socks5cop(8)

NAME
socks5cop - A program to raise alarm when socks5's proxy activities meet user-specified conditions

SYNOPSIS
socks5cop [ -fhlt ] [ -i inputfile ] [ -d datafile ] [ -r refr-time ]

DESCRIPTION
Socks5cop is designed to equip the Socks5 server with an alarm hook. When Socks5, Socks5watcher and Socks5cop are deployed, data about connections, known to the Socks5 server processes, are passed to Socks5watcher which in turn delivers them to Socks5cop. Socks5cop maintains some important aggregates such as numbers of failed attempts, accesses and transferred bytes in a database. When a condition specified by the user is met, its associated action is triggered by executing it as a shell command. The input file contains only two language constructs: assignment statement and alarm specification. See socks5cop.conf(5) for their syntax. The program automatically refreshes the database after a certain time in which it sits idle. That is, it removes all obsolete records. The user can turn off the automatic refresh by using the option -r 0 and have his own refresh schedule by sending the VTALRM signal to the Socks5cop process at desired times. The command
        kill -VTALRM process-number sends the VTALRM signal to refresh the database. To let Socks5cop properly close the database, a QUIT signal has to be sent to the Socks5cop process to end the execution. The following command can be used for this purpose:
        kill -QUIT process-number The triggered actions and error messages such as syntax error and database failure are recorded in the system log by default. The triggered actions are not logged if the -l option is specified. If the -f option (foreground) is specified, the messages are not logged, instead, they are sent to stderr (terminal).

OPTIONS

-f  runs the program on foreground.

-h  gives the SYNOPSIS of the program.

-l  logs no actions in syslog.

-t  traces condition checking in "/tmp/socks5cop.log" when -f is not specified; to stderr (terminal) if -f is specified.

-i inputfile
    specifies the alarm specification file (by default: "./socks5cop.conf").

-d datafile
    specifies the database file prefix (by default: "./datafile").

-r refr-time
    specifies the time (in minutes) that Socks5cop waits idle before it refreshes the database (by default: 60, i.e., 1hr.).

EXAMPLES
socks5cop -ft
runs the program on foreground and traces the operation on the screen. socks5cop -i /etc/socks5cop.conf -l
runs the program with "/etc/socks5cop.conf" as its configuration file and without syslogging actions.

SEE ALSO
socks5(1), socks5.conf(5), socks5cop.conf(5), socks5watcher(8).

LIMITATIONS
Only TCP and UDP are considered for this version. When an action is executed, Socks5cop will wait until the execution finishes. It is users' responsibility to make sure that the actions can be correctly executed and do not hang.

AUTHOR
Jianyu You (jyou@syl.dl.nec.com)