| blob | abcd5d02904870b6eae3ea1e5e5762f7e1ccdc3a |
1 '\" te
2 .\" Copyright (c) 1996 David Sacerdote All rights reserved.
3 .\" Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
4 .\" 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. The name of the author may not be used to endorse or promote products derived from this
5 .\" software without specific prior written permission THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR
6 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
7 .\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
8 .\" Portions Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
9 .TH NC 1 "Apr 9, 2009"
10 .SH NAME
11 nc \- arbitrary TCP and UDP connections and listens
12 .SH SYNOPSIS
13 .LP
14 .nf
15 \fBnc\fR \fB-h\fR
16 .fi
18 .LP
19 .nf
20 \fBnc\fR [\fB-46dnrtuvz\fR] [\fB-i\fR \fIinterval\fR] [\fB-P\fR \fIproxy_username\fR] [\fB-p\fR \fIport\fR]
21 [\fB-s\fR \fIsource_ip_address\fR] [\fB-T\fR \fIToS\fR] [\fB-w\fR \fItimeout\fR]
22 [\fB-X\fR \fIproxy_protocol\fR] [\fB-x\fR \fIproxy_address\fR[:\fIport\fR]]
23 \fIhostname\fR \fIport_list\fR
24 .fi
26 .LP
27 .nf
28 \fBnc\fR \fB-l\fR [\fB-46Ddnrtuvz\fR] [\fB-i\fR \fIinterval\fR] [\fB-T\fR \fIToS\fR] [\fIhostname\fR] \fIport\fR
29 .fi
31 .LP
32 .nf
33 \fBnc\fR \fB-l\fR [\fB-46Ddnrtuvz\fR] [\fB-i\fR \fIinterval\fR] [\fB-T\fR \fIToS\fR] \fB-p\fR \fIport\fR
34 .fi
36 .LP
37 .nf
38 \fBnc\fR \fB-U\fR [\fB-Ddtvz\fR] [\fB-i\fR \fIinterval\fR] [\fB-w\fR \fItimeout\fR] \fIpath\fR
39 .fi
41 .LP
42 .nf
43 \fBnc\fR \fB-Ul\fR [\fB-46Ddktv\fR] [\fB-i\fR \fIinterval\fR] \fIpath\fR
44 .fi
46 .SH DESCRIPTION
47 .sp
48 .LP
49 The \fBnc\fR (or \fBnetcat\fR) utility is used for a variety of tasks
50 associated with TCP or UDP. \fBnc\fR can open TCP connections, send UDP
51 packets, listen on arbitrary TCP and UDP ports, perform port scanning, and deal
52 with both IPv4 and IPv6. Unlike \fBtelnet\fR(1), \fBnc\fR scripts nicely, and
53 separates error messages onto standard error instead of sending them to
54 standard output.
55 .sp
56 .LP
57 The \fBnc\fR command is often used for the following tasks:
58 .RS +4
59 .TP
60 .ie t \(bu
61 .el o
62 simple TCP proxies
63 .RE
64 .RS +4
65 .TP
66 .ie t \(bu
67 .el o
68 shell-script based HTTP clients and servers
69 .RE
70 .RS +4
71 .TP
72 .ie t \(bu
73 .el o
74 network daemon testing
75 .RE
76 .RS +4
77 .TP
78 .ie t \(bu
79 .el o
80 a SOCKS or HTTP \fBProxyCommand\fR for \fBssh\fR(1)
