13 .TH noip 1 "5 May 2005" "Straylight/Edgeware" "Preload hacks"
15 noip \- run programs without the ability to use IP sockets
25 (by default, the user's shell, as determined by the
27 environment variable) in an environment where attempts to use TCP/IP
28 networking are (mostly) transparently translated into the use of
29 Unix-domain sockets in a private directory.
31 There are many programs which use TCP/IP for their own internal
32 communications needs, largely unnecessarily. This can present security
33 problems: even if a program binds its listening sockets to
35 other users on the same system can still connect, and many such programs
36 don't seem to have authentication systems.
39 addresses this problem by intercepting a program's networking calls and
40 making it use Unix-domain sockets in a private directory instead of
41 TCP/IP. Now its communications are truly private to the running user.
42 .SS The socket directory
45 program keeps its sockets in a directory whose name can be configured,
55 environment variables, or is
58 in the temporary directory, which in turn is determined by the
62 environment variables, or is
64 The sockets in this directory are simply named
66 after the Internet sockets they represent.
68 If the socket directory does not exist when a program running under
70 starts up, it is created and made readable and writable only by the
71 current user. Also, it is scanned and any apparently stale sockets are
76 is controlled by a configuration file. By default,
78 reads configuration from
80 in the calling user's home directory, as determined by the
82 environment, or, failing that, looking up the
84 (not effective) user id in the password database.
86 The configuration file has a simple line-based format. A line is
87 ignored if it consists only of whitespace, or if its first whitespace
90 Otherwise, the first whitespace-delimited word is a keyword and the
91 remainder of the line is a value. The following keywords are
94 .BR "debug " [\fInumber\fR]
97 is nonzero, turn debugging on; if it is zero, turn debugging off. The
100 is given, is to turn debugging on. Debugging is written to standard
101 error. Some debugging is produced before the configuration file is
102 read; the environment variable
104 can be used to control this.
106 .BI "socketdir " directory
107 Store the Unix-domain sockets in
109 rather than the default.
111 .BI "realbind " acl-entry
114 access control list (ACL). When a program attempts to
116 a socket to an address, the
118 ACL is consulted. If the address is matched, then the program is
119 allowed to bind a real Internet socket to that address; otherwise, the
120 socket is bound to a Unix-domain socket.
122 .BI "realbind " acl-entry
125 access control list (ACL). When a program attempts to
127 a socket to an address, or to contact another socket using
133 ACL is consulted. If the destination address is matched, then the
134 program is allowed to contact the real Internet socket; otherwise, the
135 attempt is made to contact a Unix-domain socket.
137 (Aside: An attempt to connect to a remote host may not be a hopeless failure,
138 even if a real IP socket is denied:
140 deliberately makes no attempt to check that addresses being bound to
141 sockets correspond to locally available addresses; and besides, sockets
142 can be introduced into the directory by other programs simulating remote
161 (The spaces in the above are optional.)
163 The leading sign says whether
164 matching addresses should be
171 The IP-address portion may be any of the following
174 Matches all addresses.
177 Matches the address of one of the machine's network interfaces.
180 Matches just the given address
182 .IB address \- address
183 Matches any address which falls in the given range. Addresses are
184 compared lexicographically, with octets to the left given precedence
185 over octets to the right.
188 Matches an address in the given network. The
190 may be a netmask in dotted-quad form, or a one-bit-count.
192 The port portion may be omitted (which means `match any port'), or may
199 Range comparisons are always inclusive of both endpoints.
201 ACL entries are processed in the order they appear in the configuration
202 file. The default action of an ACL, used if none of its entries match,
203 is the opposite of the last actual entry in the list: if the last entry
204 says `accept', then the default is to deny, and vice-versa. If the ACL
205 is empty, the default is to deny all addresses.
207 For example, it may be useful to allow access at least to a DNS server.
208 This can be accomplished by adding a line
210 realconnect +1.2.3.4:52
212 to the configuration file, where 1.2.3.4 is the IP address of one of
214 .SS Example applications
215 SLIME is an Emacs extension for doing interactive programming with Lisp
216 systems. It communicates with the Lisp system using TCP sockets, since
217 Unix-domain sockets are unavailable on Windows, and besides, they are
218 less well supported by Lisp implementations. Unfortunately, when the
219 author wrote this program, SLIME applied no authentication on its TCP
220 port, allowing any local user to take over the running Lisp. Worse,
221 some Lisps are unable to bind a listening socket to a particular
222 address, leaving the socket potentially available to anyone on the
223 network. By running Emacs under
225 the security hole is closed completely and no messing with
226 authentication secrets is needed.
228 SSH is an excellent tool for secure communications over hostile
229 networks. In particular, its ability to forward TCP connections to a
230 port on one side of an SSH tunnel to the other side is very useful.
231 However, such a forwarded port is available to all users on the source
232 side of the tunnel. Using
234 and a suitable configuration, a user can restrict access to a forwarded
235 port to himself or a small group.
240 hack. It won't work on setuid programs. Also, perhaps more
241 importantly, it can't do anything a
243 program use of networking: a program could theoretically issue sockets
244 system calls directly instead of using the C library calls that
246 intercepts. It is intended only as a tool for enhancing the security of
247 software written by well-meaning programmers who don't understand the
248 security aspects of writing networking code.
250 It's very hard to tell exactly what state a Unix-domain socket is in.
251 If the filesystem object isn't there, it's not active, but if it
253 then the socket might be in use or it might be stale.
257 to decide whether a socket is in use, but this can fail in two ways.
258 Firstly, if the socket is created and renamed, the kernel doesn't
261 will think that the new name is stale. Secondly, if the socket is
262 created, used, unlinked while it's still in use, and recreated, then
264 will think that it's in use when in fact it's gone stale. Don't mess
267 sockets unless you know what you're doing.
269 The procedure to replace a Unix-domain socket by an Internet one is
270 fairly thorough, but there are some missing cases. In particular, if
271 the socket being bound or connected is a duplicate (using
273 then only one of the copies will be fixed. Similarly, copies owned by
274 child processes will be unaffected.
276 This manual is surprisingly long and complicated for such a simple hack.
278 Mark Wooding, <mdw@nsict.org>