Man Linux: Main Page and Category List

NAME

       perdition - POP3 and IMAP4 proxy server

SYNOPSIS

       perdition [options]
       perdition.pop3 [options]
       perdition.pop3s [options]
       perdition.imap4 [options]
       perdition.imap4s [options]
       perdition.imaps [options]

DESCRIPTION

       perdition  allows  users  to  connect  to  a content-free POP3 or IMAP4
       server that will redirect them to  their  real  POP3  or  IMAP4  server
       respectively.  This  enables  mail  retrieval  for a domain to be split
       across multiple real mail servers on a per user basis.  This  can  also
       be   used   to  as  a  POP3  or  IMAP4  proxy  especially  in  firewall
       applications.

       When a connection is made to perdition in POP3 mode, it reads the  USER
       and PASS commands and then refers to its popmap to find the real-server
       that the user’s connection should be forwarded  to.   A  connection  is
       made  to  the  real-server  and perdition then enters the USER and PASS
       commands. If authentication is successful  then  perdition  pipes  data
       between the end-user and the real-server.  If authentication fails then
       the real-server connection is closed and the client connection is reset
       to the state it was in on initial connection. That is new USER and PASS
       commands are expected.  Similarly in IMAP4 mode, perdition accepts  the
       LOGIN command and passes the username and password onto the real-server
       or authentication.

       No IMAP authentication  schemes,  other  than  the  LOGIN  command  are
       accepted.

       When  invoked  as  perdition.pop3,  perdition.pop3s, perdition.imap4 or
       perdition.imap4s then perdition will  run  in  POP3,  POP3S,  IMAP4  or
       IMAP4S  mode  respectively, unless overridden on the command line or in
       the configuration file.  perdition.imaps also runs perdition in  IMAP4S
       mode  and  is provided to get around the truncation of process names in
       the /proc filesystem on Linux which can cause init scripts to  fail  to
       stop perdition correctly.

OPTIONS

       -A|--add_domain STATE[,STATE...][,STRIP_DEPTH]:
              Appends  a  domain to the USER based on the IP address connected
              to in given state(s). The domain name  to  append  will  be  the
              reverse-lookup  of  the  IP address connected to. If there is no
              reverse lookup for this IP address, then a domain  will  not  be
              appended. Probably the easiest way to enforce this mapping is to
              add entries to /etc/hosts.

              The valid states  are  servername_lookup,  local_authentication,
              remote_login and all

              servername_lookup:  Append the domain to the username for lookup
              of   username   in   Popmap.   Will   not   take    effect    if
              client_server_specification is in effect.

              local_authentication:  Append the domain to the username for use
              in local authentication. Only has effect if  authenticate_in  is
              in effect.

              remote_login:  Send the username with the domain appended to the
              real-server for authentication.

              all: Short-Hand for all of above states.

              The domain may also have leading levels striped, essentially  to
              convert  a  hostname  to  a  domain name. The depth of the strip
              defaults to 1, which would mean that  www.au.vergenet.net  would
              become  au.vergenet.net.  A  depth of 2 would cause it to become
              vergenet.net and  so  forth.  A  depth  of  0  leaves  the  name
              unchanged.    The  depth  and  may  be  specified  by  appending
              ",STRIP_DEPTH" to the  state.   For  compatibility  reasons  the
              default depth is 1.

              e.g. all,2

              (the default value for add_domain is "")

       --authenticate_timeout:
              Idle  timeout in seconds used while the user is unauthenticated.
              Zero for infinite timeout.

       -a, --authenticate_in:
              User is authenticated by perdition before connection to back-end
              server is made. Only available if perdition is compiled with pam
              support.

       -B, --no_bind_banner:
              If bind_address is specified, then the address will be  resolved
              and  the  reverse-lookup  of  this will be used in the greeting.
              This option disables this behaviour  an  reverts  to  using  the
              uname to derive the hostname for the greeting.

       -b, --bind_address SERVER[,SERVER...]:
              Bind to these addresses and ports. interfaces with this address.
              Format is as per the --outgoing_server option. If  the  port  is
              ommitted, then the listen_port will be used.

              In  non-inetd  mode,  connections  will  only be accepted to the
              listed servers. If un-set connections will be  accepted  on  all
              addresses on the listen_port.

              (default "")

       -C|--connection_logging:
              Log  interaction  between  clients, perdition and servers during
              authentication phase.

              Note: -d|--debug must be  specified  for  this  option  to  take
              effect.

       --connect_relog SECONDS:
              How  often to relog the connection.  For use in conjunction with
              POP and IMAP before SMTP.  If zero then the connection will  not
              be reloged.
              (default 300)

       -c, --client_server_specification:
              Allow  USER  of the form user<delimiter>server[:port] to specify
              the server and port for a user.

       -D, --domain_delimiter STRING:
              Delimiter between username and domain.
              (default "@")

       -d, --debug:
              Turn on verbose debugging.

       -e, --explicit_domain STRING:
              With -A, use STRING as the default domain rather  than  deriving
              from the IP address connected to.
              (default NULL)

       -F, --log_facility FACILITY:
              Facility  to  log  to. If the facility has a leading ’/’ then it
              will be treated as a file. If is "-" or "+" then log  to  stdout
              or  stderr  respectively. Otherwise it is assumed to be the name
              of a  syslog  facility.  See  syslog.conf(5)  for  valid  syslog
              facility names.
              (default "mail")
              Notes:  If  an  error  occurs  before options are read it may be
              logged to stderr. If  stdout  or  stderr  is  specified  as  the
              facility,  then  the  process  will not fork and detach from the
              terminal.

       -f, --config_file FILENAME:
              Name of config file to  read.   Command  line  options  override
              options set in config file.

              The default is derived as follows:

              The  sysconfig dir ("/etc/perdition" for example) is checked for
              <basename>.conf. If this is  found  then  it  is  used.   So  if
              perdition    is   invoked   as   /usr/sbin/perdition.pop3,   and
              /etc/perdition/perdition.pop3.conf exists then it will be  used.

              Next the sysconfig dir is checked for peridtion.<protocol>.conf,
              where protocol is the ASCII representation of the protocol being
              used,  one  of  "imap4",  "imap4s",  "pop3",  or "pop3s".  So if
              perdition    is    being    run    in    imap4     mode,     and
              /etc/perdition/perdition.imap4.conf  exists,  then  it  is used.
              Note that the protocol name is lowercase.

              Next the sysconfig dir is checked for perdition.conf, if  it  is
              found then it is used.

              If  none  of these files are found then no configuration file is
              used.

       -g, --group GROUP:
              Group to run as.
              (default "nobody")

       -h, --help:
              Display this message

       -I, --capability, --pop_capability, --imap_capability STRING:
              Capabilities for the protocol.

              When using a POP3 based protocol,  the  capabilities  should  be
              delimited  by  two  spaces.  This  is  because  the capabilities
              themselves may contain  single  spaces.  The  default  is  "UIDL
              USER".

              When  using  an  IMAP4 based protocol, this string is taken as a
              string literal that will be returned when a  client  issues  the
              CAPABILITY  command.  As  such  the capabilities should be space
              delimited.  The default is "IMAP4 IMAP4REV1". However, perdition
              does  support RFC 2088 non-synchronising string literals, if the
              real servers also support this then the capability may be set to
              "IMAP4 IMAP4REV1 LITERAL+".

              If   perdition   is  listening  for  TLS  connections  then  the
              capability STLS for POP3 or STARTTLS for IMAP4 will be  appended
              to  the  list  of  capabilities  if  it  is not already present.
              Similarly these capabilities will be removed from  the  list  of
              capabilities  if they are present and perdition is not listening
              for TLS connections.

              Perdition may also manipulate the capability in IMAP mode to add
              and   remove   the  LOGINDISABLED  capability  if  the  no_login
              capability  is  in  effect   or   if   the   ssl_mode   includes
              tls_listen_force or tls_outgoing_force.

