1.\" $NetBSD: inetd.8,v 1.36 2001/03/16 08:19:13 fair Exp $ 2.\" 3.\" Copyright (c) 1998 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 8.\" NASA Ames Research Center. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. All advertising materials mentioning features or use of this software 19.\" must display the following acknowledgement: 20.\" This product includes software developed by the NetBSD 21.\" Foundation, Inc. and its contributors. 22.\" 4. Neither the name of The NetBSD Foundation nor the names of its 23.\" contributors may be used to endorse or promote products derived 24.\" from this software without specific prior written permission. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 27.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 28.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 29.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 30.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 31.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 32.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 33.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 34.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 35.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 36.\" POSSIBILITY OF SUCH DAMAGE. 37.\" 38.\" Copyright (c) 1985, 1991 The Regents of the University of California. 39.\" All rights reserved. 40.\" 41.\" Redistribution and use in source and binary forms, with or without 42.\" modification, are permitted provided that the following conditions 43.\" are met: 44.\" 1. Redistributions of source code must retain the above copyright 45.\" notice, this list of conditions and the following disclaimer. 46.\" 2. Redistributions in binary form must reproduce the above copyright 47.\" notice, this list of conditions and the following disclaimer in the 48.\" documentation and/or other materials provided with the distribution. 49.\" 3. All advertising materials mentioning features or use of this software 50.\" must display the following acknowledgement: 51.\" This product includes software developed by the University of 52.\" California, Berkeley and its contributors. 53.\" 4. Neither the name of the University nor the names of its contributors 54.\" may be used to endorse or promote products derived from this software 55.\" without specific prior written permission. 56.\" 57.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 58.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 59.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 60.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 61.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 62.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 63.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 64.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 65.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 66.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 67.\" SUCH DAMAGE. 68.\" 69.\" from: @(#)inetd.8 8.4 (Berkeley) 6/1/94 70.\" 71.Dd March 10, 2001 72.Dt INETD 8 73.Os 74.Sh NAME 75.Nm inetd , 76.Nm inetd.conf 77.Nd internet 78.Dq super-server 79.Sh SYNOPSIS 80.Nm 81.Op Fl d 82.Op Fl l 83.Op Ar configuration file 84.Sh DESCRIPTION 85.Nm 86should be run at boot time by 87.Pa /etc/rc 88(see 89.Xr rc 8 ) . 90It then listens for connections on certain internet sockets. 91When a connection is found on one of its sockets, it decides what 92service the socket corresponds to, and invokes a program to service 93the request. 94After the program is finished, it continues to listen on the socket 95(except in some cases which will be described below). 96Essentially, 97.Nm 98allows running one daemon to invoke several others, 99reducing load on the system. 100.Pp 101The options available for 102.\" Why doesn't just `.Nm :' work? 103.Nm "" : 104.Bl -tag -width Ds 105.It Fl d 106Turns on debugging. 107.El 108.Pp 109.Bl -tag -width Ds 110.It Fl l 111Turns on libwrap connection logging. 112.El 113.Pp 114Upon execution, 115.Nm 116reads its configuration information from a configuration 117file which, by default, is 118.Pa /etc/inetd.conf . 119The path given for this configuration file must be absolute, unless 120the 121.Fl d 122option is also given on the command line. 123There must be an entry for each field of the configuration 124file, with entries for each field separated by a tab or 125a space. 126Comments are denoted by a ``#'' at the beginning of a line. 127There must be an entry for each field (except for one 128special case, described below). 