Network UPS Tools User Manual

Network UPS Tools User Manual 39 / 84
LISTEN 127.0.0.1
LISTEN 192.168.50.1
LISTEN ::1
LISTEN 2001:0db8:1234:08d3:1319:8a2e:0370:7344
This parameter will only be read at startup. You’ll need to restart (rather than reload) upsd to apply any changes made here.
9.4.2 Firewall
NUT has its own official IANA port: 3493/tcp.
The upsmon process on slave systems, as well as any other NUT client (such as upsc, upscmd, upsrw, NUT-Monitor, . . . )
connects to the upsd process on the master system via this TCP port. The upsd process does not connect out.
You should use this to restrict network access.
Uncomplicated Firewall (UFW) support
NUT can tightly integrate with Uncomplicated Firewall using the provided profile (nut.ufw.profile).
You must first install the profile on your system:
$ cp nut.ufw.profile /etc/ufw/applications.d/
To enable outside access to your local upsd, use:
$ ufw allow NUT
To restrict access to the network 192.168.X.Y, use:
$ ufw allow from 192.168.0.0/16 to any app NUT
You can also use graphical frontends, such as gui-ufw (gufw), ufw-kde or ufw-frontends.
For more information, refer to:
• UFW homepage,
• UFW project page,
• UFW wiki,
• UFW manual page, section APPLICATION INTEGRATION
9.4.3 TCP Wrappers
If the server is build with tcp-wrappers support enabled, it will check if the NUT username is allowed to connect from the client
address through the /etc/hosts.allow and /etc/hosts.deny files.
Note
this will only be done for commands that require the user to be logged into the server.
hosts.allow:
ups : admin@127.0.0.1/32
ups : monslave@127.0.0.1/32 monslave@192.168.1.0/24
hosts.deny:
upsd : ALL
Further details are described in hosts_access(5).