrappers.