1.\" $NetBSD: inetd.8,v 1.68 2024/05/24 21:55:13 andvar Exp $ 2.\" 3.\" Copyright (c) 1998 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 8.\" NASA Ames Research Center. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29.\" POSSIBILITY OF SUCH DAMAGE. 30.\" 31.\" Copyright (c) 1985, 1991 The Regents of the University of California. 32.\" All rights reserved. 33.\" 34.\" Redistribution and use in source and binary forms, with or without 35.\" modification, are permitted provided that the following conditions 36.\" are met: 37.\" 1. Redistributions of source code must retain the above copyright 38.\" notice, this list of conditions and the following disclaimer. 39.\" 2. Redistributions in binary form must reproduce the above copyright 40.\" notice, this list of conditions and the following disclaimer in the 41.\" documentation and/or other materials provided with the distribution. 42.\" 3. Neither the name of the University nor the names of its contributors 43.\" may be used to endorse or promote products derived from this software 44.\" without specific prior written permission. 45.\" 46.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 47.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 48.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 49.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 50.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 51.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 52.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 53.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 54.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 55.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 56.\" SUCH DAMAGE. 57.\" 58.\" from: @(#)inetd.8 8.4 (Berkeley) 6/1/94 59.\" 60.Dd October 12, 2021 61.Dt INETD 8 62.Os 63.Sh NAME 64.Nm inetd , 65.Nm inetd.conf 66.Nd internet 67.Dq super-server 68.Sh SYNOPSIS 69.Nm 70.Op Fl d 71.Op Fl l 72.Op Ar configuration file 73.Sh DESCRIPTION 74.Nm 75should be run at boot time by 76.Pa /etc/rc 77(see 78.Xr rc 8 ) . 79It then opens sockets according to its configuration and listens 80for connections. 81When a connection is found on one of its sockets, it decides what 82service the socket corresponds to, and invokes a program to service 83the request. 84After the program is finished, it continues to listen on the socket 85(except in some cases which will be described below). 86Essentially, 87.Nm 88allows running one daemon to invoke several others, 89reducing load on the system. 90.Pp 91The options available for 92.Nm : 93.Bl -tag -width Ds 94.It Fl d 95Turns on debugging and runs 96.Nm 97in the foreground. 98.It Fl f 99Runs 100.Nm 101in the foreground. 102.It Fl l 103Turns on libwrap connection logging. 104.El 105.Pp 106Upon execution, 107.Nm 108reads its configuration information from a configuration 109file which, by default, is 110.Pa /etc/inetd.conf . 111The path given for this configuration file must be absolute, unless 112the 113.Fl d 114option is also given on the command line. 115.Pp 116Services can be specified using the legacy `positional' notation or the 117`key-values' notation described in the sections 118.Sx Positional Notation 119and 120.Sx Key-Values Notation 121below. 122.Ss Positional Notation 123There must be an entry for each field of the configuration 124file, with entries for each field separated by a tab or 125a space. 126Comments are denoted by a ``#'' at the beginning of a line (see subsection 127.Sx Key-Values Notation 128for defining comments in key-values definitions). 129There must be an entry for each field (except for one 130special case, described below). 131A positional definition is terminated by a newline. 132The fields of the configuration file are as follows: 133.Pp 134.Bd -unfilled -offset indent -compact 135[listen-addr:]service-spec 136socket-type[:accept-filter] 137protocol[,sndbuf=size][,rcvbuf=size] 138wait/nowait[:max] 139user[:group] 140server-program 141server program arguments 142.Ed 143.Pp 144The 145.Em listen-addr 146parameter specifies the local address 147.Nm 148should use when listening. 149The single character 150.Dq \&* 151means 152.Dv INADDR_ANY : 153all local addresses. 