Administrator's Guide

The inetd daemon is usually started automatically by the /sbin/init.d/inetd
script as part of the boot process.
The inetd daemon monitors for connection requests for the services listed in the /etc/
inetd.conf configuration file, and spawns the appropriate server on receiving a
request. In other words, users connect to remote systems by using an Internet Service,
such as telnet. The inetd daemon determines if a telnet connection from the host
is allowed before completing the connection. The host information for allowing or denying
access is in the /var/adm/inetd.sec file.
The inetd daemon works as follows:
1. Starts at run level 2 during system boot. (if the following command is in the system
startup script: /sbin/init.d/inetd start)
2. Checks /etc/inetd.conf to determine which services to provide. For more
information, see ftp(1) and inetd.conf(4).
3. Checks /etc/services to determine which ports to monitor for the services listed
in /etc/inetd.conf. The /etc/services file maps service names to port
numbers. For more information, see services(4).
4. Receives an Internet Service connection request from a client. For example, someone
runs telnet.
5. Consults /var/adm/inetd.sec to determine if the client is permitted access. For
more information, see inetd.sec(4).
6. Logs the request in /var/adm/syslog/syslog.log if logging is enabled. For
more information, see syslogd(1M).
7. If inetd refuses the connection for security reasons, the connection is shut down.
8. If the connection request is valid, inetd starts a server process to handle the valid
connection request. The server process can have other security features in addition
to inetd.
4.2.1 Securing inetd
The /etc/inetd.conf file is the inetd configuration file, which lists the services that
the inetddaemon can start. Each service listed in /etc/inetd.conf must also appear
in the /etc/services file. The /etc/services file maps service names to port
numbers. Each port number has an associated protocol name, such as tcp or udp. Every
entry for a protocol must have a matching entry in the /etc/protocols file.
The following suggestions can make inetd more secure:
• Enable inetd logging in /etc/rc.config.d/netdaemons. For more
information, see rc.config.d(4).
• Review /etc/inetd.conf and /etc/services for changes. An unauthorized
user might have gained root access and modified the /etc/services and /etc/
inetd.conf files. In /etc/inetd.conf, look for names of services you are not
using. In /etc/services, look for port numbers that are not registered with the
4.2 The inetd Daemon 71