NAME

       bld - A black list daemon

SYNOPSIS

       bld -h | [option]

OPTIONS

       -v     Output version information and exit

       -n     Do not fork to become a daemon

       -a address
              Address to bind to

       -p port
              Port to listen to

       -l number
              Log verbosity (between 0 and 3)

       -t number
              Minimum time interval before blacklisting

       -m number
              Maximum submissions in time interval

       -i number
              IP list size

       -b number
              Blacklist size

       -e number
              Blacklist expiration

       -P filename
              Filename where to save PID

       -T number
              Timeout for client connections

       -u user
              User to run as

       -g group
              Group to run as

       -f filename
              Use a specific configuration file

       -A filename
              Filename where to find ACLs

       -W filename
              Filename where to find whitelist

       -B filename
              Filename where to store blacklist

       -I filename
              Filename where to store whole IP list

       DESCRIPTION

       By  default,  the  bld  daemon  listens  to requests on port 2905.  Requests are either IP
       addresses submissions or checks against the black list.

       bld uses a very simple algorithm to decide whether to add IP addresses to the blacklist or
       not.  The  first  time  an IP address is submitted, it is added to an internal list with a
       timestamp and all further requests increment a counter  for  this  IP.   As  soon  as  the
       minimum time interval is elapsed (default: 30 seconds), and if a maximum requests ratio is
       reached (default: 10 submissions in the 30  seconds  interval),  the  IP  is  put  in  the
       blacklist.  It is then blacklisted for a configurable time (default: 900 seconds).

PROTOCOL

       Requests  sent  to bld are rather simple.  Each request or reply is followed by a linefeed
       and a carriage return.  A client may only send one request per TCP session.   As  of  now,
       two commands may be used: ip (address submission) and ip? (ask if address is blacklisted).

       ip=a.b.c.d  submits  an IP address.  The server acknowledges either with a 200 code if the
       address is not blacklisted or a 421 if it is.

       ipdecr=a.b.c.d decrements the internal counter for an IP address.  The  lowest  value  for
       the counter is zero.  The server always acknowledges with a 200 code.

       ip?=a.b.c.d  asks  if address is blacklisted.  The server reply may be 421 if it is or 200
       if it's not.

       ipbl=a.b.c.d forces the insertion in the blacklist.  The server acknowledges  with  a  200
       code.

       If  using  IP  based restrictions, the server reply may be 600 if the client is not in the
       correct ACL to perform a request.  Any other error will generate a reply with a 500  error
       code.

NOTES

       bld  binds to localhost by default and accepts any local request, so please make sure that
       only trusted users can establish a connection  to  the  daemon.   Please  check  that  all
       authorized  hosts  meet  the  minimal security requirements before changing this parameter
       even if using an access control list (see bld_acl.conf(5)).

       bld will log some statistics if it receives the SIGUSR1 signal.  SIGUSR2 is used to  force
       a dump of both lists in bld working directory.

FILES

       /etc/bld/bld.conf  /etc/bld/bld_acl.conf  /etc/bld/bld_whitelist.conf /var/run/bld/bld.pid
       /var/run/bld/bld_iplist.dump /var/run/bld/bld_blacklist.dump

SEE ALSO

       bld.conf(5)  bld_acl.conf(5)  bld_whitelist.conf(5)  bldread(8)  bldquery(8)  bldsubmit(8)
       blddecr(8)

AUTHOR

       Olivier Beyssac <obld@r14.freenix.org>

                                           August 2004                                     BLD(8)