xinetd

https://github.com/xinetd-org/xinetd
Admin
xinetd is a powerful replacement for inetd that provides advanced access control mechanisms,...
Tokens:7,200
Snippets:42
Trust Score:5.6
Update:6 months ago
Show doc for...
Tokens:
Raw
### Start xinetd Daemon with Options

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Use these commands to start the xinetd daemon with various configurations, including specifying configuration files, logging methods, debug modes, and operational parameters.

```bash
xinetd
```

```bash
xinetd -f /etc/xinetd.conf
```

```bash
xinetd -syslog daemon
```

```bash
xinetd -filelog /var/log/xinetd.log
```

```bash
xinetd -d
```

```bash
xinetd -dontfork
```

```bash
xinetd -stayalive
```

```bash
xinetd -limit 100
```

```bash
xinetd -pidfile /var/run/xinetd.pid
```

```bash
xinetd -inetd_compat
```

```bash
xinetd -cc 60
```

```bash
xinetd -version
```

--------------------------------

### External TCP Service Configuration Example (telnet)

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Configure an external TCP service like telnet in a file within /etc/xinetd.d/. This example shows settings for socket type, protocol, user, server path, arguments, access control, logging, and resource limits.

```bash
# /etc/xinetd.d/telnet
service telnet
{
    # Enable or disable the service
    disable         = no

    # Socket type: stream (TCP), dgram (UDP), raw, seqpacket
    socket_type     = stream

    # Protocol (optional if socket_type specified)
    protocol        = tcp

    # Multi-threaded (no) vs single-threaded (yes)
    wait            = no

    # User to run the server as
    user            = root

    # Server executable path
    server          = /usr/sbin/in.telnetd

    # Server arguments (do NOT include argv[0])
    server_args     = -h

    # Nice value for process priority
    nice            = 10

    # Access control - allow only these networks
    only_from       = 192.168.1.0/24 10.0.0.0/8

    # Deny these hosts
    no_access       = 192.168.1.100

    # Time-based access control (24-hour format)
    access_times    = 08:00-18:00

    # Maximum concurrent instances
    instances       = 20

    # Logging options
    log_on_success  += USERID DURATION
    log_on_failure  += USERID

    # Resource limits
    rlimit_as       = 8M
    rlimit_cpu      = 60
}

```

--------------------------------

### Configure SSH Service Interface Binding

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Examples for binding SSH services to specific network interfaces with distinct access controls.

```bash
# /etc/xinetd.d/ssh-internal
# SSH only on internal interface
service ssh
{
    disable         = no
    id              = ssh-internal
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/sshd
    server_args     = -i

    # Bind to internal interface IP only
    bind            = 192.168.1.1

    # Allow from internal networks
    only_from       = 192.168.1.0/24 10.0.0.0/8
}
```

```bash
# /etc/xinetd.d/ssh-external
# Different SSH config on external interface
service ssh
{
    disable         = no
    id              = ssh-external
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/sshd
    server_args     = -i

    # Bind to external interface
    bind            = 203.0.113.1

    # Stricter access control for external
    only_from       = 198.51.100.0/24

    # Lower instance limit
    instances       = 5
    per_source      = 2
}
```

--------------------------------

### Configure TCPMUX Services

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Setup for port multiplexing services as defined in RFC 1078, including the main entry and custom service definitions.

```bash
# /etc/xinetd.d/tcpmux
# Main TCPMUX service entry (required)
service tcpmux
{
    disable         = no
    type            = INTERNAL
    id              = tcpmux
    socket_type     = stream
    protocol        = tcp
    wait            = no
    user            = root
}
```

```bash
# /etc/xinetd.d/myservice-tcpmux
# A service accessible via TCPMUX
service myorg_custom_service
{
    disable         = no

    # TCPMUX: server handles protocol handshake
    # TCPMUXPLUS: xinetd handles handshake automatically
    type            = TCPMUX

    socket_type     = stream
    protocol        = tcp
    wait            = no
    user            = myuser

    server          = /usr/local/bin/my_server
    server_args     = --config /etc/myserver.conf
}
```

```bash
# Client connection example:
# $ telnet localhost 1
# Trying 127.0.0.1...
# Connected to localhost.
# myorg_custom_service
# +OK Service ready
```

--------------------------------

### Validate and Test Configuration

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Verify syntax, check listening ports, and test connectivity for TCP/UDP services.

```bash
# Check configuration syntax (run in debug mode briefly)
xinetd -d -f /etc/xinetd.conf &
PID=$!
sleep 2
kill $PID

# Test specific service
# First, verify it's listening
netstat -tlnp | grep xinetd
ss -tlnp | grep xinetd

# Test TCP service connection
telnet localhost 21  # FTP
nc -v localhost 22   # SSH

# Test UDP service
echo "test" | nc -u localhost 69  # TFTP

# Check internal state
kill -USR1 $(cat /var/run/xinetd.pid)
cat /var/run/xinetd.dump

# Monitor logs
tail -f /var/log/xinetd.log
journalctl -u xinetd -f

# Test access control
# From allowed host:
telnet allowed-server.example.com 23

# From denied host (should fail):
telnet denied-host.example.com 23
```