81 .RE
82 .SH OPTIONS
83 .sp
84 .LP
85 The following options are supported:
86 .sp
87 .ne 2
88 .na
89 \fB\fB-4\fR\fR
90 .ad
91 .sp .6
92 .RS 4n
93 Force \fBnc\fR to use IPv4 addresses only.
94 .RE
96 .sp
97 .ne 2
98 .na
99 \fB\fB-6\fR\fR
100 .ad
101 .sp .6
102 .RS 4n
103 Force \fBnc\fR to use IPv6 addresses only.
104 .RE
106 .sp
107 .ne 2
108 .na
109 \fB\fB-D\fR\fR
110 .ad
111 .sp .6
112 .RS 4n
113 Enable debugging on the socket.
114 .RE
116 .sp
117 .ne 2
118 .na
119 \fB\fB-d\fR\fR
120 .ad
121 .sp .6
122 .RS 4n
123 Do not attempt to read from \fBstdin\fR.
124 .RE
126 .sp
127 .ne 2
128 .na
129 \fB\fB-h\fR\fR
130 .ad
131 .sp .6
132 .RS 4n
133 Print \fBnc\fR help.
134 .RE
136 .sp
137 .ne 2
138 .na
139 \fB\fB-i\fR \fIinterval\fR\fR
140 .ad
141 .sp .6
142 .RS 4n
143 Specify a delay time of \fIinterval\fR between lines of text sent and received.
144 This option also causes a delay time between connections to multiple ports.
145 .RE
147 .sp
148 .ne 2
149 .na
150 \fB\fB-k\fR\fR
151 .ad
152 .sp .6
153 .RS 4n
154 Force \fBnc\fR to listen for another connection after its current connection is
155 closed.
156 .sp
157 It is an error to use this option without the \fB-l\fR option.
158 .RE
160 .sp
161 .ne 2
162 .na
163 \fB\fB-l\fR\fR
164 .ad
165 .sp .6
166 .RS 4n
167 Listen for an incoming connection rather than initiate a connection to a remote
168 host.
169 .sp
170 It is an error to use this option in conjunction with the \fB-s\fR or \fB-z\fR
171 options. Additionally, any \fItimeout\fR specified with the \fB-w\fR option is
172 ignored.
173 .RE
175 .sp
176 .ne 2
177 .na
178 \fB\fB-n\fR\fR
179 .ad
180 .sp .6
181 .RS 4n
182 Do not do any naming or service lookups on any addresses, hostnames, or ports.
183 .sp
184 Use of this option means that \fIhostname\fR and \fIport\fR arguments are
185 restricted to numeric values.
186 .sp
187 If used with \fB-v\fR option all addresses and ports are printed in numeric
188 form, in addition to the restriction imposed on the arguments. This option does
189 not have any effect when used in conjunction with the \fB-U\fR option.
190 .RE
192 .sp
193 .ne 2
194 .na
195 \fB\fB-P\fR \fIproxy_username\fR\fR
196 .ad
197 .sp .6
198 .RS 4n
199 Specify a username (\fIproxy_username\fR) to present to a proxy server that
200 requires authentication. If \fIproxy_username\fR is not specified,
201 authentication is not attempted. Proxy authentication is only supported for
202 \fBHTTP CONNECT\fR proxies at present.
203 .sp
204 It is an error to use this option in conjunction with the \fB-l\fR option.
205 .RE
207 .sp
208 .ne 2
209 .na
210 \fB\fB-p\fR \fIport\fR\fR
211 .ad
212 .sp .6
213 .RS 4n
214 When used without \fB-l\fR option, specify the source port \fBnc\fR should use,
215 subject to privilege restrictions and availability. When used with the \fB-l\fR
216 option, set the listen port.
217 .sp
218 This option can be used with \fB-l\fR option only provided global port argument
219 is not specified.
220 .RE
222 .sp
223 .ne 2
224 .na
225 \fB\fB-r\fR\fR
226 .ad
227 .sp .6
228 .RS 4n
229 Choose source or destination ports randomly instead of sequentially within a
230 range or in the order that the system assigns them.
231 .sp
232 It is an error to use this option in conjunction with the \fB-l\fR option.
233 .RE
235 .sp
236 .ne 2
237 .na
238 \fB\fB-s\fR \fIsource_ip_address\fR\fR
239 .ad
240 .sp .6
241 .RS 4n
242 Specify the IP of the interface which is used to send the packets.
243 .sp
244 It is an error to use this option in conjunction with the \fB-l\fR option.
245 .RE
247 .sp
248 .ne 2
249 .na
250 \fB\fB-T\fR \fIToS\fR\fR
251 .ad
252 .sp .6
253 .RS 4n
254 Specify IP Type of Service (\fBToS\fR) for the connection. Valid values are the
255 tokens: \fBlowdelay\fR, \fBthroughput\fR, \fBreliability\fR, or an 8-bit
256 hexadecimal value preceded by \fB0x\fR.
