1 .\" Copyright (c) 1985, 1991, 1993, 1994
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .Dd September 29, 2022
44 .Op Ar configuration_file
48 utility should be run at boot time by
52 It then listens for connections on certain
54 When a connection is found on one
55 of its sockets, it decides what service the socket
56 corresponds to, and invokes a program to service the request.
57 The server program is invoked with the service socket
58 as its standard input, output and error descriptors.
62 continues to listen on the socket (except in some cases which
63 will be described below).
66 allows running one daemon to invoke several others,
67 reducing load on the system.
69 The following options are available:
70 .Bl -tag -width indent
72 Specify one specific IP address to bind to.
73 Alternatively, a hostname can be specified,
74 in which case the IPv4 or IPv6 address
75 which corresponds to that hostname is used.
76 Usually a hostname is specified when
80 in which case the hostname corresponds to that of the
84 When the hostname specification is used
85 and both IPv4 and IPv6 bindings are desired,
86 one entry with the appropriate
89 is required for each service in
92 a TCP-based service would need two entries,
99 See the explanation of the
104 Specify the default maximum number of times a service can be invoked
105 from a single IP address in one minute; the default is unlimited.
106 May be overridden on a per-service basis with the
107 "max-connections-per-ip-per-minute" parameter.
109 Specify the default maximum number of
110 simultaneous invocations of each service;
111 the default is unlimited.
112 May be overridden on a per-service basis with the "max-child"
117 Turn on logging of successful connections.
119 Specify an alternate file in which to store the process ID.
121 Specify the maximum number of times a service can be invoked
122 in one minute; the default is 256.
123 A rate of 0 allows an unlimited number of invocations.
125 Specify the default maximum number of
126 simultaneous invocations of each service from a single IP address;
127 the default is unlimited.
128 May be overridden on a per-service basis with the "max-child-per-ip"
131 Turn on TCP Wrapping for internal services which are built in to
134 Turn on TCP Wrapping for external services.
136 .Sx "IMPLEMENTATION NOTES"
137 section for more information on TCP Wrappers support.
142 reads its configuration information from a configuration
143 file which, by default, is
144 .Pa /etc/inetd.conf .
145 There must be an entry for each field of the configuration
146 file, with entries for each field separated by a tab or
148 Comments are denoted by a
152 There must be an entry for each field.
154 fields of the configuration file are as follows:
156 .Bd -unfilled -offset indent -compact
160 {wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]
161 user[:group][/login-class]
163 server-program-arguments
168 service, the entry would contain these fields:
170 .Bd -unfilled -offset indent -compact
174 {wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]
175 user[:group][/login-class]
177 server-program-arguments
180 There are two types of services that
182 can start: standard and TCPMUX.
183 A standard service has a well-known port assigned to it;
184 it may be a service that implements an official Internet standard or is a
189 TCPMUX services are nonstandard services that do not have a
190 well-known port assigned to them.
191 They are invoked from
193 when a program connects to the
195 well-known port and specifies
197 This feature is useful for adding locally-developed servers.
198 TCPMUX requests are only accepted when the multiplexor service itself
199 is enabled, above and beyond and specific TCPMUX-based servers; see the
200 discussion of internal services below.
204 entry is the name of a valid service in
207 or the specification of a
209 domain socket (see below).
212 services (discussed below), the service
215 be the official name of the service (that is, the first entry in
216 .Pa /etc/services ) .
217 When used to specify an
219 service, this field is a valid RPC service name listed in
222 The part on the right of the
224 is the RPC version number.
226 can simply be a single numeric argument or a range of versions.
227 A range is bounded by the low version to the high version -
229 For TCPMUX services, the value of the
231 field consists of the string
233 followed by a slash and the
234 locally-chosen service name.
235 The service names listed in
240 Try to choose unique names for your TCPMUX services by prefixing them with
241 your organization's name and suffixing them with a version number.
252 depending on whether the socket is a stream, datagram, raw,
253 reliably delivered message, or sequenced packet socket.
254 TCPMUX services must use
259 must be a valid protocol or
265 both of which imply IPv4 for backward compatibility.
280 specify that the entry accepts both IPv4 and IPv6 connections
285 are specified with the
290 One can use specify IPv4 and/or IPv6 with the 4, 6 or 46 suffix, for example
294 TCPMUX services must use
303 entry specifies whether the server that is invoked by
306 the socket associated with the service access point, and thus whether
308 should wait for the server to exit before listening for new service
310 Datagram servers must use
312 as they are always invoked with the original datagram socket bound
313 to the specified service address.
314 These servers must read at least one datagram from the socket
316 If a datagram server connects
317 to its peer, freeing the socket so
319 can receive further messages on the socket, it is said to be
323 it should read one datagram from the socket and create a new socket
324 connected to the peer.
325 It should fork, and the parent should then exit
328 to check for new service requests to spawn new servers.
329 Datagram servers which process all incoming datagrams
330 on a socket and eventually time out are said to be
331 .Dq single-threaded .