129The fields of the configuration file are as follows: 130.Pp 131.Bd -unfilled -offset indent -compact 132[addr:]service-name 133socket-type 134protocol[,sndbuf=size][,rcvbuf=size] 135wait/nowait[:max] 136user[:group] 137server-program 138server program arguments 139.Ed 140.Pp 141To specify an 142.Em Sun-RPC 143based service, the entry would contain these fields. 144.Pp 145.Bd -unfilled -offset indent -compact 146service-name/version 147socket-type 148rpc/protocol[,sndbuf=size][,rcvbuf=size] 149wait/nowait[:max] 150user[:group] 151server-program 152server program arguments 153.Ed 154.Pp 155For Internet services, the first field of the line may also have a host 156address specifier prefixed to it, separated from the service name by a colon. 157If this is done, the string before the colon in the first field 158indicates what local address 159.Nm 160should use when listening for that service, or the single character 161.Dq \&* 162to indicate 163.Dv INADDR_ANY , 164meaning 165.Sq all local addresses . 166To avoid repeating an address that occurs frequently, a line with a 167host address specifier and colon, but no further fields, causes the 168host address specifier to be remembered and used for all further lines 169with no explicit host specifier (until another such line or the end of 170the file). 171A line 172.Dl *: 173is implicitly provided at the top of the file; thus, traditional 174configuration files (which have no host address specifiers) will be 175interpreted in the traditional manner, with all services listened for 176on all local addresses. 177.Pp 178The 179.Em service-name 180entry is the name of a valid service in 181the file 182.Pa /etc/services . 183For 184.Dq internal 185services (discussed below), the service 186name 187.Em must 188be the official name of the service (that is, the first entry in 189.Pa /etc/services ) . 190When used to specify a 191.Em Sun-RPC 192based service, this field is a valid RPC service name in 193the file 194.Pa /etc/rpc . 195The part on the right of the 196.Dq / 197is the RPC version number. 198This can simply be a single numeric argument or a range of versions. 199A range is bounded by the low version to the high version \- 200.Dq rusers/1-3 . 201.Pp 202The 203.Em socket-type 204should be one of 205.Dq stream , 206.Dq dgram , 207.Dq raw , 208.Dq rdm , 209or 210.Dq seqpacket , 211depending on whether the socket is a stream, datagram, raw, 212reliably delivered message, or sequenced packet socket. 213.Pp 214The 215.Em protocol 216must be a valid protocol as given in 217.Pa /etc/protocols . 218Examples might be 219.Dq tcp 220and 221.Dq udp . 222Rpc based services are specified with the 223.Dq rpc/tcp 224or 225.Dq rpc/udp 226service type. 227.Dq tcp 228and 229.Dq udp 230will be recognized as 231.Dq TCP or UDP over default IP version . 232It is currently IPv4, but in the future it will be IPv6. 233If you need to specify IPv4 or IPv6 explicitly, use something like 234.Dq tcp4 235or 236.Dq udp6 . 237If you would like to enable special support for 238.Xr faithd 8 , 239prepend a keyword 240.Dq faith 241into 242.Em protocol , 243like 244.Dq faith/tcp6 . 245.Pp 246In addition to the protocol, the configuration file may specify the 247send and receive socket buffer sizes for the listening socket. 248This is especially useful for 249.Tn TCP 250as the window scale factor, which is based on the receive socket 251buffer size, is advertised when the connection handshake occurs, 252thus the socket buffer size for the server must be set on the listen socket. 253By increasing the socket buffer sizes, better 254.Tn TCP 255performance may be realized in some situations. 256The socket buffer sizes are specified by appending their values to 257the protocol specification as follows: 258.Bd -literal -offset indent 259tcp,rcvbuf=16384 260tcp,sndbuf=64k 261tcp,rcvbuf=64k,sndbuf=1m 262.Ed 263.Pp 264A literal value may be specified, or modified using 265.Sq k 266to indicate kilobytes or 267.Sq m 268to indicate megabytes. 269Socket buffer sizes may be specified for all 270services and protocols except for tcpmux services. 271.Pp 272The 273.Em wait/nowait 274entry is used to tell 275.Nm 276if it should wait for the server program to return, 277or continue processing connections on the socket. 278If a datagram server connects 279to its peer, freeing the socket so 280.Nm 281can receive further messages on the socket, it is said to be 282a 283.Dq multi-threaded 284server, and should use the 285.Dq nowait 286entry. 287For datagram servers which process all incoming datagrams 288on a socket and eventually time out, the server is said to be 289.Dq single-threaded 290and should use a 291.Dq wait 292entry. 