X-Git-Url: http://dxcluster.org/gitweb/gitweb.cgi?a=blobdiff_plain;f=html%2Fadminmanual-7.html;h=b5a65d3eacc3676b7e8ec8ba611ca0611437c6d4;hb=0c1c82537e95268c2ef2b23b4e9ef317a0119b2d;hp=ca0c5c99fc1bece7f8a69192bcdc61a5d7456e0d;hpb=61660841afb3901002602e4956f09de5567bc950;p=spider.git diff --git a/html/adminmanual-7.html b/html/adminmanual-7.html index ca0c5c99..b5a65d3e 100644 --- a/html/adminmanual-7.html +++ b/html/adminmanual-7.html @@ -2,7 +2,7 @@ - The DXSpider Installation and Administration Manual: Filtering (New Style v1.45 and later) + The DXSpider Administration Manual v1.48: Security @@ -13,223 +13,82 @@ Previous Contents
-

7. Filtering (New Style v1.45 and later)

+

7. Security

-

7.1 General filter rules -

- -

Upto v1.44 it was not possible for the user to set their own filters. From -v1.45 though that has all changed. It is now possible to set filters for just -about anything you wish. If you have just updated from an older version of -DXSpider you will need to update your new filters. You do not need to do -anything with your old filters, they will be renamed as you update. -

-

There are 3 basic commands involved in setting and manipulating filters. These -are accept, reject and clear. First we will look -generally at filtering. There are a number of things you can filter in the -DXSpider system. They all use the same general mechanism. -

-

In general terms you can create a 'reject' or an 'accept' filter which can have -up to 10 lines in it. You do this using, for example ... -

-

-
- 
-accept/spots .....
-reject/spots .....
-
-
-

where ..... are the specific commands for that type of filter. There are filters -for spots, wwv, announce, wcy and (for sysops) connects. See each different -accept or reject command reference for more details. -

There is also a command to clear out one or more lines in a filter. They are ... +

From version 1.49 DXSpider has some additional security features. These +are not by any means meant to be exhaustive, however they do afford some +security against piracy. These two new features can be used independently +of each other or in concert to tighten the security.

-

-
-clear/spots 1
-clear/spots all
-
-
-

There is clear/xxxx command for each type of filter. -

-

and you can check that your filters have worked by the command ... -

-

-
-  
-show/filter
-
-
-

-

For now we are going to use spots for the examples, but you can apply the same -principles to all types of filter. -

-

7.2 Types of filter +

7.1 Registration

-

There are two main types of filter, accept or reject. You -can use either to achieve the result you want dependent on your own preference -and which is more simple to do. It is pointless writing 8 lines of reject -filters when 1 accept filter would do the same thing! Each filter has 10 -lines (of any length) which are tried in order. If a line matches then the -action you have specified is taken (ie reject means ignore it and accept -means take it) -

-

If you specify reject filters, then any lines that arrive that match the filter -will be dumped but all else will be accepted. If you use an accept filter, -then ONLY the lines in the filter will be accepted and all else will be dumped. -For example if you have a single line accept filter ... -

-

-
-accept/spots on vhf and (by_zone 14,15,16 or call_zone 14,15,16)
-
-
-

then you will ONLY get VHF spots from or to CQ zones -14, 15 and 16. -

-

If you set a reject filter like this ... -

-

-
-reject/spots on hf/cw
-
-
-

Then you will get everything EXCEPT HF CW spots. You could make this -single filter even more flexible. For example, if you are interested in IOTA -and will work it even on CW even though normally you are not interested in -CW, then you could say ... +

The basic principle of registration is simple. If a user is not registered +by the sysop, then they have read-only access to the cluster. The only +thing they can actually send is a talk or a message to the sysop. In +order for them to be able to spot, send announces or talks etc the sysop +must register them with the set/register command, like this ...

-reject/spots on hf/cw and not info iota
+set/register g0vgs
 
-

But in that case you might only be interested in iota and say:- +

The user g0vgs can now fully use the cluster. In order to enable +registration, you can issue the command ...

-accept/spots not on hf/cw or info iota
+set/var $main::reqreg = 1
 
-

which achieves exactly the same thing. You should choose one or the other -until you are comfortable with the way it works. You can mix them if you -wish (actually you can have an accept AND a reject on the same line) but -don't attempt this until you are sure you know what you are doing! +

Any users that are not registered will now see the motd_nor file rather +than the motd file as discussed in the Information, files and useful +programs section.

-

You can arrange your filter lines into logical units, either for your own -understanding or simply convenience. Here is an example ... +

Entering this line at the prompt will only last for the time the cluster +is running of course and would not be present on a restart. To make the +change permanent, add the above line to /spider/scripts/startup. To +read more on the startup file, see the section on Information, files +and useful programs.

