1.\" $NetBSD: inetd.8,v 1.45 2005/09/11 23:38:35 wiz Exp $ 2.\" 3.\" Copyright (c) 1998 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 8.\" NASA Ames Research Center. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. All advertising materials mentioning features or use of this software 19.\" must display the following acknowledgement: 20.\" This product includes software developed by the NetBSD 21.\" Foundation, Inc. and its contributors. 22.\" 4. Neither the name of The NetBSD Foundation nor the names of its 23.\" contributors may be used to endorse or promote products derived 24.\" from this software without specific prior written permission. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 27.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 28.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 29.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 30.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 31.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 32.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 33.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 34.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 35.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 36.\" POSSIBILITY OF SUCH DAMAGE. 37.\" 38.\" Copyright (c) 1985, 1991 The Regents of the University of California. 39.\" All rights reserved. 40.\" 41.\" Redistribution and use in source and binary forms, with or without 42.\" modification, are permitted provided that the following conditions 43.\" are met: 44.\" 1. Redistributions of source code must retain the above copyright 45.\" notice, this list of conditions and the following disclaimer. 46.\" 2. Redistributions in binary form must reproduce the above copyright 47.\" notice, this list of conditions and the following disclaimer in the 48.\" documentation and/or other materials provided with the distribution. 49.\" 3. Neither the name of the University nor the names of its contributors 50.\" may be used to endorse or promote products derived from this software 51.\" without specific prior written permission. 52.\" 53.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 54.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 57.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63.\" SUCH DAMAGE. 64.\" 65.\" from: @(#)inetd.8 8.4 (Berkeley) 6/1/94 66.\" 67.Dd March 24, 2004 68.Dt INETD 8 69.Os 70.Sh NAME 71.Nm inetd , 72.Nm inetd.conf 73.Nd internet 74.Dq super-server 75.Sh SYNOPSIS 76.Nm 77.Op Fl d 78.Op Fl l 79.Op Ar configuration file 80.Sh DESCRIPTION 81.Nm 82should be run at boot time by 83.Pa /etc/rc 84(see 85.Xr rc 8 ) . 86It then listens for connections on certain internet sockets. 87When a connection is found on one of its sockets, it decides what 88service the socket corresponds to, and invokes a program to service 89the request. 90After the program is finished, it continues to listen on the socket 91(except in some cases which will be described below). 92Essentially, 93.Nm 94allows running one daemon to invoke several others, 95reducing load on the system. 96.Pp 97The options available for 98.Nm : 99.Bl -tag -width Ds 100.It Fl d 101Turns on debugging. 102.It Fl l 103Turns on libwrap connection logging. 104.El 105.Pp 106Upon execution, 107.Nm 108reads its configuration information from a configuration 109file which, by default, is 110.Pa /etc/inetd.conf . 111The path given for this configuration file must be absolute, unless 112the 113.Fl d 114option is also given on the command line. 115There must be an entry for each field of the configuration 116file, with entries for each field separated by a tab or 117a space. 118Comments are denoted by a ``#'' at the beginning of a line. 119There must be an entry for each field (except for one 120special case, described below). 121The fields of the configuration file are as follows: 122.Pp 123.Bd -unfilled -offset indent -compact 124[addr:]service-name 125socket-type 126protocol[,sndbuf=size][,rcvbuf=size] 127wait/nowait[:max] 128user[:group] 129server-program 130server program arguments 131.Ed 132.Pp 133To specify an 134.Em Sun-RPC 135based service, the entry would contain these fields. 136.Pp 137.Bd -unfilled -offset indent -compact 138service-name/version 139socket-type 140rpc/protocol[,sndbuf=size][,rcvbuf=size] 141wait/nowait[:max] 142user[:group] 143server-program 144server program arguments 145.Ed 146.Pp 147For Internet services, the first field of the line may also have a host 148address specifier prefixed to it, separated from the service name by a colon. 