293.Xr comsat 8 294.Pq Xr biff 1 295and 296.Xr talkd 8 297are both examples of the latter type of 298datagram server. 299.Xr tftpd 8 300is an exception; it is a datagram server that establishes pseudo-connections. 301It must be listed as 302.Dq wait 303in order to avoid a race; 304the server reads the first packet, creates a new socket, 305and then forks and exits to allow 306.Nm 307to check for new service requests to spawn new servers. 308The optional 309.Dq max 310suffix (separated from 311.Dq wait 312or 313.Dq nowait 314by a dot or a colon) specifies the maximum number of server instances that may 315be spawned from 316.Nm 317within an interval of 60 seconds. 318When omitted, 319.Dq max 320defaults to 40. 321.Pp 322Stream servers are usually marked as 323.Dq nowait 324but if a single server process is to handle multiple connections, it may be 325marked as 326.Dq wait . 327The master socket will then be passed as fd 0 to the server, which will then 328need to accept the incoming connection. 329The server should eventually time 330out and exit when no more connections are active. 331.Nm 332will continue to 333listen on the master socket for connections, so the server should not close 334it when it exits. 335.Xr identd 8 336is usually the only stream server marked as wait. 337.Pp 338The 339.Em user 340entry should contain the user name of the user as whom the server should run. 341This allows for servers to be given less permission than root. 342Optionally, a group can be specified by appending a colon to the user name, 343followed by the group name (it is possible to use a dot (``.'') in lieu of a 344colon, however this feature is provided only for backward compatibility). 345This allows for servers to run with a different (primary) group id than 346specified in the password file. 347If a group is specified and 348.Em user 349is not root, the supplementary groups associated with that user will still be 350set. 351.Pp 352The 353.Em server-program 354entry should contain the pathname of the program which is to be 355executed by 356.Nm 357when a request is found on its socket. 358If 359.Nm 360provides this service internally, this entry should 361be 362.Dq internal . 363.Pp 364The 365.Em server program arguments 366should be just as arguments 367normally are, starting with argv[0], which is the name of 368the program. 369If the service is provided internally, the 370word 371.Dq internal 372should take the place of this entry. 373.Ss Internal Services 374.Pp 375.Nm 376provides several 377.Qq trivial 378services internally by use of routines within itself. 379These services are 380.Qq echo , 381.Qq discard , 382.Qq chargen 383(character generator), 384.Qq daytime 385(human readable time), and 386.Qq time 387(machine readable time, 388in the form of the number of seconds since midnight, January 1, 1900 GMT). 389For details of these services, consult the appropriate 390.Tn RFC . 391.Pp 392TCP services without official port numbers can be handled with the 393RFC1078-based tcpmux internal service. 394TCPmux listens on port 1 for requests. 395When a connection is made from a foreign host, the service name 396requested is passed to TCPmux, which performs a lookup in the 397service name table provided by 398.Pa /etc/inetd.conf 399and returns the proper entry for the service. 400TCPmux returns a negative reply if the service doesn't exist, 401otherwise the invoked server is expected to return the positive 402reply if the service type in 403.Pa /etc/inetd.conf 404file has the prefix 405.Qq tcpmux/ . 406If the service type has the 407prefix 408.Qq tcpmux/+ , 409TCPmux will return the positive reply for the 410process; this is for compatibility with older server code, and also 411allows you to invoke programs that use stdin/stdout without putting any 412special server code in them. 413Services that use TCPmux are 414.Qq nowait 415because they do not have a well-known port nubmer and hence cannot listen 416for new requests. 417.Pp 418.Nm 419rereads its configuration file when it receives a hangup signal, 420.Dv SIGHUP . 421Services may be added, deleted or modified when the configuration file 422is reread. 423.Nm 424creates a file 425.Em /var/run/inetd.pid 426that contains its process identifier. 427.Ss libwrap 428.Pp 429Support for 430.Tn TCP 431wrappers is included with 432.Nm 433to provide internal tcpd-like access control functionality. 434An external tcpd program is not needed. 435You do not need to change the 436.Pa /etc/inetd.conf 437server-program entry to enable this capability. 438.Nm 439uses 440.Pa /etc/hosts.allow 441and 442.Pa /etc/hosts.deny 443for access control facility configurations, as described in 444.Xr hosts_access 5 . 