-

-
-reject/spots 1 on hf/cw
-reject/spots 2 on 50000/1400000 not (by_zone 14,15,16 or call_zone 14,15,16)  
-
-
-

What this does is to ignore all HF CW spots and also rejects any spots on VHF -which don't either originate or spot someone in Europe. -

-

This is an example where you would use a line number (1 and 2 in this case), if -you leave the digit out, the system assumes '1'. Digits '0'-'9' are available. -This make it easier to see just what filters you have set. It also makes it -more simple to remove individual filters, during a contest for example. +

To unregister a user use unset/register and to show the list +of registered users, use the command show/register.

-

You will notice in the above example that the second line has brackets. Look -at the line logically. You can see there are 2 separate sections to it. We -are saying reject spots that are VHF or above APART from those in -zones 14, 15 and 16 (either spotted there or originated there). If you did -not have the brackets to separate the 2 sections, then Spider would read it -logically from the front and see a different expression entirely ... -

-

-
-(on 50000/1400000 and by_zone 14,15,16) or call_zone 14,15,16 
-
-
-

The simple way to remember this is, if you use OR - use brackets. Whilst we are -here CASE is not important. 'And BY_Zone' is just the same as 'and by_zone'. -

As mentioned earlier, setting several filters can be more flexible than -simply setting one complex one. Doing it in this way means that if you want -to alter your filter you can just redefine or remove one or more lines of it or -one line. For example ... -

-

-
-reject/spots 1 on hf/ssb
-
-
-

would redefine our earlier example, or -

-

-
-clear/spots 1
-
-
-

To remove all the filter lines in the spot filter ... -

-

-
-clear/spots all
-
-
-

-

7.3 Filter options -

- -

You can filter in several different ways. The options are listed in the -various helpfiles for accept, reject and filter. -

-

7.4 Default filters +

7.2 Passwords

-

Sometimes all that is needed is a general rule for node connects. This can -be done with a node_default filter. This rule will always be followed, even -if the link is isolated, unless another filter is set specifically. Default -rules can be set for nodes and users. They can be set for spots, announces, -WWV and WCY. They can also be used for hops. An example might look like -this ... +

At the moment, passwords only affect users who login to a DXSpider +cluster node via telnet. If a user requires a password, they can +either set it themselves or have the sysop enter it for them by using +the set/password command. Any users who already have passwords, +such as remote sysops, will be asked for their passwords automatically +by the cluster. Using passwords in this way means that the user has a +choice on whether to have a password or not. To force the use of +passwords at login, issue the command ...

-accept/spot node_default by_zone 14,15,16,20,33
-set/hops node_default spot 50
+set/var $main::passwdreq = 1
 
-

This filter is for spots only, you could set others for announce, WWV and WCY. -This filter would work for ALL nodes unless a specific filter is written to -override it for a particular node. You can also set a user_default should -you require. It is important to note that default filters should be -considered to be "connected". By this I mean that should you override the -default filter for spots, you need to add a rule for the hops for spots also. +

at the cluster prompt. This can also be added to the /spider/scripts/startup +file as above to make the change permanent.

-

7.5 Advanced filtering -

- -

Once you are happy with the results you get, you may like to experiment. +

Of course, if you do this you will have to assign a password for each of +your users. If you were asking them to register, it is anticipated that +you would ask them to send you a message both to ask to be registered and +to give you the password they wish to use.

-

The previous example that filters hf/cw spots and accepts vhf/uhf spots from EU -can be written with a mixed filter, for example ... +

Should a user forget their password, it can be reset by the sysop by +first removing the existing password and then setting a new one like so ...

-rej/spot on hf/cw
-acc/spot on 0/30000
-acc/spot 2 on 50000/1400000 and (by_zone 14,15,16 or call_zone 14,15,16)
+unset/password g0vgs
+set/password g0vgs new_password
 
-

Note that the first filter has not been specified with a number. This will -automatically be assumed to be number 1. In this case, we have said reject all -HF spots in the CW section of the bands but accept all others at HF. Also -accept anything in VHF and above spotted in or by operators in the zones -14, 15 and 16. Each filter slot actually has a 'reject' slot and -an 'accept' slot. The reject slot is executed BEFORE the accept slot. -

-

It was mentioned earlier that after a reject test that doesn't match, the default -for following tests is 'accept', the reverse is true for 'accept'. In the example -what happens is that the reject is executed first, any non hf/cw spot is passed -to the accept line, which lets through everything else on HF. The next filter line -lets through just VHF/UHF spots from EU. -


Next