The inetd Daemon Super Internet Server

CLOSING Closed, then remote shutdown, awaiting acknowledgment. LAST_ACK Remote shutdown, then closed, awaiting acknowledgment. FIN_WAIT_2 Socket closed, waiting for shutdown from remote. TIME_WAIT Wait after close for remote shutdown retransmission. The following example illustrates the use of the netstat command for this purpose; the host name is garp. Only active sockets are presented. netstat −a Active Internet connections including servers Proto Recv−Q Send−Q Local Address Foreign Address state tcp 0 0 garp.690 delft.scps.com.32771 TIME_WAIT tcp 0 0 garp.686 delft.scps.com.32771 TIME_WAIT tcp 0 205 garp.telnet ink2.spcs.com.1047 ESTABLISHED tcp 0 0 garp.nprodsoc garp.4108 ESTABLISHED tcp 0 0 garp.4108 garp.nprodsoc ESTABLISHED tcp 0 0 garp.telnet daloia.scps.com.1095 ESTABLISHED tcp 0 0 garp.telnet park.scps.com.1038 ESTABLISHED tcp 0 0 .printer . LISTEN tcp 0 0 garp.nprodsoc . LISTEN tcp 0 0 .2458 . LISTEN tcp 0 0 . . CLOSED tcp 0 0 .querix . LISTEN ..... ..... If no options, or only the −n option is specified, netstat displays the status of active sockets only.

15.5 Super Internet Server

15.5.1 The inetd Daemon

A huge number of different processes run on any UNIX system. Many of them are run continuously, and we usually identify them as daemons. Some daemons are configured into the kernel and are invoked with the kernel execution; others are explicitly started during the system startup through the corresponding initialization rc scripts. However, UNIX also provides one special daemon with the primary task of starting other daemons, or rather, other network server processes because the started processes run as long as their services are required. This daemon is known as the super−daemon, or the super−server; its name is inetd. The basic idea behind the inetd daemon was this: instead of continuously running many network server processes as daemons, with each of them listening for incoming client requests for its service, run a single daemon which will listen for incoming client requests and invoke the corresponding network server process on an as−needed basis. The super−server inetd is started during the system startup; when started, inetd reads its configuration data from the etcinetd.conf file to learn about the server processes it should support. Once started, inetd continues to listen for configured network services as long as the system lives, or until the super−server is reconfigured. 15.5.1.1 The inetd Configuration Obviously, inetd requires a certain level of administration, although the default configuration seems to be sufficient in most cases. The inetd daemon is actually very flexible and easy to configure. 360 Here is an example of the inetd configuration file: cat etcinetd.conf Configured using SAM by root on Mon Dec 13 22:17:00 Header: inetd.conf,v 1.20.193.2 bazavan Exp Inetd reads its configuration information from this file upon execution and at some later time if it is reconfigured. A line in the configuration file has the following fields separated by tabs andor spaces: service name as in etcservices socket type either stream or dgram protocol as in etcprotocols waitnowait only applies to datagram sockets, stream sockets should specify nowait user name of user as whom the server should run server program absolute pathname for the server inetd will execute server program args. arguments server program uses as they normally are starting with argv[0] which is the name of the server. See the inetd.conf4 manual page for more information. ARPABerkeley services ftp stream tcp nowait root etcftpd ftpd −l telnet stream tcp nowait root etctelnetd telnetd Before uncommenting the tftp entry below, please make sure that you have a tftp user in etcpasswd. If you dont have one, please consult the tftpd1M manual entry for information about setting up this service. tftp dgram udp wait root etctftpd tftpd bootps dgram udp wait root etcbootpd bootpd finger stream tcp nowait bin etcfingerd fingerd login stream tcp nowait root etcrlogind rlogind shell stream tcp nowait root etcremshd remshd exec stream tcp nowait root etcrexecd rexecd Other HP−UX network services printer stream tcp nowait root usrlibrlpdaemon rlpdaemon −i inetd internal services daytime stream tcp nowait root internal daytime dgram udp nowait root internal time stream tcp nowait root internal time dgram udp nowait root internal ..... rpc services, registered by inetd with portmap Do not uncomment these unless your system is running portmap rpc stream tcp nowait root usretcrpc.rexd 100017 1 rpc.rexd rpc dgram udp wait root usretcrpc.rstatd 100001 1−3 rpc.rstatd ..... pop stream tcp nowait root usrlocaletcpopper popper pop2 stream tcp nowait root usrlocaletcpopper popper ..... 361 name type protocol wait−status uid server arguments The fields in the inetd.conf entry are: Field Meaning name The name of a service, as listed in the etcservices file. type The type of data delivery service used, also called socket type: stream The TCP byte stream delivery service. dgram The UDP packet datagram delivery service. raw The direct IP datagram service. protocol The name of a protocol, as listed in the etcprotocols file. wait−status The value for this field: wait inetd waits for the daemon to release the socket, before it begins to listen for more requests nowait inetd can immediately begin to listen for more requests on that socket Generally, datagram−type daemons require wait, and stream−type daemons require nowait. uid The user name under which the daemon runs usually root. server The full pathname of the daemon started by inetd. For some small services, the value of this field can be internal, because it is more efficient for inetd to perform such services internally than to start an external daemon. arguments These are any command−line arguments that should be passed to the daemon when it is started. When an entry is added into the etcinetd.conf file, special attention should be paid that all entered data are well defined. Does the executable program of the added service reside in the specified path? Is the service name listed appropriately in the etcservices file? inetd must know precisely the port number for where to listen for incoming requests for a new service. The protocol name must also be listed appropriately in the etcprotocols file, etc. Some of the entries in the presented etcinetd.conf file are commented; obviously, the corresponding services are disabled. There is no need to delete an entry, it is sufficient simply to comment the entry out. It is common to disable services that carry any potential security risk, for example: tftp, or finger. On some systems, even very popular applications such as telnet and ftp could be disabled.

15.5.2 Further Improvements and Development