1.\" $OpenBSD: bgplgsh.8,v 1.12 2019/03/17 10:43:24 jmc Exp $ 2.\" 3.\" Copyright (c) 2005, 2006 Reyk Floeter <reyk@openbsd.org> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: March 17 2019 $ 18.Dt BGPLGSH 8 19.Os 20.Sh NAME 21.Nm bgplgsh 22.Nd looking glass shell for the OpenBSD Border Gateway Protocol daemon 23.Sh SYNOPSIS 24.Nm bgplgsh 25.Sh DESCRIPTION 26The 27.Nm 28program is a looking glass shell for the 29.Xr bgpd 8 30Border Gateway Protocol daemon. 31The looking glass will provide a simple command line interface 32with read-only access to a restricted set of 33.Xr bgpd 8 34and system status information, which is typically used on route 35servers by Internet Service Providers (ISPs) and Internet eXchange 36points (IXs). 37.Pp 38It requires three steps to enable the looking glass shell: 39.Bl -enum 40.It 41Add 42.Nm 43as a valid login shell. 44See 45.Xr shells 5 46for more information. 47.Bd -literal -offset indent 48# echo /usr/bin/bgplgsh \*(Gt\*(Gt /etc/shells 49.Ed 50.It 51Create a new user for restricted looking glass access. 52See 53.Xr adduser 8 54for more information about system user management. 55.Bd -literal -offset indent 56# adduser -shell bgplgsh -batch bgplg 57# passwd bgplg 58.Ed 59.It 60Start the Border Gateway Protocol daemon with a second, 61restricted, control socket. 62See 63.Xr bgpd.conf 5 64and 65.Xr bgplg 8 66for more information. 67.Pp 68For example, 69add the following to 70.Pa /etc/bgpd.conf 71to have 72.Xr bgpd 8 73open a second, restricted, control socket: 74.Pp 75.Dl socket \&"/var/www/run/bgpd.rsock\&" restricted 76.El 77.Sh FILES 78.Bl -tag -width "/var/www/run/bgpd.rsockXX" -compact 79.It Pa /var/www/run/bgpd.rsock 80Position of the second, restricted, control socket of 81.Xr bgpd 8 . 82.El 83.Sh SEE ALSO 84.Xr bgpd 8 , 85.Xr bgplg 8 86.Sh HISTORY 87The 88.Nm 89program first appeared in 90.Ox 4.1 . 91The initial implementation was done in 2005 for DE-CIX, the German 92commercial internet exchange point. 93.Sh AUTHORS 94The 95.Nm 96program was written by 97.An Reyk Floeter Aq Mt reyk@openbsd.org . 98.Sh CAVEATS 99To prevent commands from running endlessly, 100.Nm 101will kill the corresponding processes after a hard limit of 60 seconds. 102For example, this can take effect when using 103.Xr traceroute 8 104with blackholed or bad routes. 105