154The 155.Em listen-addr 156parameter may be a host name, which will be resolved once, when the service 157definition is read from the config file. 158.Pp 159Note that restricted listen addresses are meaningless and ignored for 160UNIX-domain services, and are not supported for 161.Em Sun-RPC 162services. 163All 164.Em Sun-RPC 165services always listen on all interfaces. 166.Pp 167The form of the 168.Em service-spec 169parameter varies with the service type. 170For Internet services, the 171.Em service-spec 172parameter can be either the name of a service from 173.Pa /etc/services 174or a decimal port number. 175For 176.Dq internal 177services (discussed below), the service name 178.Em must 179be the official name of the service (that is, the first entry in 180.Pa /etc/services ) 181and not an alias for it. 182.Pp 183For 184.Em Sun-RPC 185based services, the 186.Em service-spec 187parameter has the form 188.Em service-name Ns Li / Ns Em version . 189The service name must be a valid RPC service name from 190the file 191.Pa /etc/rpc . 192The 193.Em version 194on the right of the 195.Dq / 196is the RPC version number. 197This can simply be a single numeric argument or a range of versions. 198A range is bounded by the low version to the high version, e.g. 199.Dq rusers/1-3 . 200.Pp 201For UNIX-domain (local) services, the 202.Em service-spec 203parameter is the path name to listen on. 204.Pp 205The 206.Em service-spec 207parameter must not begin with a dot. 208See 209.Sx Directives . 210.Pp 211The 212.Em socket-type 213parameter should be one of 214.Dq stream , 215.Dq dgram , 216.Dq raw , 217.Dq rdm , 218or 219.Dq seqpacket , 220depending on whether the socket is a stream, datagram, raw, 221reliably delivered message, or sequenced packet socket. 222.Pp 223Optionally, for Internet services, an accept filter 224(see 225.Xr accept_filter 9 ) 226can be specified by appending a colon to 227.Em socket-type , 228followed by the name of the desired accept filter. 229In this case 230.Nm 231will not see new connections for the specified service until the accept 232filter decides they are ready to be handled. 233.\" XXX: do accept filters work for AF_UNIX sockets? nobody probably 234.\" cares, but... 235.Pp 236The 237.Em protocol 238parameter must be a valid protocol as given in 239.Pa /etc/protocols 240or (for UNIX-domain services) the string 241.Dq unix . 242The most common are 243.Dq tcp 244and 245.Dq udp . 246For TCP and UDP, the IP version (4 or 6) may be specified explicitly 247by appending 4 or 6 to the protocol name. 248Otherwise the default version (IPv4) is used. 249For 250.Em Sun-RPC 251the string 252.Dq rpc 253and a slash should be prepended: 254.Dq rpc/tcp 255or 256.Dq rpc/udp . 257If you would like to enable special support for 258.Xr faithd 8 , 259prepend the string 260.Dq faith 261and a slash: 262.Dq faith/tcp6 . 263.Pp 264In addition to the protocol, the configuration file may specify the 265send and receive socket buffer sizes for the listening socket. 266This is especially useful for 267.Tn TCP : 268the window scale factor, which is based on the receive socket 269buffer size, is advertised when the connection handshake occurs 270and thus the socket buffer size must be set on the listen socket. 271By increasing the socket buffer sizes, better 272.Tn TCP 273performance may be realized in some situations. 274The socket buffer sizes are specified by appending their values to 275the protocol specification as follows: 276.Bd -literal -offset indent 277tcp,rcvbuf=16384 278tcp,sndbuf=64k 279tcp,rcvbuf=64k,sndbuf=1m 280.Ed 281.Pp 282A literal value may be specified, or modified using 283.Sq k 284to indicate kibibytes or 285.Sq m 286to indicate mebibytes. 287Socket buffer sizes may be specified for all 288services and protocols except for tcpmux services. 289.Pp 290The 291.Em wait/nowait 292entry is used to tell 293.Nm 294if it should wait for the server program to return, 295or continue processing connections on the socket. 296If a datagram server reads a single datagram and connects 297to its peer through a different socket, freeing the service's socket so 298.Nm 299can receive further messages on the socket, it is said to be 300a 301.Dq multi-threaded 302server, and should use the 303.Dq nowait 304entry. 305For datagram servers which process all incoming datagrams 306on a socket and eventually time out, the server is said to be 307.Dq single-threaded 308and should use a 309.Dq wait 310entry. 