       -i, --inetd_mode:
              Run in inetd mode

       -L, --connection_limit LIMIT:
              Maximum  number of connections to accept simultaneously. A value
              of zero sets no limit on the number of simultaneous connections.
              (default 0)

       -l, --listen_port PORT_NUMBER|PORT_NAME:
              Port to listen on.

              The  default  is 110, 995, 143 and 993 in POP3, POP3S, IMAP4 and
              IMAP4S mode respectively.

       --login_disabled:
              Do not allow users  to  log  in.   Also  adds  LOGINDISABLED  to
              capability list in IMAP4 and IMAP4S mode.

       --log_passwd STATE:
              Log the users password, otherwise just report it as "XXXXXX".
              (default "never")

              fail: log the password on failed connection attepmts.

              ok: log the password on successful connection attepmts.

              never: never log the password

              always: always log the password

       --lower_case state[,state...]:
              Convert  usernames  to  lower  case  according the the locale in
              given state(s).  See  A|add_domain  for  a  description  of  the
              states.
              (default "(null)")

       -M, --map_library FILENAME:
              Library  to  open  that provides functions to look up the server
              for a user. An empty ("") library means that no library will  be
              accessed and hence, no lookup will take place.
              (default "/usr/lib/libperditiondb_gdbm.so.0")

       -m, --map_library_opt STRING:
              String  option  to  pass to database access function provided by
              the  library  specified  by  the  map_library   directive.   The
              treatment   of   this   string   is   up  to  the  library.  See
              perditiondb(5) for more details of how individual  map_libraries
              handle this string.
              (default "")

       --no_daemon:
              Do  not detach from terminal. Makes no sense if inetd_mode is in
              effect.

       -n, --no_lookup:
              Disable host and port lookup,  implies  no_bind_banner.   Please
              note  that  if  this  option is enabled, then perdition will not
              resolve host or port names returned  by  popmap  lookups,  thus,
              your popmap must return ip addresses and port numbers.

       -O, --ok_line:
              Use  STRING  as the OK line to send to the client. Overridden by
              server_resp_line.  OK and will be prepended to  STRING,  and  in
              IMAP mode a tag will also be prepended to the string.
              (default "You are so in")

       --server_ok_line:
              This  option  is  deprecated  and  may  be  removed  in a future
              release.  Use server_resp_line instead.  If authentication  with
              the  real-server is successful then send the servers +OK line to
              the client, instead of generating one.

       -o, --server_resp_line:
              If authentication with the real-server is successful then
              send  the servers response line to the client, instead of
              generating one.

       -P, --protocol PROTOCOL:
              Protocol to use.
              (default  "POP3")  available  protocols:  "POP3,   POP3S,
              IMAP4, IMAP4S"

       -p, --outgoing_port PORT:
              Default real-server port.
              See listen_port for defaults.

       -s, --outgoing_server SERVER[,SERVER...]:
              Define  a  server  to use if a user is not in the popmap.
              Format  is   servername|ip_address[:portname|portnumber].
              Multiple  servers  may be delimited by a ’,’. If multiple
              servers are specified then they are used in a round robin
              fashion.
              (default "")

       --pid_file FILENAME:
              Path  for  pidfile.  Must  be a full path starting with a
              ’/’.  To allow perdition to remove the pid file after the
              owner  of  the perdition process is changed to a non-root
              user,  it  is  advised  to  specify  a  pid  file  in   a
              subdirectory  of  the system var state directory (usually
              /var/run). This subdirectory should  be  unique  to  this
              perdition  invocation  and  will  be created and have its
              owner  and  permissions  set  to   allow   perdition   to
              subsequently removed the pid file.
              Empty for no pid file. Not used in inetd mode.
              (default <var_state_dir>/<basename>/<basename>.pid)

       -S, --strip_domain STATE[,STATE]:
              Allow   USER  of  the  from  user<delimiter>domain  where
              <delimiter>domain  will   be   striped   off   in   given
              state(s).See  add_domain for a description of the states.

       -t, --timeout SECONDS:
              Idle timeout  for  post-authentication  phase.  Zero  for
              infinite timeout.
              (default 1800)

       -u, --username USERNAME:
              User to run as.
              (default "nobody")

       -U, --username_from_database:
              If  the  servername  in the popmap specified in the form:
              user<delimiter>domain then use the username given by  the
              servername.   If  a servername is given in this form then
              the domain will be used as  the  server  to  connect  to,
              regardless of this option.

