2008-04-06 15:21:47 +00:00
|
|
|
.TH saned 8 "6 April 2008" "@PACKAGEVERSION@" "SANE Scanner Access Now Easy"
|
1999-08-09 18:06:01 +00:00
|
|
|
.IX saned
|
|
|
|
.SH NAME
|
2002-11-22 18:20:32 +00:00
|
|
|
saned \- SANE network daemon
|
1999-08-09 18:06:01 +00:00
|
|
|
.SH SYNOPSIS
|
|
|
|
.B saned
|
2008-04-06 15:21:47 +00:00
|
|
|
.B [ -a | -d
|
|
|
|
.I [ n ]
|
|
|
|
.B | -s
|
|
|
|
.I [ n ]
|
|
|
|
.B ]
|
1999-08-09 18:06:01 +00:00
|
|
|
.SH DESCRIPTION
|
|
|
|
.B saned
|
|
|
|
is the SANE (Scanner Access Now Easy) daemon that allows remote clients
|
|
|
|
to access image acquisition devices available on the local host.
|
|
|
|
.SH OPTIONS
|
|
|
|
.PP
|
|
|
|
The
|
2008-04-06 15:21:47 +00:00
|
|
|
.B -a
|
|
|
|
flag requests that
|
|
|
|
.B saned
|
|
|
|
run in standalone daemon mode. In this mode,
|
|
|
|
.B saned
|
|
|
|
will detach from the console and run in the background, listening for incoming
|
|
|
|
client connections;
|
|
|
|
.B inetd
|
|
|
|
is not required for
|
|
|
|
.B saned
|
|
|
|
operations in this mode.
|
|
|
|
.PP
|
|
|
|
The
|
2005-11-24 20:17:43 +00:00
|
|
|
.B -d
|
2002-01-05 12:54:34 +00:00
|
|
|
and
|
2005-11-24 20:17:43 +00:00
|
|
|
.B -s
|
2002-01-05 12:54:34 +00:00
|
|
|
flags request that
|
1999-08-09 18:06:01 +00:00
|
|
|
.B saned
|
|
|
|
run in debug mode (as opposed to
|
|
|
|
.BR inetd (8)
|
|
|
|
mode). In this mode,
|
|
|
|
.B saned
|
|
|
|
explicitly waits for a connection request. When compiled with
|
2002-01-05 12:54:34 +00:00
|
|
|
debugging enabled, these flags may be followed by a number to request
|
|
|
|
debug info. The larger the number, the more verbose the debug output.
|
2002-11-22 18:20:32 +00:00
|
|
|
E.g.,
|
2005-11-24 20:17:43 +00:00
|
|
|
.B -d128
|
2002-11-22 18:20:32 +00:00
|
|
|
will request printing of all debug info. Debug level 0 means no debug output
|
|
|
|
at all. The default value is 2. If flag
|
2005-11-24 20:17:43 +00:00
|
|
|
.B -d
|
2002-01-05 12:54:34 +00:00
|
|
|
is used, the debug messages will be printed to stderr while
|
2005-11-24 20:17:43 +00:00
|
|
|
.B -s
|
2003-02-09 15:48:54 +00:00
|
|
|
requests using syslog.
|
|
|
|
.PP
|
|
|
|
If
|
|
|
|
.B saned
|
|
|
|
is run from inetd or xinetd, no option can be given.
|
1999-08-09 18:06:01 +00:00
|
|
|
.SH CONFIGURATION
|
2003-02-09 15:48:54 +00:00
|
|
|
First and foremost:
|
|
|
|
.B saned
|
|
|
|
is not intended to be exposed to the internet or other non-trusted
|
|
|
|
networks. Make sure that access is limited by tcpwrappers and/or a firewall
|
|
|
|
setup. Don't depend only on
|
|
|
|
.BR saned 's
|
|
|
|
own authentification. Don't run
|
|
|
|
.B saned
|
|
|
|
as root if it's not necessary. And do
|
2002-11-22 18:20:32 +00:00
|
|
|
.B not
|
1999-08-09 18:06:01 +00:00
|
|
|
install
|
|
|
|
.B saned
|
2003-02-09 15:48:54 +00:00
|
|
|
as setuid root.
|
1999-08-09 18:06:01 +00:00
|
|
|
.PP
|
|
|
|
The contents of the
|
|
|
|
.I saned.conf
|
2003-10-19 10:36:28 +00:00
|
|
|
file is a list of host names, IP addresses or IP subnets (CIDR notation) that
|
|
|
|
are permitted to use local SANE devices. IPv6 addresses must be enclosed in
|
|
|
|
brackets, and should always be specified in their compressed form.
|
|
|
|
Connections from localhost are always permitted.