257 .RE
259 .sp
260 .ne 2
261 .na
262 \fB\fB-t\fR\fR
263 .ad
264 .sp .6
265 .RS 4n
266 Cause \fBnc\fR to send \fIRFC 854\fR \fBDON'T\fR and \fBWON'T\fR responses to
267 \fIRFC 854\fR \fBDO\fR and \fBWILL\fR requests. This makes it possible to use
268 \fBnc\fR to script \fBtelnet\fR sessions.
269 .RE
271 .sp
272 .ne 2
273 .na
274 \fB\fB-U\fR\fR
275 .ad
276 .sp .6
277 .RS 4n
278 Specify the use of Unix Domain Sockets. If you specify this option without
279 \fB-l\fR, \fBnc\fR, it becomes \fBAF_UNIX\fR client. If you specify this option
280 with the \fB-l\fR option, a \fBAF_UNIX\fR server is created.
281 .sp
282 Use of this option requires that a single argument of a valid Unix domain path
283 has to be provided to \fBnc\fR, not a host name or port.
284 .RE
286 .sp
287 .ne 2
288 .na
289 \fB\fB-u\fR\fR
290 .ad
291 .sp .6
292 .RS 4n
293 Use UDP instead of the default option of TCP.
294 .RE
296 .sp
297 .ne 2
298 .na
299 \fB\fB-v\fR\fR
300 .ad
301 .sp .6
302 .RS 4n
303 Specify verbose output.
304 .RE
306 .sp
307 .ne 2
308 .na
309 \fB\fB-w\fR \fItimeout\fR\fR
310 .ad
311 .sp .6
312 .RS 4n
313 Silently close the connection if a connection and \fBstdin\fR are idle for more
314 than \fItimeout\fR seconds.
315 .sp
316 This option has no effect on the \fB-l\fR option, that is, \fBnc\fR listens
317 forever for a connection, with or without the \fB-w\fR flag. The default is no
318 timeout.
319 .RE
321 .sp
322 .ne 2
323 .na
324 \fB\fB-X\fR \fIproxy_protocol\fR\fR
325 .ad
326 .sp .6
327 .RS 4n
328 Use the specified protocol when talking to the proxy server. Supported
329 protocols are \fB4\fR (\fBSOCKS v.4\fR), \fB5\fR (\fBSOCKS v.5\fR) and
330 \fBconnect\fR (\fBHTTP\fR proxy). If the protocol is not specified, \fBSOCKS v.
331 5\fR is used.
332 .sp
333 It is an error to use this option in conjunction with the \fB-l\fR option.
334 .RE
336 .sp
337 .ne 2
338 .na
339 \fB\fB-x\fR \fIproxy_address\fR[:\fIport\fR]\fR
340 .ad
341 .sp .6
342 .RS 4n
343 Request connection to \fIhostname\fR using a proxy at \fIproxy_address\fR and
344 \fIport\fR. If \fIport\fR is not specified, the well-known port for the proxy
345 protocol is used (\fB1080\fR for \fBSOCKS\fR, \fB3128\fR for \fBHTTP\fR).
346 .sp
347 It is an error to use this option in conjunction with the \fB-l\fR option.
348 .RE
350 .sp
351 .ne 2
352 .na
353 \fB\fB-z\fR\fR
354 .ad
355 .sp .6
356 .RS 4n
357 Scan for listening daemons, without sending any data to them.
358 .sp
359 It is an error to use this option in conjunction with the \fB-l\fR option.
360 .RE
362 .SH OPERANDS
363 .sp
364 .LP
365 The following operands are supported:
366 .sp
367 .ne 2
368 .na
369 \fB\fIhostname\fR\fR
370 .ad
371 .RS 13n
372 Specify host name.
373 .sp
374 \fIhostname\fR can be a numerical IP address or a symbolic hostname (unless the
375 \fB-n\fR option is specified).
