HOSTS.HFAXD(5F)

💖 HOSTS.HFAXD — the HylaFAX client access control list (section 5F) 💖

okay bestie, sit down, hydrate, because this file is the bouncer at the club and you absolutely need to know how to talk to it 🫶

✨ NAME ✨

hosts.hfaxd — the HylaFAX client access control list. that's it, that's the whole vibe. it decides who gets in. 💅

🌸 DESCRIPTION 🌸

so the ASCII file etc/hosts.hfaxd lives in the HylaFAX spooling area, and it's the one that says which hosts and users are allowed to access services through the hfaxd(8C) process. this file has to exist for client access — like, if it's not there, hfaxd will deny every single request for service. no file, no entry, no exceptions, periodt. 😭

also!! this file must be readable only by the fax'' user. that means mode `600` and owned by fax''. do not be out here with world-readable permissions, bestie, that's giving security incident. 💀

usually you'd manage etc/hosts.hfaxd through the faxadduser(8C) and faxdeluser(8C) tools, or the SITE ADDUSER'' and SITE DELUSER'' functions through an administrative client. cute, easy, love that for you. ✨ but some features are just not accessible through those tools, and etc/hosts.hfaxd will need direct editing to use them. specifically — the order of entries in etc/hosts.hfaxd may need manipulation, because hfaxd uses the first-matched entry, read top-down. so the sequence is not a vibe, it's load-bearing. 👑

each newline-terminated entry is a set of colon (:) separated fields, and all but the first one are optional. trailing null fields and their separators may be omitted. the most general form is:

client:uid:passwd:adminwd

client is a regular expression to be matched against a string user@host'' that's formed from the user string passed to `hfaxd` with the `USER` command, plus the official host name or the DARPA Internet address, specified in dot notation''. and if client does not contain an @'' then, for backwards compatibility, it's treated as a host for which any user may have access — i.e. it gets automatically converted to the regular expression ^.*@client$''. the more you know 🌈

comments are introduced with the ``#'' character and extend to the end of the line. any whitespace immediately preceding a comment is also ignored. so you can annotate your little heart out. 🎀

if client has a leading ``!'', then it's interpreted as a class of hosts and users to which access is to be disallowed. that is, if the pattern matches the client information, then access is denied. the ! is giving "not you, babe" energy. 🙈

⚠️ note that regular expressions are not anchored. that is, a regular expression may match a substring of the user@host'' string. thus `pb@.*\.cl\.cam\.ac\.uk' matches `cpb@mc.cl.cam.ac.uk.esd.sgi.com'. use ^'' to match the start of the string and ``$'' to match the end. do not skip this part, i'm literally begging. 😭

the fields following client are optional and specify the following:

• uid — the numerical user ID to assign to clients that use the entry for access. hfaxd uses the uid to control access to server resources such as jobs and documents (the value is used to set the group ID of files created by a client). multiple clients/users may share the same uid, or unique IDs may be created for each client. user IDs may be any number in the range [0..60002], with 60002 used, by convention, for entries that do not have a uid specified. slay, a whole number range to play in. 🔥
• passwd — the encrypted password. if this field is empty (null) then no password will be demanded when a client logs in; i.e. the USER command does not need to be followed by a PASS command. open door, walk in. 🚪✨
• adminwd — the encrypted password for this user to gain administrative privileges. if this field is empty (null) then the user is not permitted to have administrative privileges. no admin key, no admin door. 🔐

🌟 EXAMPLE 🌟

here's a sample hosts.hfaxd file, and remember: the first entry that matches is taken, so more-specific entries should be placed first. order = everything. 💅

^pb@[^.]*\.cl\.cam\.ac\.uk$:::hFy8zXq2KaG8s
                       # pb on a machine directly in cl.cam.ac.uk can
                       # administer if an admin pw is given
127.0.0.1              # anyone on local host uses the default uid
192.168.[0-9]+.[0-9]+  # anyone on the LAN uses the default uid
^sam@flake.*sgi\.com$  # Sam on his work machine
^sam@oxford.*Berkeley.*# Sam on any machine starting oxford and containing
                       # Berkeley, e.g. sam@oxfordberkeley.cl.cam.ac.uk
^.*@.*.\.esd\.         # anyone in an esd domain
!^tom@                 # Tom Davis is denied access
.*\.sgi\.com$          # but anyone else at sgi is ok

🦋 SEE ALSO 🦋

faxadduser(8C), faxdeluser(8C), sendfax(8C), hfaxd(8C), hylafax-server(5F)

and that's the whole page, bestie!! this one's from the HylaFAX source, dated January 18, 1996, and it's HOSTS.HFAXD(5F) — go forth and configure responsibly 💜✨