First 1/2 of edits to this section.
Shuffle content into a more logical order and clarify text. Rename a few sub-sections and remove reference to a section that was merged into another section. Sponsored by: iXsystems
This commit is contained in:
Dru Lavigne
parent
2223d9a1a6
commit
c09698e58c
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/head/; revision=43706
2 changed files with 131 additions and 134 deletions
|
|
@ -4232,7 +4232,7 @@ cd /usr/src/etc; make distribution</programlisting>
|
||||||
|
|
||||||
<step>
|
<step>
|
||||||
<para>Enable &man.inetd.8; by following the steps outlined
|
<para>Enable &man.inetd.8; by following the steps outlined
|
||||||
in <xref linkend="network-inetd-settings"/>.</para>
|
in <xref linkend="network-inetd-conf"/>.</para>
|
||||||
</step>
|
</step>
|
||||||
|
|
||||||
<step>
|
<step>
|
||||||
|
|
|
||||||
|
|
@ -132,20 +132,20 @@
|
||||||
-->
|
-->
|
||||||
|
|
||||||
<title>The <application>inetd</application>
|
<title>The <application>inetd</application>
|
||||||
<quote>Super-Server</quote></title>
|
Super-Server</title>
|
||||||
|
|
||||||
<sect2 xml:id="network-inetd-overview">
|
<sect2 xml:id="network-inetd-overview">
|
||||||
<title>Overview</title>
|
|
||||||
|
|
||||||
<para>The &man.inetd.8; daemon is sometimes referred to as the
|
<para>The &man.inetd.8; daemon is sometimes referred to as a
|
||||||
<quote>Internet Super-Server</quote> because it manages
|
Super-Server because it manages
|
||||||
connections for many services. When a connection is received
|
connections for many services. Instead of starting multiple
|
||||||
by <application>inetd</application>, it determines which
|
applications, only the <application>inetd</application> service
|
||||||
program the connection is destined for, spawns the particular
|
needs to be started. When a connection is received
|
||||||
process and delegates the socket to it (the program is invoked
|
for a service that is managed by <application>inetd</application>, it determines which
|
||||||
with the service socket as its standard input, output and
|
program the connection is destined for, spawns a
|
||||||
error descriptors). Running <application>inetd</application>
|
process for that program, and delegates the program a socket.
|
||||||
for servers that are not heavily used can reduce the overall
|
Using <application>inetd</application>
|
||||||
|
for services that are not heavily used can reduce
|
||||||
system load, when compared to running each daemon individually
|
system load, when compared to running each daemon individually
|
||||||
in stand-alone mode.</para>
|
in stand-alone mode.</para>
|
||||||
|
|
||||||
|
|
@ -155,133 +155,44 @@
|
||||||
<application>auth</application>, and
|
<application>auth</application>, and
|
||||||
<application>daytime</application>.</para>
|
<application>daytime</application>.</para>
|
||||||
|
|
||||||
<para>This section covers the basics in configuring
|
<para>This section covers the basics of configuring
|
||||||
<application>inetd</application> through its command-line
|
<application>inetd</application>.</para>
|
||||||
options and its configuration file,
|
|
||||||
<filename>/etc/inetd.conf</filename>.</para>
|
|
||||||
</sect2>
|
|
||||||
|
|
||||||
<sect2 xml:id="network-inetd-settings">
|
|
||||||
<title>Settings</title>
|
|
||||||
|
|
||||||
<para><application>inetd</application> is initialized through
|
|
||||||
the &man.rc.8; system. The <literal>inetd_enable</literal>
|
|
||||||
option is set to <literal>NO</literal> by default. It can be
|
|
||||||
enabled by placing:</para>
|
|
||||||
|
|
||||||
<programlisting>inetd_enable="YES"</programlisting>
|
|
||||||
|
|
||||||
<para>into <filename>/etc/rc.conf</filename>.
|
|
||||||
<application>inetd</application> will now start at boot time.
|
|
||||||
The command:</para>
|
|
||||||
|
|
||||||
<screen>&prompt.root; <userinput>service inetd rcvar</userinput></screen>
|
|
||||||
|
|
||||||
<para>can be run to display the current effective
|
|
||||||
setting.</para>
|
|
||||||
|
|
||||||
<para>Additionally, different command-line options can be passed
|
|
||||||
to <application>inetd</application> via the
|
|
||||||
<literal>inetd_flags</literal> option.</para>
|
|
||||||
</sect2>
|
|
||||||
|
|
||||||
<sect2 xml:id="network-inetd-cmdline">
|
|
||||||
<title>Command-Line Options</title>
|
|
||||||
|
|
||||||
<para>Like most server daemons, <application>inetd</application>
|
|
||||||
has a number of options that it can be passed in order to
|
|
||||||
modify its behaviour. Refer to &man.inetd.8; for
|
|
||||||
the full list of options.</para>
|
|
||||||
|
|
||||||
<para>Options can be passed to <application>inetd</application>
|
|
||||||
using the <literal>inetd_flags</literal> option in
|
|
||||||
<filename>/etc/rc.conf</filename>. By default,
|
|
||||||
<literal>inetd_flags</literal> is set to
|
|
||||||
<literal>-wW -C 60</literal>, which turns on TCP wrapping for
|
|
||||||
<application>inetd</application>'s services, and prevents any
|
|
||||||
single <acronym>IP</acronym> address from requesting any
|
|
||||||
service more than 60 times in any given minute.</para>
|
|
||||||
|
|
||||||
<para>Although we mention rate-limiting options below, novice
|
|
||||||
users may be pleased to note that these parameters usually do
|
|
||||||
not need to be modified. These options may be useful if
|
|
||||||
an excessive amount of connections are being established.