376 .sp
377 In general, \fIhostname\fR must be specified, unless the \fB-l\fR option is
378 given or \fB-U\fR is used (in which case the argument is a path). If
379 \fIhostname\fR argument is specified with \fB-l\fR option then \fIport\fR
380 argument must be given as well and \fBnc\fR tries to bind to that address and
381 port. If \fIhostname\fR argument is not specified with \fB-l\fR option then
382 \fBnc\fR tries to listen on a wildcard socket for given \fIport\fR.
383 .RE
385 .sp
386 .ne 2
387 .na
388 \fB\fIpath\fR\fR
389 .ad
390 .RS 13n
391 Specify pathname.
392 .RE
394 .sp
395 .ne 2
396 .na
397 \fB\fIport\fR\fR
398 .ad
399 .br
400 .na
401 \fB\fIport_list\fR\fR
402 .ad
403 .RS 13n
404 Specify port.
405 .sp
406 \fIport_list\fR can be specified as single integers, ranges or combinations of
407 both. Specify ranges in the form of \fInn-mm\fR. The \fIport_list\fR must have
408 at least one member, but can have multiple ports/ranges separated by commas.
409 .sp
410 In general, a destination port must be specified, unless the \fB-U\fR option is
411 given, in which case a Unix Domain Socket path must be specified instead of
412 \fIhostname\fR.
413 .RE
415 .SH USAGE
416 .SS "Client/Server Model"
417 .sp
418 .LP
419 It is quite simple to build a very basic client/server model using \fBnc\fR. On
420 one console, start \fBnc\fR listening on a specific port for a connection. For
421 example, the command:
422 .sp
423 .in +2
424 .nf
425 $ nc -l 1234
426 .fi
427 .in -2
428 .sp
430 .sp
431 .LP
432 listens on port \fB1234\fR for a connection. On a second console (or a second
433 machine), connect to the machine and port to which \fBnc\fR is listening:
434 .sp
435 .in +2
436 .nf
437 $ nc 127.0.0.1 1234
438 .fi
439 .in -2
440 .sp
442 .sp
443 .LP
444 There should now be a connection between the ports. Anything typed at the
445 second console is concatenated to the first, and vice-versa. After the
446 connection has been set up, \fBnc\fR does not really care which side is being
447 used as a \fBserver\fR and which side is being used as a \fBclient\fR. The
448 connection can be terminated using an \fBEOF\fR (Ctrl/d).
449 .SS "Data Transfer"
450 .sp
451 .LP
452 The example in the previous section can be expanded to build a basic data
453 transfer model. Any information input into one end of the connection is output
454 to the other end, and input and output can be easily captured in order to
455 emulate file transfer.
456 .sp
457 .LP
458 Start by using \fBnc\fR to listen on a specific port, with output captured into
459 a file:
460 .sp
461 .in +2
462 .nf
463 $ nc -l 1234 > filename.out
464 .fi
465 .in -2
466 .sp
468 .sp
469 .LP
470 Using a second machine, connect to the listening \fBnc\fR process, feeding it
471 the file which is to be transferred:
472 .sp
473 .in +2
474 .nf
475 $ nc host.example.com 1234 < filename.in
476 .fi
477 .in -2
478 .sp
480 .sp
481 .LP
482 After the file has been transferred, the connection closes automatically.
483 .SS "Talking to Servers"
484 .sp
485 .LP
486 It is sometimes useful to talk to servers \fBby hand\fR rather than through a
487 user interface. It can aid in troubleshooting, when it might be necessary to
488 verify what data a server is sending in response to commands issued by the
489 client.
490 .sp
491 .LP
492 For example, to retrieve the home page of a web site:
493 .sp
494 .in +2
495 .nf
496 $ echo -n "GET / HTTP/1.0\er\en\er\en" | nc host.example.com 80
497 .fi
498 .in -2
499 .sp
501 .sp
502 .LP
503 This also displays the headers sent by the web server. They can be filtered, if
504 necessary, by using a tool such as \fBsed\fR(1).