149If this is done, the string before the colon in the first field 150indicates what local address 151.Nm 152should use when listening for that service, or the single character 153.Dq \&* 154to indicate 155.Dv INADDR_ANY , 156meaning 157.Sq all local addresses . 158To avoid repeating an address that occurs frequently, a line with a 159host address specifier and colon, but no further fields, causes the 160host address specifier to be remembered and used for all further lines 161with no explicit host specifier (until another such line or the end of 162the file). 163A line 164.Dl *: 165is implicitly provided at the top of the file; thus, traditional 166configuration files (which have no host address specifiers) will be 167interpreted in the traditional manner, with all services listened for 168on all local addresses. 169.Pp 170The 171.Em service-name 172entry is the name of a valid service in 173the file 174.Pa /etc/services . 175For 176.Dq internal 177services (discussed below), the service 178name 179.Em must 180be the official name of the service (that is, the first entry in 181.Pa /etc/services ) . 182When used to specify a 183.Em Sun-RPC 184based service, this field is a valid RPC service name in 185the file 186.Pa /etc/rpc . 187The part on the right of the 188.Dq / 189is the RPC version number. 190This can simply be a single numeric argument or a range of versions. 191A range is bounded by the low version to the high version \- 192.Dq rusers/1-3 . 193.Pp 194The 195.Em socket-type 196should be one of 197.Dq stream , 198.Dq dgram , 199.Dq raw , 200.Dq rdm , 201or 202.Dq seqpacket , 203depending on whether the socket is a stream, datagram, raw, 204reliably delivered message, or sequenced packet socket. 205.Pp 206The 207.Em protocol 208must be a valid protocol as given in 209.Pa /etc/protocols . 210Examples might be 211.Dq tcp 212and 213.Dq udp . 214Rpc based services are specified with the 215.Dq rpc/tcp 216or 217.Dq rpc/udp 218service type. 219.Dq tcp 220and 221.Dq udp 222will be recognized as 223.Dq TCP or UDP over default IP version . 224It is currently IPv4, but in the future it will be IPv6. 225If you need to specify IPv4 or IPv6 explicitly, use something like 226.Dq tcp4 227or 228.Dq udp6 . 229If you would like to enable special support for 230.Xr faithd 8 , 231prepend a keyword 232.Dq faith 233into 234.Em protocol , 235like 236.Dq faith/tcp6 . 237.Pp 238In addition to the protocol, the configuration file may specify the 239send and receive socket buffer sizes for the listening socket. 240This is especially useful for 241.Tn TCP 242as the window scale factor, which is based on the receive socket 243buffer size, is advertised when the connection handshake occurs, 244thus the socket buffer size for the server must be set on the listen socket. 245By increasing the socket buffer sizes, better 246.Tn TCP 247performance may be realized in some situations. 248The socket buffer sizes are specified by appending their values to 249the protocol specification as follows: 250.Bd -literal -offset indent 251tcp,rcvbuf=16384 252tcp,sndbuf=64k 253tcp,rcvbuf=64k,sndbuf=1m 254.Ed 255.Pp 256A literal value may be specified, or modified using 257.Sq k 258to indicate kilobytes or 259.Sq m 260to indicate megabytes. 261Socket buffer sizes may be specified for all 262services and protocols except for tcpmux services. 263.Pp 264The 265.Em wait/nowait 266entry is used to tell 267.Nm 268if it should wait for the server program to return, 269or continue processing connections on the socket. 270If a datagram server connects 271to its peer, freeing the socket so 272.Nm 273can receive further messages on the socket, it is said to be 274a 275.Dq multi-threaded 276server, and should use the 277.Dq nowait 278entry. 279For datagram servers which process all incoming datagrams 280on a socket and eventually time out, the server is said to be 281.Dq single-threaded 282and should use a 283.Dq wait 284entry. 285.Xr comsat 8 286.Pq Xr biff 1 287and 288.Xr talkd 8 289are both examples of the latter type of 290datagram server. 291.Xr tftpd 8 292is an exception; it is a datagram server that establishes pseudo-connections. 293It must be listed as 294.Dq wait 295in order to avoid a race; 296the server reads the first packet, creates a new socket, 297and then forks and exits to allow 298.Nm 299to check for new service requests to spawn new servers. 