|
|
||||||
A full list of options can be found in
|
|
||||||
&man.inetd.8;.</para>
|
|
||||||
|
|
||||||
<variablelist>
|
|
||||||
<varlistentry>
|
|
||||||
<term>-c maximum</term>
|
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>Specify the default maximum number of simultaneous
|
|
||||||
invocations of each service; the default is unlimited.
|
|
||||||
May be overridden on a per-service basis with the
|
|
||||||
<option>max-child</option> parameter.</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
|
|
||||||
<varlistentry>
|
|
||||||
<term>-C rate</term>
|
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>Specify the default maximum number of times a
|
|
||||||
service can be invoked from a single
|
|
||||||
<acronym>IP</acronym> address in one minute; the default
|
|
||||||
is unlimited. May be overridden on a per-service basis
|
|
||||||
with the
|
|
||||||
<option>max-connections-per-ip-per-minute</option>
|
|
||||||
parameter.</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
|
|
||||||
<varlistentry>
|
|
||||||
<term>-R rate</term>
|
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>Specify the maximum number of times a service can be
|
|
||||||
invoked in one minute; the default is 256. A rate of 0
|
|
||||||
allows an unlimited number of invocations.</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
|
|
||||||
<varlistentry>
|
|
||||||
<term>-s maximum</term>
|
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>Specify the maximum number of times a service can be
|
|
||||||
invoked from a single <acronym>IP</acronym> address at
|
|
||||||
any one time; the default is unlimited. May be
|
|
||||||
overridden on a per-service basis with the
|
|
||||||
<option>max-child-per-ip</option> parameter.</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
</variablelist>
|
|
||||||
</sect2>
|
</sect2>
|
||||||
|
|
||||||
<sect2 xml:id="network-inetd-conf">
|
<sect2 xml:id="network-inetd-conf">
|
||||||
<!-- XXX This section is not very clear and could do with some tlc -->
|
<title>Configuration File</title>
|
||||||
<title><filename>inetd.conf</filename></title>
|
|
||||||
|
|
||||||
<para>Configuration of <application>inetd</application> is
|
<para>Configuration of <application>inetd</application> is
|
||||||
done by editing <filename>/etc/inetd.conf</filename>.</para>
|
done by editing <filename>/etc/inetd.conf</filename>. Each line of this configuration file represents an application
|
||||||
|
which can be started by <application>inetd</application>. By
|
||||||
|
default, every line starts with a comment
|
||||||
|
(<literal>#</literal>), meaning that <application>inetd</application>
|
||||||
|
is not listening for any applications. To configure
|
||||||
|
<application>inetd</application> to listen for an application's
|
||||||
|
connections, remove the <literal>#</literal> at the beginning of
|
||||||
|
the line for that application.</para>
|
||||||
|
|
||||||
<para>When a modification is made to
|
<para>After saving your edits, configure <application>inetd</application>
|
||||||
<filename>/etc/inetd.conf</filename>,
|
to start at system boot by editing <filename>/etc/rc.conf</filename>:</para>
|
||||||
<application>inetd</application> can be forced to re-read its
|
|
||||||
configuration file by running the command:</para>
|
|
||||||
|
|
||||||
<example xml:id="network-inetd-reread">
|
<programlisting>inetd_enable="YES"</programlisting>
|
||||||
<title>Reloading the <application>inetd</application>
|
|
||||||
Configuration File</title>
|
|
||||||
|
|
||||||
<screen>&prompt.root; <userinput>service inetd reload</userinput></screen>
|
<para>To start
|
||||||
</example>
|
<application>inetd</application> now, so that it listens for
|
||||||
|
the service you configured, type:</para>
|
||||||
|
|
||||||
<para>Each line of the configuration file specifies an
|
<screen>&prompt.root; <userinput>service inetd start</userinput></screen>
|
||||||
individual daemon. Comments in the file are preceded by a
|
|
||||||
<quote>#</quote>. The format of each entry in
|
<para>Typically, the default entry for an application does not
|
||||||
<filename>/etc/inetd.conf</filename> is as follows:</para>
|
need to be edited beyond removing the <literal>#</literal>.