505 .sp
506 .LP
507 More complicated examples can be built up when the user knows the format of
508 requests required by the server. As another example, an email can be submitted
509 to an SMTP server using:
510 .sp
511 .in +2
512 .nf
513 $ nc localhost 25 << EOF
514 HELO host.example.com
515 MAIL FROM: <user@host.example.com
516 RCTP TO: <user2@host.example.com
517 DATA
518 Body of email.
519 \&.
520 QUIT
521 EOF
522 .fi
523 .in -2
524 .sp
526 .SS "Port Scanning"
527 .sp
528 .LP
529 It can be useful to know which ports are open and running services on a target
530 machine. The \fB-z\fR flag can be used to tell \fBnc\fR to report open ports,
531 rather than to initiate a connection.
532 .sp
533 .LP
534 In this example:
535 .sp
536 .in +2
537 .nf
538 $ nc -z host.example.com 20-30
539 Connection to host.example.com 22 port [tcp/ssh] succeeded!
540 Connection to host.example.com 25 port [tcp/smtp] succeeded!
541 .fi
542 .in -2
543 .sp
545 .sp
546 .LP
547 The port range was specified to limit the search to ports 20 - 30.
548 .sp
549 .LP
550 Alternatively, it might be useful to know which server software is running, and
551 which versions. This information is often contained within the greeting
552 banners. In order to retrieve these, it is necessary to first make a
553 connection, and then break the connection when the banner has been retrieved.
554 This can be accomplished by specifying a small timeout with the \fB-w\fR flag,
555 or perhaps by issuing a \fBQUIT\fR command to the server:
556 .sp
557 .in +2
558 .nf
559 $ echo "QUIT" | nc host.example.com 20-30
560 SSH-2.0-Sun_SSH_1.1
561 Protocol mismatch.
562 220 host.example.com IMS SMTP Receiver Version 0.84 Ready
563 .fi
564 .in -2
565 .sp
567 .SS "\fBinetd\fR Capabilities"
568 .sp
569 .LP
570 One of the possible uses is to create simple services by using \fBinetd\fR(1M).
571 .sp
572 .LP
573 The following example creates a redirect from TCP port 8080 to port 80 on host
574 \fBrealwww\fR:
575 .sp
576 .in +2
577 .nf
578 # cat << EOF >> /etc/services
579 wwwredir 8080/tcp # WWW redirect
580 EOF
581 # cat << EOF > /tmp/wwwredir.conf
582 wwwredir stream tcp nowait nobody /usr/bin/nc /usr/bin/nc -w 3 realwww 80
583 EOF
584 # inetconv -i /tmp/wwwredir.conf
585 wwwredir -> /var/svc/manifest/network/wwwredir-tcp.xml
586 Importing wwwredir-tcp.xml ...Done
587 # inetadm -l wwwredir/tcp
588 SCOPE NAME=VALUE
589 name="wwwredir"
590 endpoint_type="stream"
591 proto="tcp"
592 isrpc=FALSE
593 wait=FALSE
594 exec="/usr/bin/nc -w 3 realwww 80"
595 arg0="/usr/bin/nc"
596 user="nobody"
597 default bind_addr=""
598 default bind_fail_max=-1
599 default bind_fail_interval=-1
600 default max_con_rate=-1
601 default max_copies=-1
602 default con_rate_offline=-1
603 default failrate_cnt=40
604 default failrate_interval=60
605 default inherit_env=TRUE
606 default tcp_trace=TRUE
607 default tcp_wrappers=FALSE
608 .fi
609 .in -2
610 .sp
612 .SS "Privileges"
613 .sp
614 .LP
615 To bind to a privileged port number \fBnc\fR needs to be granted the
616 \fBnet_privaddr\fR privilege. If Solaris Trusted Extensions are configured and
617 the port \fBnc\fR should listen on is configured as a multi-level port \fBnc\fR
618 also needs the \fBnet_bindmlp\fR privilege.