300The optional 301.Dq max 302suffix (separated from 303.Dq wait 304or 305.Dq nowait 306by a dot or a colon) specifies the maximum number of server instances that may 307be spawned from 308.Nm 309within an interval of 60 seconds. 310When omitted, 311.Dq max 312defaults to 40. 313.Pp 314Stream servers are usually marked as 315.Dq nowait 316but if a single server process is to handle multiple connections, it may be 317marked as 318.Dq wait . 319The master socket will then be passed as fd 0 to the server, which will then 320need to accept the incoming connection. 321The server should eventually time 322out and exit when no more connections are active. 323.Nm 324will continue to 325listen on the master socket for connections, so the server should not close 326it when it exits. 327.Xr identd 8 328is usually the only stream server marked as wait. 329.Pp 330The 331.Em user 332entry should contain the user name of the user as whom the server should run. 333This allows for servers to be given less permission than root. 334Optionally, a group can be specified by appending a colon to the user name, 335followed by the group name (it is possible to use a dot (``.'') in lieu of a 336colon, however this feature is provided only for backward compatibility). 337This allows for servers to run with a different (primary) group id than 338specified in the password file. 339If a group is specified and 340.Em user 341is not root, the supplementary groups associated with that user will still be 342set. 343.Pp 344The 345.Em server-program 346entry should contain the pathname of the program which is to be 347executed by 348.Nm 349when a request is found on its socket. 350If 351.Nm 352provides this service internally, this entry should 353be 354.Dq internal . 355.Pp 356The 357.Em server program arguments 358should be just as arguments 359normally are, starting with argv[0], which is the name of 360the program. 361If the service is provided internally, the 362word 363.Dq internal 364should take the place of this entry. 365It is possible to quote an argument using either single or double quotes. 366This allows you to have, e.g., spaces in paths and parameters. 367.Ss Internal Services 368.Nm 369provides several 370.Qq trivial 371services internally by use of routines within itself. 372These services are 373.Qq echo , 374.Qq discard , 375.Qq chargen 376(character generator), 377.Qq daytime 378(human readable time), and 379.Qq time 380(machine readable time, 381in the form of the number of seconds since midnight, January 1, 1900 GMT). 382For details of these services, consult the appropriate 383.Tn RFC . 384.Pp 385TCP services without official port numbers can be handled with the 386RFC1078-based tcpmux internal service. 387TCPmux listens on port 1 for requests. 388When a connection is made from a foreign host, the service name 389requested is passed to TCPmux, which performs a lookup in the 390service name table provided by 391.Pa /etc/inetd.conf 392and returns the proper entry for the service. 393TCPmux returns a negative reply if the service doesn't exist, 394otherwise the invoked server is expected to return the positive 395reply if the service type in 396.Pa /etc/inetd.conf 397file has the prefix 398.Qq tcpmux/ . 399If the service type has the 400prefix 401.Qq tcpmux/+ , 402TCPmux will return the positive reply for the 403process; this is for compatibility with older server code, and also 404allows you to invoke programs that use stdin/stdout without putting any 405special server code in them. 406Services that use TCPmux are 407.Qq nowait 408because they do not have a well-known port number and hence cannot listen 409for new requests. 410.Pp 411.Nm 412rereads its configuration file when it receives a hangup signal, 413.Dv SIGHUP . 414Services may be added, deleted or modified when the configuration file 415is reread. 416.Nm 417creates a file 418.Em /var/run/inetd.pid 419that contains its process identifier. 420.Ss libwrap 421Support for 422.Tn TCP 423wrappers is included with 424.Nm 425to provide internal tcpd-like access control functionality. 426An external tcpd program is not needed. 427You do not need to change the 428.Pa /etc/inetd.conf 429server-program entry to enable this capability. 430.Nm 431uses 432.Pa /etc/hosts.allow 433and 434.Pa /etc/hosts.deny 435for access control facility configurations, as described in 436.Xr hosts_access 5 . 437.Pp 438.Em Nota Bene : 439.Tn TCP 440wrappers do not affect/restrict 441.Tn UDP 442or internal services. 443.Ss IPsec 444The implementation includes a tiny hack to support IPsec policy settings for 445each socket. 