311.Xr comsat 8 312.Pq Xr biff 1 313and 314.Xr ntalkd 8 315are both examples of the latter type of 316datagram server. 317.Xr tftpd 8 318is an exception; it is a datagram server that establishes pseudo-connections. 319It must be listed as 320.Dq wait 321in order to avoid a race; 322the server reads the first packet, creates a new socket, 323and then forks and exits to allow 324.Nm 325to check for new service requests to spawn new servers. 326The optional 327.Dq max 328suffix (separated from 329.Dq wait 330or 331.Dq nowait 332by a dot or a colon) specifies the maximum number of server instances that may 333be spawned from 334.Nm 335within an interval of 60 seconds. 336When omitted, 337.Dq max 338defaults to 40. 339If it reaches this maximum spawn rate, 340.Nm 341will log the problem (via the syslogger using the 342.Dv LOG_DAEMON 343facility and 344.Dv LOG_ERR 345level) 346and stop handling the specific service for ten minutes. 347.Pp 348Stream servers are usually marked as 349.Dq nowait 350but if a single server process is to handle multiple connections, it may be 351marked as 352.Dq wait . 353The master socket will then be passed as fd 0 to the server, which will then 354need to accept the incoming connection. 355The server should eventually time 356out and exit when no more connections are active. 357.Nm 358will continue to 359listen on the master socket for connections, so the server should not close 360it when it exits. 361.Xr identd 8 362is usually the only stream server marked as wait. 363.Pp 364The 365.Em user 366entry should contain the user name of the user as whom the server should run. 367This allows for servers to be given less permission than root. 368Optionally, a group can be specified by appending a colon to the user name, 369followed by the group name (it is possible to use a dot (``.'') in lieu of a 370colon, however this feature is provided only for backward compatibility). 371This allows for servers to run with a different (primary) group id than 372specified in the password file. 373If a group is specified and 374.Em user 375is not root, the supplementary groups associated with that user will still be 376set. 377.Pp 378The 379.Em server-program 380entry should contain the pathname of the program which is to be 381executed by 382.Nm 383when a request is found on its socket. 384If 385.Nm 386provides this service internally, this entry should 387be 388.Dq internal . 389.Pp 390The 391.Em server program arguments 392should be just as arguments 393normally are, starting with argv[0], which is the name of 394the program. 395If the service is provided internally, the 396word 397.Dq internal 398should take the place of this entry. 399It is possible to quote an argument using either single or double quotes. 400This allows you to have, e.g., spaces in paths and parameters. 401.Ss Key-Values Notation 402In key-values notation, keys are separated from their associated values by `=', 403values are separated by whitespace, and key-values options are separated by 404commas. 405A service definition is terminated by a semicolon. 406Multiple definitions may exist on a single line (and a line may 407end with a positional definition. 408A key-values definition has the following form: 409.Bd -filled -offset indent 410[listen-addr:]service-spec {on|off} <option> = [value1], 411<option> = [value1] [value2] ..., <option> =, ...; 412.Ed 413.Pp 414Values may be in quotes, and support the following escape sequences. 415.Bl -hang -width "\xXX" -offset indent 416.It Sy \e\e 417Backslash. 418.It Sy \en 419Line feed. 420.It Sy \et 421Tab. 422.It Sy \er 423Carriage return. 424.It Sy \e' 425Single quote. 426.It Sy \e" 427Double quote. 428.It Sy \exXX 429Hexadecimal byte value, replace XX. 430.El 431.Pp 432.Em [listen-addr:]service-spec 433has the same form as in positional notation. If 434.Em service-spec 435is followed by 436.Em on 437then the service definition is active by default. 438If 439.Em service-spec 440is followed by 441.Em off 442then the service definition is parsed and errors are output to 443the system log, but the service is not active and no sockets are created. 444.Pp 445Comments that exist between the initial on/off directive 446and the closing semicolon may begin in any column and may exist on the same line 447as non-comment text. 448Note: editor syntax highlighting may be misleading! 