       -q, --quiet:
              Only log errors. Overridden by debug

       --query_key FORMAT[,FORMAT...]:
              Instead  of  using  the  username  as supplied by the end
              user, possibly modified by strip_domain, use the  formats
              specified. The formats will be used in order to query the
              popmap. The result from the first successful lookup  will
              be   used.  The  format  is  comprised  of  a  string  of
              characters, delimited by ’,’. The following escape  codes
              are valid:

              \U: Long Username, the entire string supplied by
                  the end user, less any effects of
                  --strip_domain.
              \u: Short Username, the portion Long Username
                  before the domain delimiter.
              \D: Domain Delimiter, as specified by
                  --domain_delimiter
              \d: Domain the portion Long Username after the
                  domain delimiter.
              \i: Source IP address of the connection
              \I: Destination IP address of the connection
              \p: Source port of the connection
              \P: Destination port of the connection
              \\: Literal \

              As  a  ’,’  is  the  delimiter between formats, it cannot
              appear within a format. All other characters  other  than
              the  escape codes above, and ’,’ are treated as literals.

              Examples

              Use the supplied username, the default behaviour
              \U

              Use the user portion of the supplied  username,  if  this
              doesn’t  work  try  the  domain  portion  of the supplied
              username preceded by the domain delimiter
              \u,\D\d

              Use the destination IP address
              \I

              Escape codes interspersed with literals
              \u\da_domain,\da_domain

       The options below relate  to  SSL/TLS  support.   They  are  not
       available if perdition is compiled without SSL support.

       --ssl_mode MODE:
              Use  SSL  and  or  TLS  for the listening and/or outgoing
              connections.   A   comma   delimited   list   of:   none,
              ssl_listen,     ssl_outgoing,     ssl_all,    tls_listen,
              tls_outgoing,         tls_all,          tls_listen_force,
              tls_outgoing_force,  tls_all_force. TLS is defined in RFC
              2595.
              (default "(null)")

              none: Do not use SSL or TLS for any connections. This  is
              the same as providing no option, the default.

              ssl_listen:  When listening for incoming connections they
              will be treated as SSL connections.

              ssl_outgoing:  Use  SSL  to  connect  to  real   pop/imap
              servers.

              ssl_all: Short-Hand for ssl_listen,ssl_outgoing.

              tls_listen:  When listening for incoming connections they
              will be treated as TLS connections.

              tls_outgoing:  Use  TLS  to  connect  to  real   pop/imap
              servers.

              tls_all: Short-Hand for tls_listen,tls_outgoing.

              tls_listen_force:    Do    not    accept    plain    text
              authentication.   In   IMAP4   and   IMAP4S   mode,   the
              LOGINDISABLED  capability  until TLS has been initialised
              by the client issuing  a  STARTTLS.  In  all  modes  mode
              plain-text   authentication   is   ignored.    Also  sets
              tls_listen.

              tls_outgoing_force:   Do    not    send    authentication
              information  if  TLS  cannot  be  negotiated.   Also sets
              tls_outgoing.

              tls_all_force:               Short-Hand               for
              tls_listen_force,tls_outgoing_force.

       --ssl_ca_chain_file:
              Sets  the optional all-in-one file where you can assemble
              the certificates of Certification Authorities (CA)  which
              form  the  certificate  chain  of the server certificate.
              This starts  with  the  issuing  CA  certificate  of  the
              "ssl_cert_file"  certificate and can range up to the root
              CA certificate. Such a file is simply  the  concatenation
              of  the various PEM-encoded CA Certificate files, usually
              in certificate chain  order.  Overrides  ssl_ca_file  and
              ssl_ca_path.
              (default NULL, no CA certificate will be used)

