CFINGERD.CONF(1)

NAME
cfingerd.conf - cfingerd configuration documentation

DOCUMENTATION

With the configuration file, there are a number of boolean values that are used. You should be aware of the way that they work, obviously.

The first option that is shown in the boolean variabled settings is how the finger daemon will respond to global fingers (ie. finger queries from systems that are neither REJECTED nor TRUSTED).

The second option that is shown in the boolean variabled settings is how the finger daemon will respond to local fingers (ie. finger queries from systems that are either TRUSTED or from the local host).

Also, the option names and boolean names are NOT case sensitive. NO options are case sensitive. The only case that is checked is your filenames.

OPTIONS
The following is a listing of the options that are setable in the cfingerd.conf file.

PLAN_FILE
    This is the plan file that is displayed when a user is fingered. This file is normally kept in the user's home directory, and it is accessed every time a user is fingered. If the user doesn't have this file in his/her home directory, the plan file will report back with "No plan".

PROJECT_FILE
    This is the name of the project file that is displayed when a user is fingered. This file is also kept in the user's home directory, and it is read when a user is fingerd. If the user doesn't have a file of this type in their home directory, the finger query will report back "No project".

NOFINGER_FILE
    If the user doesn't want to have finger information displayed about them, all they have to do is put the name of this file in their home directory. If they want to show a nice little banner when they are fingered, and this file is present, the Configurable Finger Daemon will display whatever information is in that file. (This gives them a good time to FLOOD the person that fingered the user. :-)

If you are a secure system, I *HIGHLY* recommend that put this file into the root user's home directory. The one MAIN place that hackers will check before hacking into a system is to see if root is logged in.

TOP_DISPLAY_FILE
    This is the name of the file that is displayed at the top of the finger display (normally known as the header.) This file is in any directory (since you specify it at this time) and you must have it WORLD readable.

BOTTOM_DISPLAY_FILE
    This is the name of the file that is displayed at the bottom of the finger display. This file is in any directory that you specify in the configuration file, and it must be WORLD readable.

NO_NAME_BANNER_FILE
    This is the name of the file that is displayed when no user is specified during a finger query (ie. finger @your.site). Since this version of CFINGERD doesn't show who's on the system (as it is being developed as we speak), it shows a banner, or nothing at all.

NO_USER_BANNER_FILE
    This is the name of the file that is displayed when the user sends a finger-query for a user that does not exist.

REJECTED_BANNER_FILE
    This is the name of the file that you want to display when a user does not have permission to send a finger query to your system. This is any directory, and it must be WORLD readable.

TRUSTED_HOSTS
    This is a list constructed of the hosts that you want to allow to finger your system as freely as you want. These systems are treated as local fingering systems, and they will see the same information that local users would see. These also follow the WILDCARD specification, but ONLY IF you have that option enabled (it usually is...)

If you want to include a numerous amount of trusted hosts, you should include a second line (or more) that have this option on the same line. (Sorry, I don't do the backslash thing yet.) For more of an example, see the included configuration file.

REJECTED_HOSTS
    This is a list of the hosts that you DO NOT want to finger your system. Any systems that query your system that are on this list will get the REJECT_BANNER_FILE if you configure finger daemon to display it. :-) These also follow the WILDCARD specification.

FINGER_PROGRAM
    This is the name of the program that you want to spawn for finger when someone does a no-name finger query to your system (ie. requests a listing of who's logged in). It is usually wise to include the full pathname in this field.

SHOW_TOP_FILE
    If you want the header file displayed here, enable this option. This corresponds to your TOP_DISPLAY_FILE. I recommend that you keep the top display file down to a limit of about 5-7 lines for simplicity, but that all depends on how much information you display on the actual finger query.

SHOW_BOTTOM_FILE
    If you want the footer file displayed here, enable this option. This corresponds to your BOTTOM_DISPLAY_FILE.

SHOW_LOGIN_ID
    If you want the user's login name displayed, enable this.