336 utilities are examples of the latter type of
340 utility is an example of a multi-threaded datagram server.
342 Servers using stream sockets generally are multi-threaded and
346 Connection requests for these services are accepted by
348 and the server is given only the newly-accepted socket connected
349 to a client of the service.
350 Most stream-based services operate in this manner.
351 Stream-based servers that use
353 are started with the listening service socket, and must accept
354 at least one connection request before exiting.
355 Such a server would normally accept and process incoming connection
356 requests until a timeout.
357 TCPMUX services must use
360 The maximum number of outstanding child processes (or
364 service may be explicitly specified by appending a
366 followed by the number to the
370 (or if a value of zero is specified) there is no maximum.
372 once the maximum is reached, further connection attempts will be
373 queued up until an existing child process exits.
377 mode, although a value other than one (the
378 default) might not make sense in some cases.
379 You can also specify the maximum number of connections per minute
380 for a given IP address by appending
383 followed by the number to the maximum number of
384 outstanding child processes.
385 Once the maximum is reached, further
386 connections from this IP address will be dropped until the end of the
388 In addition, you can specify the maximum number of simultaneous
389 invocations of each service from a single IP address by appending a
391 followed by the number to the maximum number of outstanding child
393 Once the maximum is reached, further connections from this
394 IP address will be dropped.
398 entry should contain the user name of the user as whom the server
400 This allows for servers to be given less permission
406 allows a group name other
407 than the default group for this user to be specified.
412 allows specification of a login class other
419 entry should contain the pathname of the program which is to be
422 when a request is found on its socket.
425 provides this service internally, this entry should
430 .Em server-program-arguments
431 entry lists the arguments to be passed to the
433 starting with argv[0], which usually is the name of
435 If the service is provided internally, the
437 of the service (and any arguments to it) or the word
439 should take the place of this entry.
441 Currently, the only internal service to take arguments is
443 Without options, the service will always return
444 .Dq ERROR\ : HIDDEN-USER .
445 The available arguments to this service that alter its behavior are:
446 .Bl -tag -width indent
456 option discussed below),
457 return this username instead of an error
459 for either socket credentials or the username.
463 return this username for every request.
464 This is primarily useful when running this service on a NAT machine.
468 but without the restriction that the username in
470 must not match an existing user.
474 exists in the home directory of the identified user, report the username
475 found in that file instead of the real username.
476 If the username found in
478 is that of an existing user,
479 then the real username is reported.
482 flag is also given then the username in
484 is checked against existing user IDs instead.
487 the user's name to the ident requester,
489 username made up of random alphanumeric characters,
494 flag overrides not only the user names,
495 but also any fallback name,
501 Return numeric user IDs instead of usernames.
505 exists in the home directory of the identified user, return
506 .Dq ERROR\ : HIDDEN-USER .
509 file which might exist.
513 instead of the name of the system as reported by
518 service, as per RFC 1413.
519 All the remaining flags apply only in this case.
521 .Ar sec Ns Op Cm \&. Ns Ar usec
523 Specify a timeout for the service.
524 The default timeout is 10.0 seconds.
529 utility also provides several other
531 services internally by use of
532 routines within itself.
537 (character generator),
539 (human readable time), and
541 (machine readable time, in the form of the number of seconds since
542 midnight, January 1, 1900).
543 All of these services are available in
544 both TCP and UDP versions; the UDP versions will refuse service if the
545 request specifies a reply port corresponding to any internal service.
546 (This is done as a defense against looping attacks; the remote IP address
548 For details of these services, consult the
553 The TCPMUX-demultiplexing service is also implemented as an internal service.
554 For any TCPMUX-based service to function, the following line must be included
557 .Bd -literal -offset indent
558 tcpmux stream tcp nowait root internal
565 will log an entry to syslog each time a connection is accepted, noting the
566 service selected and the IP-number of the remote requester if available.
567 Unless otherwise specified in the configuration file,
568 and in the absence of the
580 utility rereads its configuration file when it receives a hangup signal,
582 Services may be added, deleted or modified when the configuration file
584 Except when started in debugging mode,
585 or configured otherwise with the
589 records its process ID in the file
590 .Pa /var/run/inetd.pid
591 to assist in reconfiguration.
592 .Sh IMPLEMENTATION NOTES
598 will wrap all services specified as
607 option is given, such
609 services will be wrapped.
610 If both options are given, wrapping for both
611 internal and external services will be enabled.
612 Either wrapping option
613 will cause failed connections to be logged to the
618 flag to the wrapping options will include successful connections in the
625 only wraps requests for a
627 service while no servers are available to service requests.
629 connection to such a service has been allowed,
632 over subsequent connections to the service until no more servers
633 are left listening for connection requests.
635 When wrapping is enabled, the
637 daemon is not required, as that functionality is builtin.
638 For more information on TCP Wrappers, see the relevant documentation
639 .Pq Xr hosts_access 5 .
