NAME

       bld - A black list daemon

SYNOPSIS

       bld -h | [option]

OPTIONS

       -v     Output version information and exit

       -n     Do not fork to become a daemon

       -a address
              Address to bind to

       -p port
              Port to listen to

       -l number
              Log verbosity (between 0 and 3)

       -t number
              Minimum time interval before blacklisting

       -m number
              Maximum submissions in time interval

       -i number
              IP list size

       -b number
              Blacklist size

       -e number
              Blacklist expiration

       -P filename
              Filename where to save PID

       -T number
              Timeout for client connections

       -u user
              User to run as

       -g group
              Group to run as

       -f filename
              Use a specific configuration file

       -A filename
              Filename where to find ACLs

       -W filename
              Filename where to find whitelist

       -B filename
              Filename where to store blacklist

       -I filename
              Filename where to store whole IP list

       DESCRIPTION

       By  default,  the  bld  daemon  listens  to  requests  on  port  2905.   Requests are either IP addresses
       submissions or checks against the black list.

       bld uses a very simple algorithm to decide whether to add IP addresses to the blacklist or not. The first
       time  an  IP  address  is  submitted,  it  is  added to an internal list with a timestamp and all further
       requests increment a counter for this IP.  As soon as the minimum time interval is elapsed  (default:  30
       seconds),  and  if  a  maximum  requests  ratio  is  reached  (default:  10 submissions in the 30 seconds
       interval), the IP is put in the blacklist.  It is then blacklisted for a configurable time (default:  900
       seconds).

PROTOCOL

       Requests  sent  to bld are rather simple.  Each request or reply is followed by a linefeed and a carriage
       return.  A client may only send one request per TCP session.  As of now, two commands  may  be  used:  ip
       (address submission) and ip? (ask if address is blacklisted).

       ip=a.b.c.d  submits  an IP address.  The server acknowledges either with a 200 code if the address is not
       blacklisted or a 421 if it is.

       ipdecr=a.b.c.d decrements the internal counter for an IP address.  The lowest value for  the  counter  is
       zero.  The server always acknowledges with a 200 code.

       ip?=a.b.c.d asks if address is blacklisted.  The server reply may be 421 if it is or 200 if it's not.

       ipbl=a.b.c.d forces the insertion in the blacklist.  The server acknowledges with a 200 code.

       If  using  IP  based restrictions, the server reply may be 600 if the client is not in the correct ACL to
       perform a request.  Any other error will generate a reply with a 500 error code.

NOTES

       bld binds to localhost by default and accepts any local request, so please make sure  that  only  trusted
       users  can establish a connection to the daemon.  Please check that all authorized hosts meet the minimal
       security requirements before  changing  this  parameter  even  if  using  an  access  control  list  (see
       bld_acl.conf(5)).

       bld  will log some statistics if it receives the SIGUSR1 signal.  SIGUSR2 is used to force a dump of both
       lists in bld working directory.

FILES

       /etc/bld/bld.conf      /etc/bld/bld_acl.conf       /etc/bld/bld_whitelist.conf       /var/run/bld/bld.pid
       /var/run/bld/bld_iplist.dump /var/run/bld/bld_blacklist.dump

SEE ALSO

       bld.conf(5) bld_acl.conf(5) bld_whitelist.conf(5) bldread(8) bldquery(8) bldsubmit(8) blddecr(8)

AUTHOR

       Olivier Beyssac <obld@r14.freenix.org>

                                                   August 2004                                            BLD(8)