|
2001-10-15 20:31:16 +00:00
|
|
|
Empty lines and lines starting with a hash mark (#) are ignored. A line
|
|
|
|
containing the single character ``+'' is interpreted to match any hostname.
|
|
|
|
This allows any remote machine to use your scanner and may present a security
|
|
|
|
risk, so this shouldn't be used unless you know what you're doing. A sample
|
|
|
|
configuration file is shown below:
|
1999-08-09 18:06:01 +00:00
|
|
|
.PP
|
|
|
|
.RS
|
|
|
|
scan-client.somedomain.firm
|
|
|
|
.br
|
|
|
|
# this is a comment
|
|
|
|
.br
|
2002-01-06 21:01:05 +00:00
|
|
|
192.168.0.1
|
2003-03-30 19:07:18 +00:00
|
|
|
.br
|
2003-10-19 10:36:28 +00:00
|
|
|
192.168.2.12/29
|
|
|
|
.br
|
|
|
|
[::1]
|
|
|
|
.br
|
|
|
|
[2001:7a8:185e::42:12]/64
|
1999-08-09 18:06:01 +00:00
|
|
|
.RE
|
|
|
|
.PP
|
|
|
|
The case of the host names does not matter, so AHost.COM is considered
|
2003-10-19 10:36:28 +00:00
|
|
|
identical to ahost.com.
|
2008-04-06 15:21:47 +00:00
|
|
|
.SH INETD CONFIGURATION
|
1999-08-09 18:06:01 +00:00
|
|
|
For
|
|
|
|
.B saned
|
2008-04-06 15:21:47 +00:00
|
|
|
to work properly in its default mode of operation, it is also necessary to add
|
|
|
|
a configuration line to
|
1999-08-09 18:06:01 +00:00
|
|
|
.IR /etc/inetd.conf .
|
2003-03-30 19:07:18 +00:00
|
|
|
Note that your inetd must support IPv6 if you
|
|
|
|
want to connect to saned over IPv6 ; xinetd and openbsd-inetd are known to
|
|
|
|
support IPv6, check the documentation for your inetd daemon.
|
|
|
|
.PP
|
1999-08-09 18:06:01 +00:00
|
|
|
The configuration line normally looks like this:
|
|
|
|
.PP
|
|
|
|
.RS
|
2004-06-02 18:38:28 +00:00
|
|
|
sane-port stream tcp nowait saned.saned @SBINDIR@/saned saned
|
1999-08-09 18:06:01 +00:00
|
|
|
.RE
|
|
|
|
.PP
|
|
|
|
However, if your system uses
|
|
|
|
.BR tcpd (8)
|
|
|
|
for additional security screening, you may want to disable saned
|
|
|
|
access control by putting ``+'' in
|
|
|
|
.IR saned.conf
|
|
|
|
and use a line of the following form in
|
|
|
|
.IR /etc/inetd.conf
|
|
|
|
instead:
|
|
|
|
.PP
|
|
|
|
.RS
|
2004-06-02 18:38:28 +00:00
|
|
|
sane-port stream tcp nowait saned.saned /usr/sbin/tcpd @SBINDIR@/saned
|
1999-08-09 18:06:01 +00:00
|
|
|
.RE
|
|
|
|
.PP
|
|
|
|
Note that both examples assume that there is a
|
|
|
|
.B saned
|
|
|
|
group and a
|
|
|
|
.B saned
|
|
|
|
user. If you follow this example, please make sure that the
|
|
|
|
access permissions on the special device are set such that
|
|
|
|
.B saned
|
|
|
|
can access the scanner (the program generally needs read and
|
|
|
|
write access to scanner devices).
|
|
|
|
.PP
|
2000-11-30 19:50:56 +00:00
|
|
|
If xinetd is installed on your system instead of inetd the following example
|
|
|
|
for xinetd.conf may be helpful:
|
|
|
|
.PP
|
|
|
|
.RS
|
2005-11-26 05:31:26 +00:00
|
|
|
.ft CR
|
|
|
|
.nf
|
2000-11-30 19:50:56 +00:00
|
|
|
# default: off
|
|
|
|
# description: The sane server accepts requests
|
|
|
|
# for network access to a local scanner via the
|
|
|
|
# network.
|
2004-06-02 18:38:28 +00:00
|
|
|
service sane-port
|
2000-11-30 19:50:56 +00:00
|
|
|
{
|
2005-11-26 05:31:26 +00:00
|
|
|
port = 6566
|
|
|
|
socket_type = stream
|
|
|
|
wait = no
|
|
|
|
user = saned
|
|
|
|
group = saned
|
|
|
|
server = @SBINDIR@/saned
|
2000-11-30 19:50:56 +00:00
|
|
|
}
|
2005-11-26 05:31:26 +00:00
|
|
|
.fi
|
|
|
|
.ft R
|
2000-11-30 19:50:56 +00:00
|
|
|
.RE
|
|
|
|
.PP
|
1999-08-09 18:06:01 +00:00
|
|
|
Finally, it is also necessary to add a line of the following form to
|
|
|
|
.IR /etc/services :
|
|
|
|
.PP
|
|
|
|
.RS
|
2004-06-02 18:38:28 +00:00
|
|
|
sane-port 6566/tcp # SANE network scanner daemon
|
1999-08-09 18:06:01 +00:00
|
|
|
.RE
|
|
|
|
.PP
|
2004-06-02 18:38:28 +00:00
|
|
|
The official IANA short name for port 6566 is "sane-port". The older name "sane"
|
|
|
|
is now deprecated.
|
2002-01-08 21:51:10 +00:00
|
|
|
|
|
|
|
.SH "RESTRICTIONS"
|
2008-04-06 15:21:47 +00:00
|
|
|
In addition to the control connection (port
|
|
|
|
.B 6566
|
|
|
|
)
|
|
|
|
.B saned
|
|
|
|
also uses a data
|
2002-01-08 21:51:10 +00:00
|
|
|
connection. The port of this socket is selected by the operating system and
|
|
|
|
can't be specified by the user currently. This may be a problem if the
|
2003-10-29 10:47:55 +00:00
|
|
|
connection must go through a firewall (packet filter). If you must use a packet
|
|
|
|
filter, make sure that all ports > 1024 are open on the server for connections
|
|
|
|
from the client.
|
2002-01-08 21:51:10 +00:00
|
|
|
|
1999-08-09 18:06:01 +00:00
|
|
|
.SH FILES
|
|
|
|
.TP
|
|
|
|
.I /etc/hosts.equiv
|
|
|
|
The hosts listed in this file are permitted to access all local SANE
|
|
|
|
devices. Caveat: this file imposes serious security risks and its use
|
|
|
|
is not recommended.
|
|
|
|
.TP
|
|
|
|
.I @CONFIGDIR@/saned.conf
|
|
|
|
Contains a list of hosts permitted to access local SANE devices (see
|
|
|
|
also description of
|
|
|
|
.B SANE_CONFIG_DIR
|
|
|
|
below).
|
2000-11-20 18:49:26 +00:00
|
|
|
.TP
|
|
|
|
.I @CONFIGDIR@/saned.users
|
|
|
|
If this file contains lines of the form
|
2005-04-12 06:01:14 +00:00
|
|
|
|
2000-11-24 15:05:22 +00:00
|
|
|
user:password:backend
|
2005-04-12 06:01:14 +00:00
|
|
|
|
2000-11-20 18:49:26 +00:00
|
|
|
access to the listed backends is restricted. A backend may be listed multiple
|
|
|
|
times for different user/password combinations. The server uses MD5 encryption
|
|
|
|
if supported by the client.
|
1999-08-09 18:06:01 +00:00
|
|
|
.SH ENVIRONMENT
|
|
|
|
.TP
|
|
|
|
.B SANE_CONFIG_DIR
|
|
|
|
This environment variable specifies the list of directories that may
|
|
|
|
contain the configuration file. Under UNIX, the directories are
|
|
|
|
separated by a colon (`:'), under OS/2, they are separated by a
|
|
|
|
semi-colon (`;'). If this variable is not set, the configuration file
|
|
|
|
is searched in two default directories: first, the current working
|
|
|
|
directory (".") and then in @CONFIGDIR@. If the value of the
|
|
|
|
environment variable ends with the directory separator character, then
|
|
|
|
the default directories are searched after the explicitly specified
|
|
|
|
directories. For example, setting
|
|
|
|
.B SANE_CONFIG_DIR
|
|
|
|
to "/tmp/config:" would result in directories "tmp/config", ".", and
|
|
|
|
"@CONFIGDIR@" being searched (in this order).
|
|
|
|
|
|
|
|
.SH "SEE ALSO"
|
2002-11-22 18:20:32 +00:00
|
|
|
.BR sane (7),
|
|
|
|
.BR scanimage (1),
|
|
|
|
.BR xscanimage (1),
|
|
|
|
.BR xcam (1),
|
|
|
|
.BR sane-dll (5),
|
|
|
|
.BR sane-net (5),
|
|
|
|
.BR sane-"backendname" (5)
|
|
|
|
.br
|
2002-04-30 12:13:16 +00:00
|
|
|
.I http://www.penguin-breeder.org/?page=sane-net
|
1999-08-09 18:06:01 +00:00
|
|
|
.SH AUTHOR
|
|
|
|
David Mosberger
|