|
||||||
|
In some situations, it may be appropriate to edit the default
|
||||||
|
entry.</para>
|
||||||
|
|
||||||
|
<para>As an example, this is the default entry for &man.ftpd.8; using IPv4:</para>
|
||||||
|
|
||||||
|
<programlisting>ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l</programlisting>
|
||||||
|
|
||||||
|
<para>The seven columns in an entry are as follows:</para>
|
||||||
|
|
||||||
<programlisting>service-name
|
<programlisting>service-name
|
||||||
socket-type
|
socket-type
|
||||||
|
|
@ -291,10 +202,7 @@ user[:group][/login-class]
|
||||||
server-program
|
server-program
|
||||||
server-program-arguments</programlisting>
|
server-program-arguments</programlisting>
|
||||||
|
|
||||||
<para>An example entry for the &man.ftpd.8; daemon using IPv4
|
<para>where:</para>
|
||||||
might read:</para>
|
|
||||||
|
|
||||||
<programlisting>ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l</programlisting>
|
|
||||||
|
|
||||||
<variablelist>
|
<variablelist>
|
||||||
<varlistentry>
|
<varlistentry>
|
||||||
|
|
@ -489,6 +397,95 @@ server-program-arguments</programlisting>
|
||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
</variablelist>
|
</variablelist>
|
||||||
|
|
||||||
|
<para>When a modification is made to
|
||||||
|
<filename>/etc/inetd.conf</filename>,
|
||||||
|
<application>inetd</application> can be forced to re-read its
|
||||||
|
configuration file by running the command:</para>
|
||||||
|
|
||||||
|
<example xml:id="network-inetd-reread">
|
||||||
|
<title>Reloading the <application>inetd</application>
|
||||||
|
Configuration File</title>
|
||||||
|
|
||||||
|
<screen>&prompt.root; <userinput>service inetd reload</userinput></screen>
|
||||||
|
</example>
|
||||||
|
</sect2>
|
||||||
|
|
||||||
|
<sect2 xml:id="network-inetd-cmdline">
|
||||||
|
<title>Command-Line Options</title>
|
||||||
|
|
||||||
|
<para>Additionally, different command-line options can be passed
|
||||||
|
to <application>inetd</application> via the
|
||||||
|
<literal>inetd_flags</literal> option.</para>
|
||||||
|
<para>Like most server daemons, <application>inetd</application>
|
||||||
|
has a number of options that it can be passed in order to
|
||||||
|
modify its behaviour. Refer to &man.inetd.8; for
|
||||||
|
the full list of options.</para>
|
||||||
|
|
||||||
|
<para>Options can be passed to <application>inetd</application>
|
||||||
|
using the <literal>inetd_flags</literal> option in
|
||||||
|
<filename>/etc/rc.conf</filename>. By default,
|
||||||
|
<literal>inetd_flags</literal> is set to
|
||||||
|
<literal>-wW -C 60</literal>, which turns on TCP wrapping for
|
||||||
|
<application>inetd</application>'s services, and prevents any
|
||||||
|
single <acronym>IP</acronym> address from requesting any
|
||||||
|
service more than 60 times in any given minute.</para>
|
||||||
|
|
||||||
|
<para>Although we mention rate-limiting options below, novice
|
||||||
|
users may be pleased to note that these parameters usually do
|
||||||
|
not need to be modified. These options may be useful if
|
||||||
|
an excessive amount of connections are being established.
|
||||||
|
A full list of options can be found in
|
||||||
|
&man.inetd.8;.</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term>-c maximum</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specify the default maximum number of simultaneous
|
||||||
|
invocations of each service; the default is unlimited.
|
||||||
|
May be overridden on a per-service basis with the
|
||||||
|
<option>max-child</option> parameter.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>-C rate</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specify the default maximum number of times a
|
||||||
|
service can be invoked from a single
|
||||||
|
<acronym>IP</acronym> address in one minute; the default
|
||||||
|
is unlimited. May be overridden on a per-service basis
|
||||||
|
with the
|
||||||
|
<option>max-connections-per-ip-per-minute</option>
|
||||||
|
parameter.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>-R rate</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specify the maximum number of times a service can be
|
||||||
|
invoked in one minute; the default is 256. A rate of 0
|
||||||
|
allows an unlimited number of invocations.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>-s maximum</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specify the maximum number of times a service can be
|
||||||
|
invoked from a single <acronym>IP</acronym> address at
|
||||||
|
any one time; the default is unlimited. May be
|
||||||
|
overridden on a per-service basis with the
|
||||||
|
<option>max-child-per-ip</option> parameter.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
</sect2>
|
</sect2>
|
||||||
|
|
||||||
<sect2 xml:id="network-inetd-security">
|
<sect2 xml:id="network-inetd-security">
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue