HOSTS.HFAXD(5)

✨ HOSTS.HFAXD ✨ (that's section 5 of the File Formats Manual, bestie 💖)

okay so welcome to hosts.hfaxd, aka the HylaFAX client access control list. yes it's a guest list. yes it decides who gets in the club. let's go 🎀

🌸 NAME 🌸

hosts.hfaxd — the HylaFAX client access control list, no cap 💅

🦋 DESCRIPTION 🦋

So this ASCII file, etc/hosts.hfaxd, lives in the HylaFAX spooling area, and it's literally the bouncer at the door: it specifies the hosts and users that are permitted to access services through the hfaxd(8) process. This file must exist for client access — like, if it's not there, hfaxd will deny all requests for service. periodt. 🚫

Also, heads up: this file must be readable only by the fax user. Like, it should have mode 600 and be owned by fax. do not play with this one 🙈

Each newline-terminated entry is a set of colon (:) separated fields, and all but the first one are optional. Trailing null fields and their separators may be omitted. The most general form is:

client:uid:passwd:adminwd

So let's break it down:

• client is a regular expression that gets matched against a string user@host. That string is formed from the user string passed to hfaxd with the USER command, plus the official host name or the DARPA Internet address (specified in "dot notation"). If client does not contain an @, then — for backwards compatibility — it's treated as a host for which any user may have access, i.e. it's automatically converted to the regular expression ^.*@client$. cute, right? 🫶

Comments are introduced with the # character and extend to the end of the line. Any whitespace immediately preceding a comment is also ignored. so go ahead and annotate your guest list, we love a well-documented vibe ✨

If client has a leading !, then it's interpreted as a class of hosts and users to which access is to be disallowed. That is, if the pattern matches the client information, then access is denied. it's giving blocklist 💀

Lowkey important: regular expressions are not anchored. That means a regular expression may match a substring of the user@host string. So like, pb@.*\.cl\.cam\.ac\.uk matches cpb@mc.cl.cam.ac.uk.esd.sgi.com. Wild, I know. Use ^ to match the start of the string and $ to match the end. please anchor responsibly 🙏

The fields following client are optional and specify the following:

• uid — the numerical user ID to assign to clients that use the entry for access. hfaxd uses the uid to control access to server resources such as jobs and documents (the value is used to set the group ID of files created by a client).

Multiple clients/users may share the same uid, or unique IDs may be created for each client. User IDs may be any number in the range [0..60002], with 60002 used, by convention, for entries that do not have a uid specified. iconic range honestly 👑

• passwd — the encrypted password. If this field is empty (null) then no password will be demanded when a client logs in; i.e. the USER command does not need to be followed by a PASS command. no password, no problem, walk right in 🚪
• adminwd — the encrypted password for this user to gain administrative privileges. If this field is empty (null) then the user is not permitted to have administrative privileges. main character energy denied 😭

🎀 EXAMPLE 🎀

Here's a sample hosts.hfaxd file. Note that the first entry that matches is taken, so more-specific entries should be placed first. order matters, bestie, we're not just dumping lines in 💅

^pb@[^.]*\.cl\.cam\.ac\.uk$:::hFy8zXq2KaG8s
                               # pb on a machine directly in cl.cam.ac.uk can
                               # administer if an admin pw is given
127.0.0.1              # anyone on local host uses the default uid
^sam@flake.*sgi\.com$  # Sam on his work machine
^sam@oxford.*Berkeley.*# Sam on any machine starting oxford and containing
                               # Berkeley, e.g. sam@oxfordberkeley.cl.cam.ac.uk
^.*@.*.\.esd\.         # anyone in an esd domain
!^tom@                 # Tom Davis is denied access
.*\.sgi\.com$          # but anyone else at sgi is ok

🌈 SEE ALSO 🌈

sendfax(1), hfaxd(8), hylafax-server(5)

and that's the whole page, bestie 🫶 this one's from the January 18, 1996 era, filed under HOSTS.HFAXD(5) in the File Formats Manual — vintage but still slaying 💖✨