446A special form of the comment line, starting with 447.Dq Li "#@" , 448is used as a policy specifier. 449The content of the above comment line will be treated as a IPsec policy string, 450as described in 451.Xr ipsec_set_policy 3 . 452Multiple IPsec policy strings may be specified by using a semicolon 453as a separator. 454If conflicting policy strings are found in a single line, 455the last string will take effect. 456A 457.Li "#@" 458line affects all of the following lines in 459.Pa /etc/inetd.conf , 460so you may want to reset the IPsec policy by using a comment line containing 461only 462.Li "#@" 463.Pq with no policy string . 464.Pp 465If an invalid IPsec policy string appears in 466.Pa /etc/inetd.conf , 467.Nm 468logs an error message using 469.Xr syslog 3 470and terminates itself. 471.Ss IPv6 TCP/UDP behavior 472If you wish to run a server for IPv4 and IPv6 traffic, 473you'll need to run two separate process for the same server program, 474specified as two separate lines on 475.Pa /etc/inetd.conf , 476for 477.Dq tcp4 478and 479.Dq tcp6 . 480.Dq tcp 481means TCP on top of currently-default IP version, 482which is, at this moment, IPv4. 483.Pp 484Under various combination of IPv4/v6 daemon settings, 485.Nm 486will behave as follows: 487.Bl -bullet -compact 488.It 489If you have only one server on 490.Dq tcp4 , 491IPv4 traffic will be routed to the server. 492IPv6 traffic will not be accepted. 493.It 494If you have two servers on 495.Dq tcp4 496and 497.Dq tcp6 , 498IPv4 traffic will be routed to the server on 499.Dq tcp4 , 500and IPv6 traffic will go to server on 501.Dq tcp6 . 502.It 503If you have only one server on 504.Dq tcp6 , 505only IPv6 traffic will be routed to the server. 506The kernel may route to the server IPv4 traffic as well, 507under certain configuration. 508See 509.Xr ip6 4 510for details. 511.El 512.Sh FILES 513.Bl -tag -width /etc/hosts.allow -compact 514.It Pa /etc/inetd.conf 515configuration file for all 516.Nm 517provided services 518.It Pa /etc/services 519service name to protocol and port number mappings. 520.It Pa /etc/protocols 521protocol name to protocol number mappings 522.It Pa /etc/rpc 523.Tn Sun-RPC 524service name to service number mappings. 525.It Pa /etc/hosts.allow 526explicit remote host access list. 527.It Pa /etc/hosts.deny 528explicit remote host denial of service list. 529.El 530.Sh SEE ALSO 531.Xr hosts_access 5 , 532.Xr hosts_options 5 , 533.Xr protocols 5 , 534.Xr rpc 5 , 535.Xr services 5 , 536.Xr comsat 8 , 537.Xr fingerd 8 , 538.Xr ftpd 8 , 539.Xr rexecd 8 , 540.Xr rlogind 8 , 541.Xr rshd 8 , 542.Xr telnetd 8 , 543.Xr tftpd 8 544.Rs 545.%A J. Postel 546.%R RFC 547.%N 862 548.%D May 1983 549.%T "Echo Protocol" 550.Re 551.Rs 552.%A J. Postel 553.%R RFC 554.%N 863 555.%D May 1983 556.%T "Discard Protocol" 557.Re 558.Rs 559.%A J. Postel 560.%R RFC 561.%N 864 562.%D May 1983 563.%T "Character Generator Protocol" 564.Re 565.Rs 566.%A J. Postel 567.%R RFC 568.%N 867 569.%D May 1983 570.%T "Daytime Protocol" 571.Re 572.Rs 573.%A J. Postel 574.%A K. Harrenstien 575.%R RFC 576.%N 868 577.%D May 1983 578.%T "Time Protocol" 579.Re 580.Rs 581.%A M. Lottor 582.%R RFC 583.%N 1078 584.%D November 1988 585.%T "TCP port service Multiplexer (TCPMUX)" 586.Re 587.Sh HISTORY 588The 589.Nm 590command appeared in 591.Bx 4.3 . 592Support for 593.Em Sun-RPC 594based services is modeled after that 595provided by SunOS 4.1. 596Support for specifying the socket buffer sizes was added in 597.Nx 1.4 . 598In November 1996, libwrap support was added to provide 599internal tcpd-like access control functionality; 600libwrap is based on Wietse Venema's tcp_wrappers. 601IPv6 support and IPsec hack was made by KAME project, in 1999. 602.Sh BUGS 603Host address specifiers, while they make conceptual sense for RPC 604services, do not work entirely correctly. 605This is largely because the portmapper interface does not provide 606a way to register different ports for the same service on different 607local addresses. 608Provided you never have more than one entry for a given RPC service, 609everything should work correctly (Note that default host address 610specifiers do apply to RPC lines with no explicit specifier.) 611.Pp 612.Dq tcpmux 613on IPv6 is not tested enough. 614.Sh SECURITY CONSIDERATIONS 615Enabling the 616.Dq echo , 617.Dq discard , 618and 619.Dq chargen 620built-in trivial services is not recommended because remote 621users may abuse these to cause a denial of network service to 622or from the local host. 623