inetd(8) is referred to as the “Internet Super-Server” because it manages connections for several services. When a connection is received by inetd, it determines which program the connection is destined for, spawns the particular process and delegates the socket to it (the program is invoked with the service socket as its standard input, output and error descriptors). Running one instance of inetd reduces the overall system load as compared to running each daemon individually in stand-alone mode.
Primarily, inetd is used to spawn other daemons, but several trivial protocols are handled directly, such as chargen, auth, and daytime.
This section will cover the basics in configuring
inetd through its command-line
options and its configuration file,
/etc/inetd.conf.
inetd is initialized through
the /etc/rc.conf system. The
inetd_enable option is set to
NO by default, but is often times turned on
by sysinstall with the medium
security profile. Placing:
inetd_enable="YES"
or
inetd_enable="NO"
into
/etc/rc.conf can enable or disable
inetd starting at boot time.
Additionally, different command-line options can be passed
to inetd via the
inetd_flags option.
inetd synopsis:
inetd [-d] [-l] [-w] [-W] [-c maximum] [-C rate] [-a address | hostname]
[-p filename] [-R rate] [configuration file]
Turn on debugging.
Turn on logging of successful connections.
Turn on TCP Wrapping for external services (on by default).
Turn on TCP Wrapping for internal services which are built into inetd (on by default).
Specify the default maximum number of simultaneous
invocations of each service; the default is unlimited.
May be overridden on a per-service basis with the
max-child parameter.
Specify the default maximum number of times a
service can be invoked from a single IP address in one
minute; the default is unlimited. May be overridden on a
per-service basis with the
max-connections-per-ip-per-minute
parameter.
Specify the maximum number of times a service can be invoked in one minute; the default is 256. A rate of 0 allows an unlimited number of invocations.
Specify one specific IP address to bind to. Alternatively, a hostname can be specified, in which case the IPv4 or IPv6 address which corresponds to that hostname is used. Usually a hostname is specified when inetd is run inside a jail(8), in which case the hostname corresponds to the jail(8) environment.
When hostname specification is used and both IPv4
and IPv6 bindings are desired, one entry with the
appropriate protocol type for each binding is required
for each service in
/etc/inetd.conf. For example, a
TCP-based service would need two entries, one using
tcp4 for the protocol and the other
using tcp6.
Specify an alternate file in which to store the process ID.
These options can be passed to
inetd using the
inetd_flags option in
/etc/rc.conf. By default,
inetd_flags is set to
-wW, which turns on TCP wrapping for
inetd's internal and external
services. For novice users, these parameters usually do not
need to be modified or even entered in
/etc/rc.conf.
An external service is a daemon outside of inetd, which is invoked when a connection is received for it. On the other hand, an internal service is one that inetd has the facility of offering within itself.
Configuration of inetd is
controlled through the /etc/inetd.conf
file.
When a modification is made to
/etc/inetd.conf,
inetd can be forced to re-read its
configuration file by sending a HangUP signal to the
inetd process as shown:
Each line of the configuration file specifies an
individual daemon. Comments in the file are preceded by a
“#”. The format of
/etc/inetd.conf is as follows:
service-name
socket-type
protocol
{wait|nowait}[/max-child[/max-connections-per-ip-per-minute]]
user[:group][/login-class]
server-program
server-program-argumentsAn example entry for the ftpd daemon using IPv4:
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
This is the service name of the particular daemon.
It must correspond to a service listed in
/etc/services. This determines
which port inetd must listen
to. If a new service is being created, it must be
placed in /etc/services
first.
Either stream,
dgram, raw, or
seqpacket. stream
must be used for connection-based, TCP daemons, while
dgram is used for daemons utilizing
the UDP transport protocol.
One of the following:
| Protocol | Explanation |
|---|---|
| tcp, tcp4 | TCP IPv4 |
| udp, udp4 | UDP IPv4 |
| tcp6 | TCP IPv6 |
| udp6 | UDP IPv6 |
| tcp46 | Both TCP IPv4 and v6 |
| udp46 | Both UDP IPv4 and v6 |
wait|nowait indicates whether the
daemon invoked from inetd is
able to handle its own socket or not.
dgram socket types must use the
wait option, while stream socket
daemons, which are usually multi-threaded, should use
nowait. wait usually
hands off multiple sockets to a single daemon, while
nowait spawns a child daemon for each
new socket.
The maximum number of child daemons
inetd may spawn can be set
using the max-child option. If a limit
of ten instances of a particular daemon is needed, a
/10 would be placed after
nowait.
In addition to max-child, another
option limiting the maximum connections from a single
place to a particular daemon can be enabled.
max-connections-per-ip-per-minute does
just this. A value of ten here would limit any particular
IP address connecting to a particular service to ten
attempts per minute. This is useful to prevent
intentional or unintentional resource consumption and
Denial of Service (DoS) attacks to a machine.
In this field, wait or
nowait is mandatory.
max-child and
max-connections-per-ip-per-minute are
optional.
A stream-type multi-threaded daemon without any
max-child or
max-connections-per-ip-per-minute limits
would simply be: nowait.
The same daemon with a maximum limit of ten daemons
would read: nowait/10.
Additionally, the same setup with a limit of twenty
connections per IP address per minute and a maximum
total limit of ten child daemons would read:
nowait/10/20.
These options are all utilized by the default settings of the fingerd daemon, as seen here:
finger stream tcp nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
This is the username that the particular daemon
should run as. Most commonly, daemons run as the
root user. For security purposes, it is
common to find some servers running as the
daemon user, or the least privileged
nobody user.
The full path of the daemon to be executed when a
connection is received. If the daemon is a service
provided by inetd internally,
then internal should be
used.
This works in conjunction with
server-program by specifying the
arguments, starting with argv[0],
passed to the daemon on invocation. If
mydaemon -d is the command line,
mydaemon -d would be the value of
server-program-arguments. Again, if
the daemon is an internal service, use
internal here.
Depending on the security profile chosen at install, many
of inetd's daemons may be enabled
by default. If there is no apparent need for a particular
daemon, disable it! Place a “#” in front of the
daemon in question in /etc/inetd.conf,
and then send a hangup
signal to inetd. Some daemons, such as
fingerd, may not be desired at all
because they provide an attacker with too much
information.
Some daemons are not security-conscious and have long, or
non-existent timeouts for connection attempts. This allows an
attacker to slowly send connections to a particular daemon,
thus saturating available resources. It may be a good idea to
place max-connections-per-ip-per-minute and
max-child limitations on certain
daemons.
By default, TCP wrapping is turned on. Consult the hosts_access(5) manual page for more information on placing TCP restrictions on various inetd invoked daemons.
daytime, time, echo, discard, chargen, and auth are all internally provided services of inetd.
The auth service provides identity (ident, identd) network services, and is configurable to a certain degree.
Consult the inetd(8) manual page for more in-depth information.
All FreeBSD documents are available for download at http://ftp.FreeBSD.org/pub/FreeBSD/doc/
Questions that are not answered by the
documentation may be
sent to <freebsd-questions@FreeBSD.org>.
Send questions about this document to <freebsd-doc@FreeBSD.org>.