619 .sp
620 .LP
621 Privileges can be assigned to the user or role directly, by specifying them in
622 the account's default privilege set in \fBuser_attr\fR(4). However, this means
623 that any application that this user or role starts have these additional
624 privileges. To only grant the \fBprivileges\fR(5) when \fBnc\fR is invoked, the
625 recommended approach is to create and assign an \fBrbac\fR(5) rights profile.
626 See \fBEXAMPLES\fR for additional information.
627 .SH EXAMPLES
628 .LP
629 \fBExample 1 \fRUsing \fBnc\fR
630 .sp
631 .LP
632 Open a TCP connection to port \fB42\fR of \fBhost.example.com\fR, using port
633 \fB3141\fR as the source port, with a timeout of \fB5\fR seconds:
635 .sp
636 .in +2
637 .nf
638 $ nc -p 3141 -w 5 host.example.com 42
639 .fi
640 .in -2
641 .sp
643 .sp
644 .LP
645 Open a UDP connection to port \fB53\fR of \fBhost.example.com\fR:
647 .sp
648 .in +2
649 .nf
650 $ nc -u host.example.com 53
651 .fi
652 .in -2
653 .sp
655 .sp
656 .LP
657 Open a TCP connection to port 42 of \fBhost.example.com\fR using \fB10.1.2.3\fR
658 as the IP for the local end of the connection:
660 .sp
661 .in +2
662 .nf
663 $ nc -s 10.1.2.3 host.example.com 42
664 .fi
665 .in -2
666 .sp
668 .sp
669 .LP
670 Use a list of ports and port ranges for a port scan on various ports:
672 .sp
673 .in +2
674 .nf
675 $ nc -z host.example.com 21-25,53,80,110-120,443
676 .fi
677 .in -2
678 .sp
680 .sp
681 .LP
682 Create and listen on a Unix Domain Socket:
684 .sp
685 .in +2
686 .nf
687 $ nc -lU /var/tmp/dsocket
688 .fi
689 .in -2
690 .sp
692 .sp
693 .LP
694 Create and listen on a UDP socket with associated port \fB8888\fR:
696 .sp
697 .in +2
698 .nf
699 $ nc -u -l -p 8888
700 .fi
701 .in -2
702 .sp
704 .sp
705 .LP
706 which is the same as:
708 .sp
709 .in +2
710 .nf
711 $ nc -u -l 8888
712 .fi
713 .in -2
714 .sp
716 .sp
717 .LP
718 Create and listen on a TCP socket with associated port \fB2222\fR and bind to
719 address \fB127.0.0.1\fR only:
721 .sp
722 .in +2
723 .nf
724 $ nc -l 127.0.0.1 2222
725 .fi
726 .in -2
727 .sp
729 .sp
730 .LP
731 Connect to port \fB42\fR of \fBhost.example.com\fR using an HTTP proxy at
732 \fB10.2.3.4\fR, port \fB8080\fR. This example could also be used by
733 \fBssh\fR(1). See the \fBProxyCommand\fR directive in \fBssh_config\fR(4) for
734 more information.