449.Pp 450Syntax and semantic error detection is performed on a best-effort basis. 451If an error with a service definition is easily detectable, it will 452log the error using 453.Xr syslog 3 454and continue reading the configuration file if possible, skipping the erroneous 455definition or file. 456Otherwise, it is up to the user to write definitions that conform to the 457documentation. 458Errors may be worded differently depending on the ordering of 459options in the service definition. 460.Pp 461The following are the available values for 462.Em <option>: 463.Bl -hang -width "acceptfilter" 464.It Sy bind 465Set the listen address for this service. 466This can be an IPv4 or IPv6 address or a hostname. 467.It Sy socktype 468Equivalent to 469.Em socket-type 470in positional notation. 471.Em socktype 472is optional if 473.Em protocol 474is specified and is 475.Li udp{4,6} 476or 477.Li tcp{4,6} . 478.It Sy acceptfilter 479An accept filter, equivalent to 480.Em accept 481in positional notation (see 482.Xr accept_filter 9 483and 484.Dv SO_ACCEPTFILTER 485in 486.Xr setsockopt 2 ) . 487.It Sy protocol 488Equivalent to 489.Em protocol 490in positional notation. 491If specified as 492.Li tcp 493or 494.Li udp 495with no version specifier, the associated hostname or 496.Em bind 497value is used to determine the IP version. 498If the version is not specified and the hostname string or 499.Em bind 500value is not an IPv4 or IPv6 address, the service definition is 501invalid. 502.It Sy sndbuf 503Equivalent to 504.Em sndbuf 505in positional notation. 506.It Sy recvbuf 507Equivalent to 508.Em recvbuf 509in positional notation. 510.It Sy wait 511The value 512.Li yes 513or 514.Li no . 515Equivalent to 516.Em wait/nowait 517in positional notation. 518This option is automatically determined for internal 519services, and is mandatory for all others. 520.It Sy service_max 521Equivalent to 522.Em max 523in positional notation. 524Defaults to 40 if not specified. 525.It Sy ip_max 526Specifies the maximum number of server instances that may be spawned from 527.Nm 528within an interval of 60 seconds for a given IP address. 529Other address types may also work if supported by 530.Xr getnameinfo 3 , 531test thoroughly using 532.Fl d . 533For example, connections from unnamed Unix sockets 534do not work, but connections from named Unix sockets may work. 535However, there is no way to only accept named Unix sockets. 536.It Sy user 537The user to run the program as. 538Equivalent to 539.Em user 540in positional notation. 541.It Sy group 542The primary group to run the program as. 543Equivalent to 544.Em group 545in positional notation. 546.It Sy exec 547The path to the program's executable or 548.Dq internal 549for a built-in service. 550If not specified, this will be assumed to be 551.Dq internal 552(and will fail if 553.Em socktype 554is not specified). 555.It Sy args 556The program arguments. 557By convention, the first argument should be the name of the program. 558.It Sy ipsec 559An IPsec policy string. 560Defaults to the global default setting. 561If specified without a value (i.e., 562.Dq ipsec=, ) , 563IPsec will be disabled for this service. 564See the 565.Sx Directives 566section for details. 567Currently only one value is allowed, so all IPsec policies 568should be in a quoted string, separated by semicolons. 569.El 570.Ss Directives 571<listen-addr>: 572.Pp 573To avoid the need to repeat listen addresses over and over again, 574listen addresses are inherited from line to line, and the listen 575address can be changed without defining a service by including a line 576containing just a 577.Em listen-addr 578followed by a colon. 579The default (compatible with historical configuration files) is \&*. 580To return to this behavior after configuring some services with 581specific listen addresses, give \&* explicitly. 582.Pp 583.Li "#@" 584[<IPsec policy>] [; [<IPsec policy>]] ... 585.Pp 586The implementation includes a tiny hack to support IPsec policy settings for 587each socket. 588A special form of the comment line, starting with 589.Dq Li "#@" , 590is used as a policy specifier. 