inetd

inetd(internetservicedaemon) is asuper-serverdaemonon manyUnixsystems that providesInternetservices. For each configured service, it listens for requests from connecting clients. Requests are served by spawning a process which runs the appropriate executable, but simple services such asechoare served by inetd itself. External executables, which are run on request, can be single- ormulti-threaded.First appearing in4.3BSD,it is generally located at/usr/sbin/inetd.inetd is based on the (service) activator pattern

Function

Often called asuper-server,inetd listens on designatedportsused by Internet services such asFTP,POP3,andtelnet.When aTCPpacket orUDPpacket arrives with a particular destination port number, inetd launches the appropriate server program to handle the connection. For services that are not expected to run with high loads, this method uses memory more efficiently, since the specific servers run only when needed. Furthermore, in inetd's "nowait" mode of service management, no network code is required in the service-specific programs, as inetd hooks the network stream directly tostdinandstdoutof the spawned process. For protocols that have frequent traffic, such asHTTPand POP3, either inetd's "wait" mode of operation, or a dedicated server that intercepts the traffic directly may be preferable.

Setup

The list of services that will be serviced is given in a configuration file, usually/etc/inetd.conf.AGUIfor managing the configuration file is an optional accessory. The daemon may need a signal in order to re-read its configuration. For an example,telnetcan be configured as follows (line taken from a machine runningAIXversion 5.1):

telnet stream tcp6 nowait root /usr/sbin/telnetd telnetd -a

The first word,telnet,is the official name of the service. It is resolved using the system database to map port numbers and protocols to service names. In this case,/etc/servicesshould contain:

telnet 23/tcp

The second and third words describe the type of socket and underlying protocol respectively. The/etc/protocolsdatabase is consulted.

The fourth word is the wait/nowait switch. A single-threaded server expects inetd to wait until it finishes reading all the data. Otherwise inetd lets the server run and spawns new, concurrent processes for new requests.

The fifth word is the user name, from the/etc/passwddatabase, that the service program should run as.

Finally, the path and the arguments of an external program are given. As usual, the first argument is the program name. In the example, inetd is told to launch the program/usr/sbin/telnetdwith the command line argumentstelnetd -a.inetd automatically hooks the socket to stdin, stdout, and stderr of the server program.

Generally TCP sockets are handled by spawning a separate server to handle each connection concurrently. UDP sockets are generally handled by a single server instance that handles all packets on that port.

Some simple services, such asecho,are handled directly by inetd, without spawning an external server.

Creating an inetd service

This is a simple inetd service, written inC.It expects a command line argument containing a filename for a log file, and then it logs all strings sent through the socket to the log file. Note that this is a very insecure example program.

#include<stdio.h>
#include<stdlib.h>

intmain(intargc,char**argv)
{
constchar*fn=argv[1];
FILE*fp=fopen(fn,"a+");
if(fp==NULL)
exit(EXIT_FAILURE);

charstr[4096];
/* inetd passes its information to us in stdin. */
while(fgets(str,sizeofstr,stdin)){
fputs(str,fp);
fflush(fp);
}
fclose(fp);
return0;
}

The example usesstdiofunctions and it responds to network traffic coming in on stdin. In this case, we want all messages logged to a single file, so we only want one instance of the service running to service all requests. This means UDP is the correct protocol to use. First, an unused port number must be selected. In this sample, 9999 will be used. The/etc/servicesentry will look like this:

errorLogger 9999/udp

And the entry in/etc/inetd.confwill look like this:

errorLogger dgram udp wait root /usr/local/bin/errlogd errlogd /tmp/logfile.txt

This tells inetd to run the/usr/local/bin/errlogdprogram, with the commandline:errlogd /tmp/logfile.txt(refer to the inetd.confman pagefor information on the other arguments). The first argument contains the filename to be used for the log file:/tmp/logfile.txt.inetd will run the service when needed, and attach port 9999 to the input and output streams, and all strings sent to that port will be logged to the file. By specifyingwait,it tells inetd to only use one instance of the server to handle all requests.

Note: the functionality of the above example is usually implemented by usingsyslogand a process like syslogd. syslogd would normally be started in parallel with inetd, not as an inetd service.

inetd replacements

In recent years, because of the security limitations in the original design of inetd, it has been replaced byxinetd,rlinetd,ucspi-tcp,and others in many systems. Distributions ofLinuxespecially have many options andMac OS X(beginning withMac OS X v10.2) usesxinetd.As of versionMac OS X v10.4,Apple has merged the functionality of inetd intolaunchd.

The services provided by inetd can be omitted entirely. This is becoming more common where machines are dedicated to a single function. For example, an HTTP server could be configured to just runhttpdand have no other ports open. A dedicated firewall could have no services started.

systemdsupports inetd services, and expands socket activation beyond IP messaging (AF INET+6) to includeAF UNIX,AF NETLINKand more.

Security concerns

While the inetd concept as a service dispatcher is not inherently insecure, the long list of services that inetd traditionally provided gave computer security experts pause. The possibility of a service having an exploitable flaw, or the service just being abused, had to be considered. Unnecessary services being disabled and "off by default" became the mantra. It is not uncommon to find an/etc/inetd.confwith almost all the servicescommented outin a modern Unix distribution.

See also

• TCP Wrapper
• xinetd
• List of TCP and UDP port numbers
• Svchost.exe

External links

• inetd(8):internet 'super-server' –FreeBSDSystem Manager'sManual