640 When reading that document, keep in mind that
642 services have no associated daemon name.
643 Therefore, the service name
646 should be used as the daemon name for
651 describes the TCPMUX protocol:
652 ``A TCP client connects to a foreign host on TCP port 1.
654 service name followed by a carriage-return line-feed <CRLF>.
656 service name is never case sensitive.
657 The server replies with a
658 single character indicating positive (+) or negative (\-)
659 acknowledgment, immediately followed by an optional message of
660 explanation, terminated with a <CRLF>.
661 If the reply was positive,
662 the selected protocol begins; otherwise the connection is closed.''
663 The program is passed the TCP connection as file descriptors 0 and 1.
665 If the TCPMUX service name begins with a
668 returns the positive reply for the program.
669 This allows you to invoke programs that use stdin/stdout
670 without putting any special server code in them.
672 The special service name
676 to list the TCPMUX services which are enabled in
679 The implementation includes a tiny hack
680 to support IPsec policy settings for each socket.
681 A special form of comment line, starting with
683 is interpreted as a policy specifier.
686 will be used as an IPsec policy string,
688 .Xr ipsec_set_policy 3 .
690 policy specifier is applied to all the following lines in
692 until the next policy specifier.
693 An empty policy specifier resets the IPsec policy.
695 If an invalid IPsec policy specifier appears in
698 will provide an error message via the
700 interface and abort execution.
701 .Ss Ux Domain Sockets
702 In addition to running services on IP sockets,
707 To do this you specify a
721 The specification of the socket must be
722 an absolute path name,
723 optionally prefixed by an owner and mode
725 .Em ":user:group:mode\&:" .
728 .Dl ":news:daemon:220:/var/run/sock"
730 creates a socket owned
735 with permissions allowing only that user and group to connect.
736 The default owner is the user that
739 The default mode only allows the socket's owner to connect.
746 must change the ownership and permissions on the socket.
747 This can only be done securely if
748 the directory in which the socket is created
749 is writable only by root.
754 to create sockets in world writable directories
759 or a similar directory instead.
761 Internal services may be run on
763 domain sockets, in the usual way.
765 the name of the internal service
767 the last component of the socket's pathname.
768 For example, specifying a socket named
772 service when a connection is received on that socket.
774 .Bl -tag -width /var/run/inetd.pid -compact
775 .It Pa /etc/inetd.conf
777 .It Pa /etc/netconfig
778 network configuration data base
780 translation of service names to RPC program numbers
782 translation of service names to port numbers
783 .It Pa /var/run/inetd.pid
784 the pid of the currently running
788 Examples for a variety of services are available in
789 .Pa /etc/inetd.conf .
791 It includes examples for
809 .Nm prometheus_sysctl_exporter ,
818 The internal services provided by
820 for daytime, time, echo, discard and chargen are also
821 included, as well as chargen for
823 Authentication Headers
825 Examples for handling auth requests via
827 are similarly included.
832 logs error messages using
834 Important error messages and their explanations are:
838 .Ar service Ns / Ns Ar protocol
839 .No "server failing (looping), service terminated."
841 The number of requests for the specified service in the past minute
843 The limit exists to prevent a broken program
844 or a malicious user from swamping the system.
845 This message may occur for several reasons:
846 .Bl -enum -offset indent
848 There are many hosts requesting the service within a short time period.
850 A broken client program is requesting the service too frequently.
852 A malicious user is running a program to invoke the service in
853 a denial-of-service attack.
855 The invoked service program has an error that causes clients
862 as described above, to change the rate limit.
863 Once the limit is reached, the service will be
864 reenabled automatically in 10 minutes.
867 .Ar service Ns / Ns Ar protocol :
873 .Ar service Ns / Ns Ar protocol :
886 (re)reads the configuration file.
887 The second message occurs when the
900 The user or group ID for the entry's
904 .It "setsockopt(SO_PRIVSTATE): Operation not supported"
907 utility attempted to renounce the privileged state associated with a
908 socket but was unable to.
915 No entry was found for either
928 No entry was found for either
937 .Xr cvs 1 Pq Pa ports/devel/opencvs ,
940 .Xr ipsec_set_policy 3 ,
943 .Xr hosts_options 5 ,
953 .Xr imapd 8 Pq Pa ports/mail/courier-imap ,
954 .Xr nmbd 8 Pq Pa ports/net/samba412 ,
961 .Xr prometheus_sysctl_exporter 8 ,
962 .Xr smbd 8 Pq Pa ports/net/samba412 ,
964 .Xr telnetd 8 Pq Pa ports/net/freebsd-telnetd ,
966 .Xr uucpd 8 Pq Pa ports/net/freebsd-uucp
968 .%A Michael C. St. Johns
969 .%T Identification Protocol
977 TCPMUX is based on code and documentation by Mark Lottor.
979 ONC RPC-based services is modeled after that
983 The IPsec hack was contributed by the KAME project in 1999.
986 TCP Wrappers support first appeared in