SHOW_REALNAME
    If you want the user's realname displayed, enable this.

SHOW_DIRECTORY
    If you want the user's home directory displayed, enable this. I don't recommend this on a secure system.

SHOW_SHELL
    If you want the user's default shell displayed, enable this. I don't recommend this on a secure system.

SHOW_ROOM_NUMBER
    If you want the user's room number displayed, enable this.

SHOW_WORK_NUMBER
    If you want the user's work number displayed, enable this.

SHOW_HOME_NUMBER
    If you want the user's home number displayed, enable this.

SHOW_OTHER
    If you want the user's other information displayed, enable this.

SHOW_LAST_TIME_ON
    If you want to show the last time the user was logged into your system, enable this.

SHOW_IF_ONLINE
    If you want to show if the user is online, enable this.

SHOW_LAST_TIME_MAIL_READ
    If you want to show the last time this user read mail, enable this.

SHOW_LAST_DAY_MAIL_READ
    If you want to show the last day this user read mail, enable this.

SHOW_LAST_ORIGINATION
    If you want to show where this user last originated from, enable this.

SHOW_PLANFILE
    If you want to show the user's planfile, enable this.

SHOW_PROJECTFILE
    If you want to show the user's project file, enable this.

SHOW_NO_NAME_BANNER
    If you want to show the no-name banner if no name is passed to the daemon, enable this, and disable SHOW_SYSTEM_LIST.

SHOW_REJECTED_BANNER
    If you want to show the REJECTED_BANNER_FILE when your system is fingered from a rejected system, enable this.

SHOW_SYSTEM_LIST
    If you want the system listing to be shown when someone does a no-name user finger to your system, enable this. This also corresponds to the FINGER_PROGRAM setting that you set. Not that if you set this to TRUE, it will ignore the setting in SHOW_NO_NAME_BANNER.

SHOW_NOUSER
    If you want to display the "no_user_banner_file" here, you can enable this. Otherwise, if you select FALSE on this option, it will just show "Sorry, username (user) does not exist on this system."

SINGLE BOOLEAN OPTIONS

These options are like the options above (the double-booleans) but these only have one boolean option.

SHOW_SYSTEM_WILDCARD
    If you want wildcards allowed in the search when a site name fingers your system, enable this setting. (See info on WILDCARDED HOSTS for more info.)

SHOW_NO_IP_MATCH
    If you want to be let the finger daemon give normal finger information to people from IP addresses that could not be resolved, enable this option. (Normally FALSE).

CONFIGURABLE STRINGS

Configurable strings must contain strings that are enclosed in QUOTATION MARKS (ie. ""). The main reason is because you need to be able to put a space in-between strings.

You can usually tell which options are configurable strings because they all end in the suffix "_TEXT".

USERNAME_TEXT
    This string is displayed before the user's login name.

REALNAME_TEXT
    This string is displayed before the user's real name.

DIRECTORY_TEXT
    This string is displayed before the user's home directory is displayed.

SHELL_TEXT
    This string is displayed before the user's default shell.

ROOM_NUMBER_TEXT
    This string is displayed before the user's room number.

WORK_PHONE_NUMBER
    This string is displayed before the user's work (or office) phone number.

HOME_PHONE_NUMBER
    This string is displayed before the user's home phone number.

OTHER_TEXT
    This string is displayed before the user's OTHER information. Usually, only root has this option, but some systems have been known to let users enter information into this field. (Personally, I like "Root of All Evil" here. :-)

SYSLOG TEXT MESSAGES

You can also change the messages that are displayed in the syslogger text. These options are here so you can change the text as you see fit. These text options have exactly the same option format that the Configurable Strings take.

IP_NO_HOSTMATCH
    This is the text that is shown in syslog if a hostname cannot be matched for the incoming IP address.

NICE_FATAL
    If NICE (priority changing) fails, this is the error message that is displayed in the syslog.

