saned(8)

💖 saned(8) — SANE Scanner Access Now Easy 💖

okay bestie, gather round, because we're talking about saned — the SANE network daemon. yes it's a whole manual page, yes it's from saned(8), and yes we're gonna make it cute AND correct. no cap. 🫶

---

✨ NAME ✨

saned — the SANE network daemon. that's it, that's the name, and it's iconic. 👑

---

✨ SYNOPSIS ✨

saned [ -a [ username ] ] [ -u username ] [ -b address ] [ -p port ] [ -l ] [ -D ] [ -o ] [ -d n ] [ -e ] [ -h ] [ -B buffer-size ]

look at all those little flags, living their best lives. 🎀

---

✨ DESCRIPTION ✨

so saned is the SANE (that's Scanner Access Now Easy, and yes the acronym spells SANE, we love an acronym that ate) daemon. what does it do? it lets remote clients reach the image acquisition devices that are chillin' on the local host. that's the whole vibe. scanner go brrr but over the network. 💅

---

✨ OPTIONS ✨

saned recognises the following options, and bestie we are listing ALL of them:

• -a [username], --alone[=username] — this one is literally just -l -D -u username bundled together like a lil combo meal 🍓. BUT the username is optional here — the running user only gets set when you actually specify one. lowkey efficient.
• -u username, --user=username — asks saned to drop root privileges and run as the user (and group, don't forget the group) associated with username, and it does this after binding. after. binding. important order, bestie.
• -b address, --bind=address — tells saned to bind to the address you give it. that's it. that's the flag.
• -p port, --port=port — tells saned to listen on the port you give it. a value of 0 tells it to just pick an unused port for you (chaotic but generous ✨). the default is the sane-port, aka 6566.
• -l, --listen — asks saned to run in standalone daemon mode. in this mode it listens for incoming client connections all by itself, and inetd(8) is not required for saned operations in this mode. independent queen energy. 👑
• -D, --daemonize — requests that saned detach from the console and run in the background. bye console, it's giving mysterious. 🦋
• -n, --allow-network — lets saned use network scanners. by default this is forbidden, and the reason is so cute: it's to prevent saned from contacting itself 😭. when you enable it, the configuration of the sane-net(5) backend should not mention the address on which saned is listening.
• -o, --once — requests that saned exits after the first client disconnects. useful for debugging, aka the "one and done" setting 💀.
• -d n, --debug=n — sets the level of saned debug output to n. when compiled with debugging enabled, this flag may be followed by a number to request more or less debug info. the larger the number, the more verbose the debug output. e.g., -d128 will request output of all debug info. a level of 0 produces no output at all. the default value is 2. she's chatty by default, we respect it.
• -e, --stderr — diverts saned debug output to stderr instead of the syslog default. your logs, your choice. ✨
• -B, --buffer-size=buffer-size — specifies the size of the read buffer used for communication with the backend, in KB. default value is 1MB.
• -h, --help — displays a short help message. we love a helpful queen 🫶.

---

✨ CONFIGURATION ✨

the saned.conf configuration file contains both the options for the daemon and the access list. two jobs, one file, main character energy fr fr.

• data_portrange = min_port - max_port — specify the port range to use for the data connection. pick a port range between 1024 and 65535. don't pick a too large port range, because it may have performance issues. use this option if your saned server is sitting behind a firewall. if that firewall is a Linux machine, we strongly recommend using the Netfilter nf_conntrack_sane module instead.
• data_connect_timeout = timeout — specify the time in milliseconds that saned will wait for a data connection. without this option, if the data connection is not done before the scanner reaches the end of scan, the scanner will continue to scan past the end and may damage it depending on the backend 😭. specify zero to have the old behavior. the default is 4000ms.

🌸 the access list 🌸

the access list is a list of host names, IP addresses or IP subnets (CIDR notation) that are permitted to use local SANE devices.

• IPv6 addresses must be enclosed in brackets, and should always be specified in their compressed form.
• connections from localhost are always permitted. bestie privileges. 🫶
• empty lines and lines starting with a hash mark (#) are ignored.
• a line containing the single character + is interpreted to match any hostname. this allows any remote machine to use your scanner and may present a security risk, so this shouldn't be used unless you know what you're doing. 👀

a sample configuration file is shown below:

# Daemon options
data_portrange = 10000 - 10100
# Access list
scan-client.somedomain.firm
# this is a comment
192.168.0.1
192.168.2.12/29
[::1]
[2001:db8:185e::42:12]/64

the case of the host names does not matter, so AHost.COM is considered identical to ahost.com. slay, case-insensitive. 💅

---

✨ FILES ✨

• /etc/hosts.equiv — the hosts listed in this file are permitted to access all local SANE devices. caveat: this file imposes serious security risks and its use is not recommended. like, at all. 🙈
• /etc/sane.d/saned.conf — contains a list of hosts permitted to access local SANE devices (see also the description of SANE_CONFIG_DIR below).
• /etc/sane.d/saned.users — if this file contains lines of the form

user:password:backend

access to the listed backends is restricted. a backend may be listed multiple times for different user/password combinations. the server uses MD5 hashing if supported by the client. 🔐

---

✨ ENVIRONMENT ✨

• SANE_CONFIG_DIR — this environment variable specifies the list of directories that may contain the configuration file. on *NIX systems, the directories are separated by a colon (:); under OS/2, they are separated by a semi-colon (;). if this variable is not set, the configuration file is searched in two default directories: first, the current working directory (".") and then in /etc/sane.d. if the value of the environment variable ends with the directory separator character, then the default directories are searched after the explicitly specified directories. for example, setting SANE_CONFIG_DIR to "/tmp/config:" would result in directories tmp/config, ., and /etc/sane.d being searched (in this order). look at her go, searching in order like a well-behaved icon. 🌈

---

✨ NOTES ✨

saned does not provide confidentiality when communicating with clients. if saned is exposed directly on the network, other users may be able to intercept scanned images, or learn passwords for connecting to saned, with little effort. client systems should connect to saned through a secure tunnel to the server instead. seriously bestie, tunnel up. 🔐

saned is not a trusted program and should not run with root privileges. periodt.

refer to /usr/share/doc/sane-backends/saned/saned.install.md for details on configuring saned as a service. 📄

---

✨ SEE ALSO ✨

sane(7), scanimage(1), xscanimage(1), xcam(1), sane-dll(5), sane-net(5), sane-"backendname"(5), inetd(8), xinetd(8), systemd(1)

http://www.penguin-breeder.org/?page=sane-net

go read those too, they're all part of the friend group. 🦋

---

✨ AUTHOR ✨

David Mosberger — the author, the legend, the moment. 👑

---

and that's the whole page bestie!! 💖 written by David Mosberger, dated 29 Sep 2017, and it lives in the saned(8) section of the manual, under SANE Scanner Access Now Easy. go configure your scanner, use a secure tunnel, and never run it as root. mwah 💅✨