445.Ss IPsec 446.Pp 447The implementation includes a tiny hack to support IPsec policy settings for 448each socket. 449A special form of the comment line, starting with 450.Dq Li "#@" , 451is used as a policy specifier. 452The content of the above comment line will be treated as a IPsec policy string, 453as described in 454.Xr ipsec_set_policy 3 . 455Multiple IPsec policy strings may be specified by using a semicolon 456as a separator. 457If conflicting policy strings are found in a single line, 458the last string will take effect. 459A 460.Li "#@" 461line affects all of the following lines in 462.Pa /etc/inetd.conf , 463so you may want to reset the IPsec policy by using a comment line containing 464only 465.Li "#@" 466.Pq with no policy string . 467.Pp 468If an invalid IPsec policy string appears in 469.Pa /etc/inetd.conf , 470.Nm 471logs an error message using 472.Xr syslog 3 473and terminates itself. 474.Ss IPv6 TCP/UDP behavior 475.Pp 476If you wish to run a server for IPv4 and IPv6 traffic, 477you'll need to run two separate process for the same server program, 478specified as two separate lines on 479.Pa /etc/inetd.conf , 480for 481.Dq tcp4 482and 483.Dq tcp6 . 484.Dq tcp 485means TCP on top of currently-default IP version, 486which is, at this moment, IPv4. 487.Pp 488Under various combination of IPv4/v6 daemon settings, 489.Nm 490will behave as follows: 491.Bl -bullet -compact 492.It 493If you have only one server on 494.Dq tcp4 , 495IPv4 traffic will be routed to the server. 496IPv6 traffic will not be accepted. 497.It 498If you have two servers on 499.Dq tcp4 500and 501.Dq tcp6 , 502IPv4 traffic will be routed to the server on 503.Dq tcp4 , 504and IPv6 traffic will go to server on 505.Dq tcp6 . 506.It 507If you have only one server on 508.Dq tcp6 , 509only IPv6 traffic will be routed to the server. 510The kernel may route to the server IPv4 traffic as well, 511under certain configuration. 512See 513.Xr ip6 4 514for details. 515.El 516.Sh FILES 517.Bl -tag -width /etc/hosts.allow -compact 518.It Pa /etc/inetd.conf 519configuration file for all 520.Nm 521provided services 522.It Pa /etc/services 523service name to protocol and port number mappings. 524.It Pa /etc/protocols 525protocol name to protocol number mappings 526.It Pa /etc/rpc 527.Tn Sun-RPC 528service name to service number mappings. 529.It Pa /etc/hosts.allow 530explicit remote host access list. 531.It Pa /etc/hosts.deny 532explicit remote host denial of service list. 533.El 534.Sh BUGS 535Host address specifiers, while they make conceptual sense for RPC 536services, do not work entirely correctly. 537This is largely because the portmapper interface does not provide 538a way to register different ports for the same service on different 539local addresses. 540Provided you never have more than one entry for a given RPC service, 541everything should work correctly (Note that default host address 542specifiers do apply to RPC lines with no explicit specifier.) 543.Pp 544.Dq tcpmux 545on IPv6 is not tested enough. 546.Sh SEE ALSO 547.Xr comsat 8 , 548.Xr fingerd 8 , 549.Xr ftpd 8 , 550.Xr rexecd 8 , 551.Xr rlogind 8 , 552.Xr rshd 8 , 553.Xr telnetd 8 , 554.Xr tftpd 8 , 555.Xr hosts_access 5 , 556.Xr hosts_options 5 , 557.Xr protocols 5 , 558.Xr rpc 5 , 559.Xr services 5 560.Rs 561.%A J. Postel 562.%R RFC 563.%N 862 564.%D May 1983 565.%T "Echo Protocol" 566.Re 567.Rs 568.%A J. Postel 569.%R RFC 570.%N 863 571.%D May 1983 572.%T "Discard Protocol" 573.Re 574.Rs 575.%A J. Postel 576.%R RFC 577.%N 864 578.%D May 1983 579.%T "Character Generator Protocol" 580.Re 581.Rs 582.%A J. Postel 583.%R RFC 584.%N 867 585.%D May 1983 586.%T "Daytime Protocol" 587.Re 588.Rs 589.%A J. Postel 590.%A K. Harrenstien 591.%R RFC 592.%N 868 593.%D May 1983 594.%T "Time Protocol" 595.Re 596.Rs 597.%A M. Lottor 598.%R RFC 599.%N 1078 600.%D November 1988 601.%T "TCP port service Multiplexer (TCPMUX)" 602.Re 603.Sh HISTORY 604The 605.Nm 606command appeared in 607.Bx 4.3 . 608Support for 609.Em Sun-RPC 610based services is modeled after that 611provided by SunOS 4.1. 612Support for specifying the socket buffer sizes was added in 613.Nx 1.4 . 614In November 1996, libwrap support was added to provide 615internal tcpd-like access control functionality; 616libwrap is based on Wietse Venema's tcp_wrappers. 617IPv6 support and IPsec hack was made by KAME project, in 1999. 618.Sh SECURITY CONSIDERATIONS 619Enabling the 620.Dq echo , 621.Dq discard , 622and 623.Dq chargen 624built-in trivial services is not recommended because remote 625users may abuse these to cause a denial of network service to 626or from the local host. 627