STDIN_EMPTY
    If STDIN (Standard IN) contains no data, or a null data socket was opened, this message is displayed in syslog.

TRUSTED_HOST_TEXT
    If a trusted host member queries your system, this text is displayed in the syslog next to the username that they queried.

REJECTED_HOST_TEXT
    If a rejected host member queries your system, this text is displayed in the syslog next to the username that they queried.

ROOT_FINGER_TEXT
    If a user makes a query for root on your system, this text is displayed in place of the username in the syslog.

SERVICE_FINGER_TEXT
    If a user makes a query to find out the services your system provides, this text is shown in place of the username in your syslog.

USERLIST_FINGER_TEXT
    If a user makes a query to your system to find out who is logged in to the system, this text is shown in place of the username in your syslog.

FAKE_USER_TEXT
    If a user makes a query to your system on a fake user (or one that executes a script), this text is shown in place of the username in your syslog, and the username that was queried also appears there.

WHOIS_USER_TEXT
    If a user makes a query to your system to find out "whois" information about a specific user, this text is displayed in the syslog.

USER SERVICES LISTING

The nice thing about the new upgrade of cfingerd is that you can now have a user listing for those users that you want to have displayed. This part of the services display is totally configurable, and you can have it say whatever you want.

SERVICES_HEADER_1 (to) SERVICES_HEADER_5
    This is the header that you want to display at the top of the services display. This string is displayed the same way you would write a normal "printf" string. In essence, if you want a carriage return, you need to use a \n character. Each string MUST have a \n string at the end to do a return.

SERVICES_STRING
    This is the string that is used for displaying the services display. Used here is the "%s" operator to display the string. You should limit this to a certain number of characters depending on what your fake usernames are. Look at the configuration file for more information on examples.

SERVICES_USERPOS
    This is the position in the SERVICES_STRING where you want to display the service username. This is either a 1, 2, or a 3.

SERVICES_SERVPOS
    This is the position in the SERVICES_STRING where you want to display the service name. This is either a 1, 2, or a 3.

SERVICES_SRCHPOS
    This is the position in the SERVICES_STRING where you want to display the boolean "TRUE" or "FALSE" of whether the service has a searchable index. This is either a 1, 2, or a 3.

Services don't have to be used in any particular order, and you can even remove them if you want. If you don't use an index, you don't need to. You can use two string displays in the SERVICES_STRING or even one, and set what you want based on the options above.

FAKE USERS

Fake users are users that do not have an account on your system; they are there to display specific information.

The format for the fake user is:

FAKEUSER=username,"service name",BOOL,/your/user/script/with/paths

This will correspond to a script (or a program) with executable permissions. This must be a script that is executable by the superuser, since it is a superuser-level script (or this means it's run as ROOT.)

When scripts are run, they are run under the "nobody" group and user IDs. This is stressed because it allows for the least security risk. Running any program under the NOBODY user ID makes it so that it doesn't cause problems to your own system. cfingerd takes careful precidence to run all scripts under this ID.

The "service name" field is what the script is known as, or what is displayed when someone finds out what services you have on your system, and the BOOL field indicates whether the finger query is a searchable index (ie. TRUE or FALSE).

If you want to add more fake users, just include another line with the same format.

WILDCARDED HOSTS

Wildcarded hosts are hosts that contain a string that is searched for when a host queries your system.

For instance, if I had a site named "phil.yee.org" and the domain was "yee.org", I would want all of the domain "yee.org" (including "hap.yee.org" and "mess.yee.org") to be allowed to finger our system. Therefore, I would list "yee.org" in the TRUSTED_HOST listing.

If you wanted to ban all of netcom.com (which is normally what I do on finger requests), I would put "netcom.com" in the REJECTED_HOSTS listing.

Or if you're really crazy, you could put "com", "org", and "net" in these listings and get some funky results. :-)

AUTHOR

Ken Hollis (khollis@bitgate.chatlink.com)

SEE ALSO

cfingerd(1), finger(1), fingerd(1), identd(8)