Expansions, when used in conjunction with the
twist directives, provide information about the client, server, and processes involved.
Below is a list of supported expansions:
%a — Supplies the client's IP address.
%A — Supplies the server's IP address.
%c — Supplies a variety of client information, such as the username and hostname, or the username and IP address.
%d — Supplies the daemon process name.
%h — Supplies the client's hostname (or IP address, if the hostname is unavailable).
%H — Supplies the server's hostname (or IP address, if the hostname is unavailable).
%n — Supplies the client's hostname. If unavailable,
unknown is printed. If the client's hostname and host address do not match,
paranoid is printed.
%N — Supplies the server's hostname. If unavailable,
unknown is printed. If the server's hostname and host address do not match,
paranoid is printed.
%p — Supplies the daemon process ID.
%s —Supplies various types of server information, such as the daemon process and the host or IP address of the server.
%u — Supplies the client's username. If unavailable,
unknown is printed.
The following sample rule uses an expansion in conjunction with the
spawn command to identify the client host in a customized log file.
When connections to the SSH daemon (
sshd) are attempted from a host in the
example.com domain, execute the
echo command to log the attempt, including the client hostname (by using the
%h expansion), to a special file:
sshd : .example.com \
: spawn /bin/echo `/bin/date` access denied to %h>>/var/log/sshd.log \
Similarly, expansions can be used to personalize messages back to the client. In the following example, clients attempting to access FTP services from the
example.com domain are informed that they have been banned from the server:
vsftpd : .example.com \
: twist /bin/echo "421 %h has been banned from this server!"
For a full explanation of available expansions, as well as additional access control options, refer to section 5 of the man pages for
man 5 hosts_access) and the man page for
For additional information about TCP wrappers, refer to Section 17.5, “Additional Resources”
. For more information about how to secure TCP wrappers, refer to the chapter titled Server Security
in the Security Guide