591The content of the above comment line will be treated as a IPsec policy string, 592as described in 593.Xr ipsec_set_policy 3 . 594Multiple IPsec policy strings may be specified by using a semicolon 595as a separator. 596If conflicting policy strings are found in a single line, 597the last string will take effect. 598IPsec policy strings are not parsed in 599comments within a key-values service definition. 600A 601.Li "#@" 602line affects all of the subsequent lines in the same config file, 603so you may want to reset the IPsec policy by using a comment line containing 604only 605.Li "#@" 606.Pq with no policy string . 607.Pp 608If an invalid IPsec policy string appears in a config file, 609.Nm 610logs an error message using 611.Xr syslog 3 612and stops reading the current config file, but may continue reading 613from other files not affected by the IPsec directive. 614.Pp 615\&.include <glob-path> 616.Pp 617Other files can be read by inetd by specifying an include directive in an inetd 618config file. 619.Em glob-path 620is an 621absolute path or a path relative (including parent directories) to the directory 622containing the current config 623file, and may contain glob patterns as specified by 624.Xr glob 7 . 625.Pp 626To include a specific file, include the relative or absolute path of the file. 627To include all files in a directory, 628.Em glob-path 629should be the directory of the files to include followed by "/*". 630.Pp 631The listening address and IPsec configuration strings of the current config file 632are inherited by files included by this directive. 633.Pp 634Files included by this directive using a glob path match are not read in a 635specific order. 636If a specific order is desired, files or directories should be 637included individually without the use of glob patterns. 638Behavior is undefined if 639multiple include directives include the same file and 640this should be avoided. 641Circular references are caught by 642.Nm . 643Anything after 644.Em glob-path 645on the same line is ignored. 646.Em glob-path 647may be in quotes. 648.Ss Internal Services 649.Nm 650provides several 651.Qq trivial 652services internally by use of routines within itself. 653These services are 654.Qq echo , 655.Qq discard , 656.Qq chargen 657(character generator), 658.Qq daytime 659(human readable time), and 660.Qq time 661(machine readable time, 662in the form of the number of seconds since midnight, January 1, 1900 GMT). 663For details of these services, consult the appropriate 664.Tn RFC . 665.Pp 666TCP services without official port numbers can be handled with the 667RFC1078-based tcpmux internal service. 668TCPmux listens on port 1 for requests. 669When a connection is made from a foreign host, the service name 670requested is passed to TCPmux, which performs a lookup in the 671service name table provided by 672.Pa /etc/inetd.conf 673and returns the proper entry for the service. 674TCPmux returns a negative reply if the service doesn't exist, 675otherwise the invoked server is expected to return the positive 676reply if the service type in 677.Pa /etc/inetd.conf 678file has the prefix 679.Qq tcpmux/ . 680If the service type has the 681prefix 682.Qq tcpmux/+ , 683TCPmux will return the positive reply for the 684process; this is for compatibility with older server code, and also 685allows you to invoke programs that use stdin/stdout without putting any 686special server code in them. 687Services that use TCPmux are 688.Qq nowait 689because they do not have a well-known port number and hence cannot listen 690for new requests. 691.Pp 692.Nm 693rereads its configuration file when it receives a hangup signal, 694.Dv SIGHUP . 695Services may be added, deleted or modified when the configuration file 696is reread. 697.Nm 698creates a file 699.Em /var/run/inetd.pid 700that contains its process identifier. 701.Ss libwrap 702Support for 703.Tn TCP 704wrappers is included with 705.Nm 706to provide internal tcpd-like access control functionality. 707An external tcpd program is not needed. 708You do not need to change the 709.Pa /etc/inetd.conf 710server-program entry to enable this capability. 711.Nm 712uses 713.Pa /etc/hosts.allow 714and 715.Pa /etc/hosts.deny 716for access control facility configurations, as described in 717.Xr hosts_access 5 . 