BS.ACL.CONF(5)

NAME
bs.acl.conf - Brimstone access control list configuration file

SYNOPSIS
/etc/bs.acl.conf

DESCRIPTION
The file is used to control what access users have through various Brimstone proxies. In local mode, proxies query this file directly, while in remote mode, proxies query sosauthd through the network, and sosauthd queries this file.

The config file is parsed by a standard LR parser generated by Bison (Yacc). The full grammer is too long and boring to bo into in detail--even for a manual page--but the basics will be outlined below.

SYNTAX
The configuration file is divided into seven sections, delimited by one line containing only the "%%" character sequence. The comment character is a hash mark "#". All characters following the hash are ignored, until the end of the line. Additionally, you may include other files with the sequence: '%include "filename"'

Of the seven sections, sections two through six share a common format. Section one contains hints to speed certain activities up, and section seven, which defines the users, has a unique format.

The common format mentioned for sections two through six (time through groups) goes something like this:
SYMBOL = spec[,spec]...
spec = <+||-><typespec>
typespec = atom | meta
atom = ( [[LOCAL]] )
meta = *SYMBOL
SYMBOL = [A-Za-z][A-Za-z0-9_]*
Where [[LOCAL]] is different for each section. In the spec line, if the first character is a minus sign and the condition matches, the rule fales. Negative matches do NOT cancel. If you ever match a negative rule, the rule will immediately fail (and access will be denied) no matter what. Metas, above, act like pointers in C or more generally, indirection or inclusion. If you add a meta, then the rule which is defined by that symbol is then parsed.

In addition, order is significant. No metas are allow unless they have been previously defined (which prevents loops and dangling references). Rules parse from left to right.

Finally, the namespace for each section is separate; meaning that STD in the date section is totally distinct from STD in the services section.

Sections 2-5 (time through services) also support a magic rule known as ANY which automatically matches. You may of course manually construct a rule NONE which automatically fails ( NONE = -*ANY ) but this is typically not needed since any test which does not match any rules automatically fails.

Memory Management Hints
    The first section, which may be empty, defines hints to the memory management routines. For normal sized rule sets (e.g. less that 1K lines per section) this can be ignored. For large configuration files, however, you may be able to speed processing up by telling how many lines is in a given section is with a line matching the regexp
    %foosize +
    where foosize can be replaced with timesize, datesize, addrsize, servsize, groupsize and usersize for the various rules sections.

Time of day/day of week definitions
    The second section defines the rules which restrict user access based on time of day and day of the week. The local part, as defined above, is:
    [[LOCAL]] = days / hours
    days = <DOW>|<DOW-DOW> [,days...]
    hours = <HOUR>|HOUR-HOUR> [,hours...]
    DOW = Sun|Mon|Tue}Wed|Thu|Fri|Sat
    HOUR = [0-23]

Date Definitions
    This third section defines special dates. They may be used to restrict access on company holidays, or during personal holidays. The local part is:
    [[LOCAL]] = MON/DAY/YEAR
    MON = 1-12
    DAY = 1-31
    YEAR = 199X-2XXX

Address Definitions
    The fourth section defines address ranges, to restrict where people can come from or connect to. The local part is:
    [[LOCAL]] = IP/MASK
    IP = [0-255].[0-255].[0-255].[0-255]
    MASK = [0-255].[0-255].[0-255].[0-255]
    Where IP is of course the IP address or network address. MASK is the mask which is applied against the test address and the IP address to see if they match.

Service Definitions
    The fifth section defines known ports, or services. The local part is:
    [[LOCAL] = port
    port = [0-65535] | [service]
    service = service name from /etc/services
    If you choose to use symbolic service names, it is important to only use standard services since the services file on the firewall may not be identical to the version on your local machine. Also, be prepared to quote the service name with double quotes if it has non-alphanumeric characters in it.

Group Definitions
    In the sixth section, you wil find the list of known groups. Groups are used to accumulate the various rules in Sections two through five above into one simple symbol name for use in the user lists. The local part is:
    [[LOCAL]] = meta-time, meta-date,
                meta-from-address, meta-from-service,
                meta-to-address, meta-to-service
    Where each meta is a symbol defined in the appropriate section above.

