Linux FAQ's & Manuals


security note: controlling the access to the cannaserver


it is possible to specify the hosts and users which can access the cannaserver by creating and editing a /etc/hosts.canna file.

if no /etc/hosts.canna file exists, or if it has the length 0, any user from any host can access the cannaserver. but this may be a security risk, therefore you may want to limit access to the cannaserver to certain hosts and users.

on each line in /etc/hosts.canna a hostname can be specified. the hostname may be followed by a colon and a comma separated list of usernames. only the listed users can access the canna server from that host. if only a hostname is specified, all users from that host can access the canna server.

if you have a non-empty /etc/hosts.canna file, please make sure that it also contains the entries localhost and unix. both localhost and unix are necessary to give the host running the canna server access to its own canna server, only one of them is not sufficient!

example contents of /etc/hosts.canna

     localhost     unix     nozomi:mfabian,root      hikari:      kodama 

the cshost command can be used to inspect the list of hostnames and usernames which can access the canna server (the access control list).

attention:

canna is very picky about the syntax of /etc/hosts.canna/ and incorrect descriptions in /etc/hosts.canna can make it impossible to access the cannaserver at all! take care not to add extra spaces, tabs or newlines, they may be already enough to prevent access to your canna server.

for example adding a space character before or behind localhost in the above example of /etc/hosts.canna is already enough to prevent access to your canna server from the local host. as a space character behind localhost is invisible in most editors it is easy to make such a mistake.

so please take special care when editing /etc/hosts.canna.

2005-03-09