736 .sp
737 .in +2
738 .nf
739 $ nc -x10.2.3.4:8080 -Xconnect host.example.com 42
740 .fi
741 .in -2
742 .sp
744 .sp
745 .LP
746 The same example again, this time enabling proxy authentication with username
747 \fBruser\fR if the proxy requires it:
749 .sp
750 .in +2
751 .nf
752 $ nc -x10.2.3.4:8080 -Xconnect -Pruser host.example.com 42
753 .fi
754 .in -2
755 .sp
757 .sp
758 .LP
759 To run \fBnc\fR with the smallest possible set of privileges as a user or role
760 that has additional privileges (such as the default \fBroot\fR account) it can
761 be invoked using \fBppriv\fR(1) as well. For example, limiting it to only run
762 with the privilege to bind to a privileged port:
764 .sp
765 .in +2
766 .nf
767 $ ppriv -e -sA=basic,!file_link_any,!proc_exec,!proc_fork,\e
768 !proc_info,!proc_session,net_privaddr nc -l 42
769 .fi
770 .in -2
771 .sp
773 .sp
774 .LP
775 To allow a user or role to use only \fBnc\fR with the \fBnet_privaddr\fR
776 privilege, a rights profile needs to be created:
778 .sp
779 .in +2
780 .nf
781 /etc/security/exec_attr
782 Netcat privileged:solaris:cmd:::/usr/bin/nc:privs=net_privaddr
784 /etc/security/prof_attr
785 Netcat privileged:::Allow nc to bind to privileged ports:help=None.html
786 .fi
787 .in -2
788 .sp
790 .sp
791 .LP
792 Assigning this rights profile using \fBuser_attr\fR(4) permits the user or role
793 to run \fBnc\fR allowing it to listen on any port. To permit a user or role to
794 use \fBnc\fR only to listen on specific ports a wrapper script should be
795 specified in the rights profiles:
797 .sp
798 .in +2
799 .nf
800 /etc/security/exec_attr
801 Netcat restricted:solaris:cmd:::/usr/bin/nc-restricted:privs=net_privaddr
803 /etc/security/prof_attr
804 Netcat restricted:::Allow nc to bind to privileged ports:help=None.html
805 .fi
806 .in -2
807 .sp
809 .sp
810 .LP
811 and write a shell script that restricts the permissible options, for example,
812 one that permits one to bind only on ports between \fB42\fR and \fB64\fR
813 (non-inclusive):
815 .sp
816 .in +2
817 .nf
818 /usr/bin/nc-restricted:
820 #!/bin/sh
821 [ $# -eq 1 ] && [ $1 -gt 42 -a $1 -lt 64 ] && /usr/bin/nc -l -p "$1"
822 .fi
823 .in -2
824 .sp
826 .sp
827 .LP
828 This grants the extra privileges when the user or role invokes \fBnc\fR using
829 the wrapper script from a profile shell. See \fBpfsh\fR(1), \fBpfksh\fR(1),
830 \fBpfcsh\fR(1), and \fBpfexec\fR(1).
832 .sp
833 .LP
834 Invoking \fBnc\fR directly does not run it with the additional privileges, and
835 neither does invoking the script without using \fBpfexec\fR or a profile shell.
837 .SH ATTRIBUTES
838 .sp
839 .LP
840 See \fBattributes\fR(5) for descriptions of the following attributes:
841 .sp
843 .sp
844 .TS
845 box;
846 c | c
847 l | l .
848 ATTRIBUTE TYPE ATTRIBUTE VALUE
849 _
850 Interface Stability See below.
851 .TE
853 .sp
854 .LP
855 The package name is Committed. The command line syntax is Committed for the
856 \fB-4\fR, \fB-6,\fR \fB-l\fR, \fB-n\fR, \fB-p\fR ,\fB-u\fR, and \fB-w\fR
857 options and their arguments (if any). The \fIname\fR and \fIport\fR list
858 arguments are Committed. The port range syntax is Uncommitted. The interface
859 stability level for all other command line options and their arguments is
860 Uncommitted.
861 .SH SEE ALSO
862 .sp
863 .LP
864 \fBcat\fR(1), \fBpfcsh\fR(1), \fBpfexec\fR(1), \fBpfksh\fR(1), \fBpfsh\fR(1),
865 \fBppriv\fR(1), \fBsed\fR(1), \fBssh\fR(1), \fBtelnet\fR(1), \fBinetadm\fR(1M),
866 \fBinetconv\fR(1M), \fBinetd\fR(1M), \fBssh_config\fR(4), \fBuser_attr\fR(4),
867 \fBattributes\fR(5), \fBprivileges\fR(5), \fBrbac\fR(5)
868 .SH AUTHORS
869 .sp
870 .LP
871 The original implementation of \fBnc\fR was written by Hobbit,
872 \fBhobbit@avian.org\fR.
873 .sp
874 .LP
875 \fBnc\fR was rewritten with IPv6 support by Eric Jackson,
876 \fBericj@monkey.org\fR.
877 .SH NOTES
878 .sp
879 .LP
880 UDP port scans always succeeds, that is, reports the port as open, rendering
881 the \fB-uz\fR combination of flags relatively useless.