       --ssl_ca_file FILENAME:
              Certificate    Authorities    to   use   when   verifying
              certificates of  real  servers.   Used  for  SSL  or  TLS
              outgoing  connections.   When  building  the  Certificate
              Authorities chain, ssl_ca_file is used first, if set, and
              then        ssl_ca_path,        if        set.        See
              SSL_CTX_load_verify_locations(3) for format details.
              (default "/etc/perdition/perdition.ca.pem")

       --ssl_ca_path PATHNAME:
              Certificate   Authorities   to   use    when    verifying
              certificates  of  real  servers.   Used  for  SSL  or TLS
              outgoing connections.  "openssh c_rehash" should  be  run
              in  this directory when new certificates are added.  When
              building the Certificate Authorities  chain,  ssl_ca_file
              is used first, if set, and then ssl_ca_path, if set.  See
              SSL_CTX_load_verify_locations(3) for details.
              (default "/etc/perdition/perdition.ca/")

       --ssl_ca_accept_self_signed:
              Accept self-signed certificate authorities.

       --ssl_cert_file FILENAME:
              Certificate  to  use  when  listening  for  SSL  or   TLS
              connections.  Should be in PEM format.
              (default "/etc/perdition/perdition.crt.pem")

       --ssl_cert_accept_self_signed:
              Accept  self-signed  certificates.   Used  for SSL or TLS
              outgoing connections.

       --ssl_cert_accept_expired:
              Accept  expired  certificates.   This   includes   server
              certificates   and  certificate  authority  certificates.
              Used for SSL or TLS outgoing connections.

       --ssl_cert_accept_not_yet_valid:
              Accept certificates that are not yet valid. This includes
              server    certificates    and    certificate    authority
              certificates.  Used for SSL or TLS outgoing  connections.

       --ssl_cert_verify_depth DEPTH:
              Chain  Depth  to  recurse to when verifying certificates.
              Used for SSL or TLS outgoing connections.
              (default 9)

       --ssl_key_file FILENAME:
              Public  key  to  use  when  listening  for  SSL  or   TLS
              connections.  Should be in PEM format.
              (default "/etc/perdition/perdition.key.pem")

       --ssl_listen_ciphers STRING:
              Cipher  list when listening for SSL or TLS connections as
              per ciphers(1). If empty ("") then openssl’s default will
              be used.
              (default "")

       --ssl_outgoing_ciphers STRING:
              Cipher  list  when making outgoing SSL or TLS connections
              as per ciphers(1). If empty ("") then  openssl’s  default
              will be used.
              (default "")

       --ssl_no_cert_verify:
              Don’t    cryptographically   verify   the   real-server’s
              certificate.  Used for SSL or TLS outgoing connections.

       --ssl_no_cn_verify:
              Don’t verify the real-server’s common name with the  name
              used.   to  connect  to  the  server. Used for SSL or TLS
              outgoing connections.

       Notes: Default value for binary flags is off.
              If a string argument is empty ("") then the  option  will
              not be used unless noted otherwise.
              The  defaults  given  refer to the values if perdition is
              compiled with --sysconfdir=/etc  as  it  would  for  many
              binary  distributions. For the actual defaults of a given
              perdition binary run "perdition --help"

USER DATABASE (POPMAP)

       For information on mechanisms for resolving users to a host  and
       port    and    information    on    the   -M|--map_library   and
       -m|--map_library_opt flags, please see perditiondb(5).

       Note that by specifying an map library no map lookups will occur
       and  all  connections will use the -s|--outgoing_server. In this
       way perdition can be configured as a "pure proxy".

STAND-ALONE MODE

       Normally  perdition  will  bind  to  a  port,  and  listen   for
       connections.   The  default  port is 110 in POP3 mode and 143 in
       IMAP4  mode,  an  alternate  port  can  be  specified  with  the
       -l|--listen_port  command  line  option.  In this mode perdition
       will fork to manage clients.

       Stand-Alone Mode: Debian and RPM Installation

       In the Debian and RPM distributions perdition can be started and
       stopped in stand-alone mode using:

       /etc/init.d/perdition start
       /etc/init.d/perdition stop

       Editing /etc/sysconfig/perdition (RPM) or /etc/default/perdition
       (Debian) allows control of whether perdition will be started  in
       POP3 mode, IMAP4 mode or both (or neither).

       The syntax for this file is:

       RUN_PERDITION=[yes|no]
       FLAGS="flags"
       POP3=[yes|no]
       POP3_FLAGS="flags"
       POP3S=[yes|no]
       POP3S_FLAGS="flags"
       IMAP4=[yes|no]
       IMAP4_FLAGS="flags"
       IMAP4S=[yes|no]
       IMAP4S_FLAGS="flags"

       The  file  is sourced into the init script so normal bash syntax
       applies. Blank lines are ignored, as is anything after a # on  a
       line.

       e.g.

       RUN_PERDITION=yes
       POP3=on
       POP3_FLAGS="--ssl_mode tls_listen"
       POP3S=on
       IMAP4_FLAGS="--ssl_mode tls_listen"
       IMAP4=on
       POP3S_FLAGS="--ssl_mode ssl_listen -p 110"
       IMAP4S=on
       IMAP4S_FLAGS="--ssl_mode ssl_listen -p 143"

INETD MODE

       Perdition  can  be  used in conjunction with inetd. This enables
       perdition to benefit from tcpd where access can be controlled to
       some  extent using /etc/hosts.allow and /etc/hosts.deny.  Sample
       /etc/inetd.conf entries follow:

       pop3      stream     tcp     nowait     root      /usr/sbin/tcpd
       /usr/sbin/perdition.pop3 -i
       pop3s      stream     tcp     nowait     root     /usr/sbin/tcpd
       /usr/sbin/perdition.pop3s -i
       imap2     stream     tcp     nowait     root      /usr/sbin/tcpd
       /usr/sbin/perdition.imap4 -i
       imaps      stream     tcp     nowait     root     /usr/sbin/tcpd
       /usr/sbin/perdition.imap4s -i

       inetd should then be restarted

LOCAL AUTHENTICATION

       If perdition has been compiled against libpam, it may  be set up
       to authenticate the user locally once the USER and PASS commands
       are entered by specifying the -a|--authenticate_in option on the
       command  line. This authentication happens before the connection
       to the foreign server is made and must succeed for a  connection
       to the foreign server to be made.

       This authentication uses PAM and a sample pam configuration file
       for perdition can be found in etc/pam.d/perdition in the  source
       tree. This should be dropped into /etc/pam.d.

DOMAIN DELIMITER

       A  multi  character  domain  delimiter  can  be  set  using  the
       -d|--domain delimiter option. This sets the  delimiter  used  in
       conjunction       with       the      -S|--strip_domain      and
       -c|--client_server_specification options.

USER PORT SPECIFICATION

       If       perdition       is       invoked        with        the
       -c|--client_server_specification   flag   then   the   user  may
       optionally specify the server and  port  that  perdition  should
       connect     to    for    the    client    using    the    syntax
       user<delimiter>host[:port].

       Example:
       IMAP4

       0 login henry@that.host:143

       POP3

       user james@other.host

IDLE TIMEOUTS

       Perdition  allows  two   idle   timeouts   to   be   configured.
       --authentication_timeout  is  used  before  the  user  has  been
       successfully authenticated with the back-end server.  And  after
       that --timeout is used.

       The default value for both timeouts is is 1800.  A timeout value
       of 0 means that  the  timeouts  are  disabled  and  clients  and
       back-end servers can idle indefinitely, though in practice a TCP
       timeout will be in effect.

LOOP DETECTION

       The greeting that perdition displays when accepting an  incoming
       connection  is  "+OK POP3 Ready <hostname>" or "* OK IMAP4 Ready
       <hostname>" in  POP3  and  IMAP4  modes  respectively.  If  when
       perdition  connects  to  the back-end server the greeting string
       matches the greeting string of the perdition process making  the
       connection  then  it  is assumed that perdition is connecting to
       itself and a "Re-Authentication  Failure"  is  returned  to  the
       client.

CONFIGURATION FILE

       The format of a line of the configuration file is:

       <key> <value>

       Key is either a short or long option as per perdition -h|--help,
       without the leading - or --.  Blank lines  are  ignored,  as  is
       anything  including  and  after  a  #  (hash)  on a line. If a \
       precedes a new line then the lines will be concatenated.  IF a \
       precedes  any  other  character, including a # (hash) it will be
       treated as a literal. Anything inside single quotes (’) will  be
       treated  as  a  literal. Anything other than a (’) inside double
       quotes (") will be treated as a literal. Whitespace in keys must
       be  escaped  or quoted. Whitespace in values need not be escaped
       or quoted.

       Options that do not make sense in the configuration file such as
       h|help  and f|config_file  are ignored. Options specified on the
       command line override the options in this file.

       Example configuration File.
       # perdition.conf
       l           110             #Short option used as key
       group       mail            #Long option used as key
       a                           #Option with no argument

POP BEFORE SMTP

       Perdition supports POP before SMTP in both POP3 and  IMAP4  mode
       by logging having logging the following messages:

       When a user connects:

       Connect: <source_ip_address>[inetd_pid=<pid>]

       When a user is authenticated

       Auth:            <source_ip_address>           user="<username>"
       passwprd="<passwowd>"    server="<servername">     port="<port>"
       status=failed...|ok

       When a user disconnects

       Close:  <source_ip_address>  user="<username>"  received=<bytes>
       sent=<bytes>

LOGGING

       By default, logs are logged via syslog using the facility  mail.
       You should inspect /etc/syslog.conf to find where these logs are
       written.   Under  Debian  these  logs   will   be   written   to
       /var/log/mail.log,  under Red Hat 7.x these logs will be written
       to /var/log/maillog, under Solaris 8 these logs will be  written
       to   /var/log/syslog.   Normally  each  session  will  have  two
       perdition log entries.  Logs are prepended, depending on  syslog
       with the date, host, and perdition[<pid>]: .

       Fatal  errors  are  also  logged  with  a  priority  of  err. In
       stand-alone  mode  the  startup   parameters   are   logged   on
       initialisation.   If  the  -d|--debug  command  line  option  or
       configuration file directive is used then startup parameters are
       logged  regardless of other configuration directives and in both
       stand-alone and identd mode additional  debugging  messages  are
       logged  with  a  priority of debug. As the flag implies, this is
       useful for debugging but is probably too verbose for  production
       systems.  If the -q|--quiet command line option or configuration
       file directive is used, only errors  will  be  logged.  This  is
       overridden by -d|--debug.

SSL/TLS Support

       Perdition  supports  using  SSLv2  and SSLv3 to encrypt sessions
       between end users and perdition and sessions  between  perdition
       and  real  servers.  SSL may be used for either, both or none of
       these classes of connections.

       The public key and certificate files should be  in  PEM  format.
       As  a quick guide, the files may be generated using openssl with
       the following command:

       openssl req -new -x509 -nodes \
         -out perdition.crt.pem -keyout perdition.key.pem -days 365

FILES

       /etc/perdition/perdition.conf

SEE ALSO

       perditiondb(5), inetd(8), syslog.conf(5), syslogd(8)

AUTHORS

       Lead
       Horms <horms@verge.net.au>

       Perditiondb Library Authors
       Frederic Delchambre <dedel@freegates.be>      (MySQL)
       Chris Stratford: <chriss@uk.uu.net>           (LDAP and Berkeley
       DB)
       Nathan Neulinger <nneul@umr.edu>              (NIS)

       Contributing Authors
       Daniel Roesen <droesen@entire-systems.com>
       Clinton Work <work@scripty.com>
       Youri <ya@linkline.be>
       Jeremy Nelson <jnelson@optusnet.com.au>
       Wim Bonis <bonis@solution-service.de>
       Arvid Requate <arvid@Team.OWL-Online.DE>
       Mikolaj J. Habryn <dichro@rcpt.to>
       Ronny Cook <ronny@asiaonline.net>
       Geoff Mitchell <g.mitchell@videonetworks.com>
       Willi Langenberger <wlang@wu-wien.ac.at>
       Matt Prigge <mprigge@pobox.com>
       Wolfgang Breyha <wolfgang.breyha@uta.at>

                                12th June 2003