SOCKD(8)

NAME
sockd - Internet firewall secure socket server (proxy server)

SYNOPSIS
sockd [ -ver | -i | -I ]

DESCRIPTION
sockd is an internet secure socket server, often referred to as a proxy server. It was designed primarily to provide hosts within a firewall access to resources outside of the firewall. Normally, hosts inside a firewall has no IP-accessibility to the network outside of the firewall. This reduces the risk of being intruded by unauthorized people from the Internet. Unfortunately, without IP-accessibility users on the inside hosts can no longer use many of the important tools such as telnet, ftp, xgopher, Mosaic, etc. to access the tremendous resources available in the Internet. With sockd installed on a server host, users on the other inside hosts can gain back the lost functionalities by using clients programs designed to work with sockd proxy server, e.g, rtelnet in place of telnet, rftp in place of ftp, rfinger in place of finger, etc. Since these client programs work like their normal counterparts without requiring direct IP-accessibility to the Internet, convenience to the uesrs is accomplished without breaching the security. The server host that runs sockd does have to be open to the Internet, and it therefore requires special attention to make sure that it is secure. sockd is usually installed in directory /usr/etc and should be run under the control of inetd. To do so, add the line
socks	1080/tcp
to file /etc/services, and the line
socks	stream	tcp	nowait	nobody	/usr/etc/sockd	sockd
to file /etc/inetd.conf. Then send a SIGHUP signal to the running inetd process to make it read and use the new contents of the files. You may also choose to use identd (RFC 1413) to verify the user's identity by appending option -i or -I to the line in /etc/inetd.conf. A configuration file /etc/sockd.conf is used to control access to sockd and its services. Permission and denial of a service request can be decided based on various combinations of the requesting host, the destination host, the type of service (destination port number), as well as the requesting user. (See sockd.conf(5).) If the server host is multi-homed, i.e., having more than one network interface and with its IP_FORWARDING turtned off, it must run a multi-homed version of sockd, which requires another control file /etc/sockd.route to decide which interface to use for connection to any given destination host. See sockd.route(5). A program called test_sockd_conf is provided for you to check your sockd configuration file(s). Be sure to use it everytime after you modify the configuration file(s). sockd uses syslog with facility daemon and level notice to log its activities and errors. Typical lines look like
Apr 11 08:51:29 eon sockd[636]: connected -- Connect from don(don)@abc.edu to wxy.com (telnet)
Apr 11 09:24:59 eon sockd[636]: terminated -- Connect from don(don)@abc.edu to wxy.com (telnet)
Apr 11 09:24:59 eon sockd[636]: 1048 bytes from abc.edu, 285143 bytes from wxy.com
Jun 22 18:24:54 eon sockd[884]: refused -- Connect from sam(unknown)@big.com to small.com (ftp)
In these lines, the first user-id is the one reported by the client program, the second one (within the parentheses) is what is reported by identd on the client host. These log lines usually appear in file /var/adm/messages though that can be changed by modifying /etc/syslog.conf. (See syslogd(8) and syslog.conf(5).) If you allow access to infosystems such as Gopher or WWW, you should be aware that they by nature would tend to get connections to hosts all over the world and would use not only Gopher and WWW ports but possibly also ports for finger, telnet, ftp, nntp, etc. as well as non-priveleged ports ( > 1023).

OPTIONS
The options are mutually exclusive and thus may only be used one at a time.

With this option, sockd prints its own version number,
    whether it is a single-homed or multi-homed version, and whether it supports clients that use Rrcmd(), and then quits.

Use identd (RFC 1413) to verify the requester's user-id. Deny access if
    connection to client's identd fails or if the result does not match the user-id reported by the client program. Client hosts without a properly installed identd daemon will not be served. User verification is done before and in addition to the normal access control.

Similar to -I but more lenient. Access is denied only if client's
    identd reports a user-id that's different from what the client program claims.

Log entries similar to the following are produced upon failure of user-id verification:
Apr 15 14:42:51 eon sockd[729]: cannot connect to identd on big.edu
Apr 15 14:42:51 eon sockd[729]: refused -- Connect from bob(unknown)@big.edu to xyz.com (ftp)
Jul 15 12:23:06 eon sockd[832]: *Alert*: real user is sam, not jim
Jul 15 12:23:06 eon sockd[832]: refused -- Connect from jim(sam)@abc.org to bad.place.com (WWW)

FILES
/etc/sockd.conf, /etc/inetd.conf, /etc/services, /var/adm/messages, /etc/syslog.conf

SEE ALSO
socks_clients(1), test_sockd_conf(8), sockd.conf(5), sockd.route(5), socks.conf(5)

AUTHOR
David Koblas, koblas@sgi.com
Ying-Da Lee, ylee@syl.dl.nec.com