718.Pp 719.Em Nota Bene : 720.Tn TCP 721wrappers do not affect/restrict 722.Tn UDP 723or internal services. 724.Ss IPv6 TCP/UDP behavior 725If you wish to run a server for both IPv4 and IPv6 traffic, 726you will need to run two separate processes for the same server program, 727specified as two separate lines in 728.Pa /etc/inetd.conf 729using 730.Dq tcp4 731and 732.Dq tcp6 733respectively. 734In positional syntax, plain 735.Dq tcp 736means TCP on top of the current default IP version, 737which is, at this moment, IPv4. 738.Pp 739Under various combination of IPv4/v6 daemon settings, 740.Nm 741will behave as follows: 742.Bl -bullet -compact 743.It 744If you have only one server on 745.Dq tcp4 , 746IPv4 traffic will be routed to the server. 747IPv6 traffic will not be accepted. 748.It 749If you have two servers on 750.Dq tcp4 751and 752.Dq tcp6 , 753IPv4 traffic will be routed to the server on 754.Dq tcp4 , 755and IPv6 traffic will go to server on 756.Dq tcp6 . 757.It 758If you have only one server on 759.Dq tcp6 , 760only IPv6 traffic will be routed to the server. 761The kernel may route to the server IPv4 traffic as well, 762under certain configuration. 763See 764.Xr ip6 4 765for details. 766.El 767.Sh FILES 768.Bl -tag -width /etc/hosts.allow -compact 769.It Pa /etc/inetd.conf 770configuration file for all 771.Nm 772provided services 773.It Pa /etc/services 774service name to protocol and port number mappings. 775.It Pa /etc/protocols 776protocol name to protocol number mappings 777.It Pa /etc/rpc 778.Tn Sun-RPC 779service name to service number mappings. 780.It Pa /etc/hosts.allow 781explicit remote host access list. 782.It Pa /etc/hosts.deny 783explicit remote host denial of service list. 784.El 785.Sh SEE ALSO 786.Xr hosts_access 5 , 787.Xr hosts_options 5 , 788.Xr protocols 5 , 789.Xr rpc 5 , 790.Xr services 5 , 791.Xr comsat 8 , 792.Xr fingerd 8 , 793.Xr ftpd 8 , 794.Xr rexecd 8 , 795.Xr rlogind 8 , 796.Xr rshd 8 , 797.Xr telnetd 8 , 798.Xr tftpd 8 799.Rs 800.%A J. Postel 801.%R RFC 802.%N 862 803.%D May 1983 804.%T "Echo Protocol" 805.Re 806.Rs 807.%A J. Postel 808.%R RFC 809.%N 863 810.%D May 1983 811.%T "Discard Protocol" 812.Re 813.Rs 814.%A J. Postel 815.%R RFC 816.%N 864 817.%D May 1983 818.%T "Character Generator Protocol" 819.Re 820.Rs 821.%A J. Postel 822.%R RFC 823.%N 867 824.%D May 1983 825.%T "Daytime Protocol" 826.Re 827.Rs 828.%A J. Postel 829.%A K. Harrenstien 830.%R RFC 831.%N 868 832.%D May 1983 833.%T "Time Protocol" 834.Re 835.Rs 836.%A M. Lottor 837.%R RFC 838.%N 1078 839.%D November 1988 840.%T "TCP port service Multiplexer (TCPMUX)" 841.Re 842.Sh HISTORY 843The 844.Nm 845command appeared in 846.Bx 4.3 . 847Support for 848.Em Sun-RPC 849based services is modeled after that 850provided by SunOS 4.1. 851Support for specifying the socket buffer sizes was added in 852.Nx 1.4 . 853In November 1996, libwrap support was added to provide 854internal tcpd-like access control functionality; 855libwrap is based on Wietse Venema's tcp_wrappers. 856IPv6 support and IPsec hack was made by KAME project, in 1999. 857.Sh BUGS 858Host address specifiers, while they make conceptual sense for RPC 859services, do not work entirely correctly. 860This is largely because the portmapper interface does not provide 861a way to register different ports for the same service on different 862local addresses. 863Provided you never have more than one entry for a given RPC service, 864everything should work correctly (Note that default host address 865specifiers do apply to RPC lines with no explicit specifier.) 866.Pp 867.Em tcpmux 868on IPv6 is not tested enough. 869.Pp 870For automatic IP version detection in key-values syntax (see the 871.Em protocol 872key), addresses with an interface specifier in the form <address>%<iface> 873are not currently supported, as addresses of that form are not parsed by 874.Xr inet_pton 3 . 875.Pp 876If a positional service definition has an invalid parameter and extends 877across multiple lines using tab characters, the subsequent lines after the 878error are treated as new service definitions. 879.Sh SECURITY CONSIDERATIONS 880Enabling the 881.Dq echo , 882.Dq discard , 883and 884.Dq chargen 885built-in trivial services is not recommended because remote 886users may abuse these to cause a denial of network service to 887or from the local host. 888