User List
    Finally, the seventh section contains the list of all users known to the firewall. The format for this section is different from all previoius sections, and is defined as:
    USER = ena:auth:aux:meta-group:create:modifications:expirations:
           contact:responsible:GCOS:comment
    USER = [A-Za-z][A-Za-z0-9_]*

    ena Enabled bit (o or 1)

    auth
        Authentication algorithm. Current valid entries include NULL, PASS, SKEY, ENIG, SID, CCARD, SHASH, and DHASH.

    aux Auxiliary authentication information (not used by all algorithms).

    meta-group
        Symbol defined in the above Group section

    create
        Date of user creation, in units of days since the epoch. This is for administrivia purposes and is not used by Brimstone.

    modification
        Date of last modification, in units of days since the epoch. This is for administrivia purposes and is not used by Brimstone.

    expiration
        Date of user expiration, in units of days since the epoch. When this date is passed, the user will no longer be able to log in.

    contact
        How to contact the user, usually email address. This is for administrivia purposes and is not used by Brimstone.

    responsible
        Person to contact about the user. This is for administrivia purposes and is not used by Brimstone.

    GCOS
        Full name. This is for administrivia purposes and is not used by Brimstone.

    Comment
        Comments about the user. This is for administrivia purposes and is not used by Brimstone.

    For aux, contct, responsible, GCOS, and comment, if the data does not matche the regexp /[a-zA-Z][0-9a-zA-Z_]+/ then you must quote the field with double quote marks. You may not include the double quote mark at any time in the data.

EXAMPLE
######################################################################
##
##			    Brimstone ACL
##
########################################
# 1: memory management hints
%datesize 512
%%
########################################
# 2: Time, day of week
#
# STD and DTS define the same times
# in two different methods.
#
FOO = ( Sun,Tue / 10,12 )
Std1 = ( Tue-Fri / 9-17 )
Std2 = ( Mon / 10-17 )
STD = *Std1, *Std2
DTS = (Mon/10-17) , (Tue-Fri/ 9-17)
NONE = -*ANY
%%
########################################
# 3: Date of year
#
NEWYEAR = (1/3/1994),(1/2/1995),(1/1/1996)
MLKD = (1/17/1994),(1/16/1995),(1/15/1996)
PRESDAY = (2/21/1994),(2/20/1995),(2/19/1996)
FOOL = ( 4/1/1994 ) , ( 4/1/1995) , (4/1/1996)
MEMDAY = (5/30/1994),(5/29/1995),(5/27/1996)
JULY4 = (7/4/1994),(7/4/1995),(7/4/1996)
LABDAY = (9/5/1994),(9/4/1995),(9/2/1996)
COLUMBUS = (10/10/1994),(10/9/1995),(10/14/1996)
THANKSGIVING = (11/24/1994),(11/23/1995),(11/28/1996)
XMAS = ( 12/ 25 / 1994 ) , ( 12/25/1995) , (12/25/1996)
HOLIDAYS = *NEWYEAR,*MLKD,*PRESDAY,*FOOL,*MEMDAY,*JULY4,*LABDAY,*COLUMBUS,*THANKSGIVING,*XMAS
STD = -*HOLIDAYS,*ANY
NONE = -*ANY
%%
########################################
# 4: Address
#
CTR = (128.59.64.0,255.255.240.0)
STD = -*CTR, *ANY
ARPA = (10.0.0.0,255.0.0.0)
NONE = -*ANY
%%
########################################
# Include /dev/null into the party
%include "/dev/null"
########################################
# 5: Services
#
TEL = telnet
FTP = ftp
# Note the use of quotes
X11 = "x-server"
# X12 is the same as X11
X12 = 6000
STD = *TEL, *FTP
NONE = -*ANY
%%
########################################
# 6: Groups
#
STD = (*STD,*STD,*ANY,*ANY,*CTR,*STD)
ALL = (*ANY,*ANY,*ANY,*ANY,*ANY,*ANY)
EXTERNAL = (*ANY, *ANY, *CTR, *ANY, *STD, *STD)
%%
########################################
# 7: Users
#
tim = 1:CCARD:"f45eedd94774952a":*NULL:0:0:0:tim@ucbarpa:Steve:Tim Rice:"Wierdo"
pass = 1:PASS:"xxsPnKZKFhRdc":*NULL:0:0:0:x:x:x:x
skey = 1:SKEY:x:*NULL:0:0:0:x:x:x:x

SEE ALSO
checkconfig(8) testauth(8) testconfig(8) btelnet(1) bftp(1) sosauthd(8) bs.rmnt.conf(5)

BUGS
Remote does not have a n in it.

A capabilities field would not be amiss for controling things like language, fork subcommands, and serial connections.