--------------------------------

### Configure File-Based Logging with Size Limits

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Set up detailed file-based logging for services, including soft and hard size limits. Specify what events to log on success and failure.

```bash
# In defaults or per-service
defaults
{
    # Log to file with soft and hard limits
    # Format: FILE <path> [soft_limit] [hard_limit]
    log_type        = FILE /var/log/xinetd.log 1M 2M

    # What to log on successful connections
    # PID - server process ID
    # HOST - remote host address
    # USERID - remote user (requires ident server)
    # EXIT - exit status or signal
    # DURATION - session duration
    # TRAFFIC - bytes transferred (redirect services only)
    log_on_success  = PID HOST DURATION EXIT

    # What to log on failed connections
    # HOST - remote host address
    # USERID - remote user
    # ATTEMPT - log the attempt (implied by others)
    log_on_failure  = HOST USERID ATTEMPT
}
```

```bash
# Per-service syslog logging
service ssh
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/sshd
    server_args     = -i

    # Log to syslog authpriv facility at info level
    log_type        = SYSLOG authpriv info
    log_on_success  = PID HOST USERID EXIT DURATION
    log_on_failure  = HOST USERID ATTEMPT
}
```

--------------------------------

### Configure RPC Services

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Template for RPC-based services, requiring specific type, protocol, and version definitions.

```bash
# /etc/xinetd.d/rstatd
service rstatd
{
    disable         = no

    # RPC service type
    type            = RPC

    # RPC services use UDP typically
    socket_type     = dgram
    protocol        = udp

    # RPC services are usually single-threaded
    wait            = yes

    user            = root
    server          = /usr/sbin/rpc.rstatd

    # RPC version range
    rpc_version     = 2-4

    # For unlisted RPC services, specify the program number
    # rpc_number    = 100001

    # Access control
    only_from       = 192.168.1.0/24

    # Environment for RPC services
    env             = LD_LIBRARY_PATH=/usr/local/lib
}
```

--------------------------------

### Configure a Custom Service with xinetd

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Define a custom service with specific port, user, environment variables, and resource limits. Ensure the port is specified for unlisted services.

```bash
service my_custom_app
{
    disable         = no

    # UNLISTED for services not in /etc/services
    type            = UNLISTED

    socket_type     = stream
    protocol        = tcp
    wait            = no
    user            = appuser
    group           = appgroup

    # Port is REQUIRED for unlisted services
    port            = 9999

    server          = /opt/myapp/bin/server
    server_args     = --daemon-mode

    # Custom environment
    env             = APP_HOME=/opt/myapp
    env             = APP_CONFIG=/etc/myapp.conf

    # Pass minimal environment
    passenv         = PATH

    # Resource limits
    rlimit_as       = 256M
    rlimit_cpu      = 300
    rlimit_data     = 128M
    rlimit_stack    = 8M

    # Logging
    log_type        = FILE /var/log/myapp-xinetd.log 1M 2M
    log_on_success  = PID HOST EXIT DURATION
    log_on_failure  = HOST ATTEMPT
}
```

--------------------------------

### Configure FTP Service with TCP Wrappers

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Defines an FTP service with specific environment variables, access times, and TCP wrapper integration.

```bash
# /etc/xinetd.d/ftp
service ftp
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = root

    # Server executable
    server          = /usr/sbin/vsftpd
    server_args     = /etc/vsftpd/vsftpd.conf

    # Nice value (lower priority)
    nice            = 10

    # Instance limits
    instances       = 4
    per_source      = 2

    # Enhanced logging
    log_on_success  = PID HOST DURATION EXIT USERID
    log_on_failure  = HOST USERID ATTEMPT

    # Access control
    only_from       = 0.0.0.0/0

    # Time restrictions - available during work hours and evenings
    access_times    = 2:00-9:00 12:00-24:00

    # Environment variables passed to server
    env             = LD_LIBRARY_PATH=/usr/local/lib
    env             = FTP_CONFIG=/etc/ftp.conf

    # Pass specific variables from xinetd's environment
    passenv         = PATH TERM

    # Override libwrap service name for hosts.allow/deny
    libwrap         = vsftpd
}
```

--------------------------------

### Convert inetd.conf to xinetd

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Use the xconv.pl script to migrate legacy inetd configurations or enable compatibility mode.

```bash
# Convert inetd.conf to xinetd format
./xconv.pl < /etc/inetd.conf > /etc/xinetd.conf

# Or use inetd compatibility mode (reads both config files)
xinetd -inetd_compat -f /etc/xinetd.conf

# Example inetd.conf entry:
# ftp  stream  tcp  nowait  root  /usr/sbin/tcpd  in.ftpd -l -a

# Converts to xinetd format:
# service ftp
# {
#     socket_type = stream
#     protocol    = tcp
#     wait        = no
#     user        = root
#     server      = /usr/sbin/tcpd
#     server_args = in.ftpd -l -a
# }
```

--------------------------------

### Configure Banners for Telnet Service

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Set up banners to be displayed on connection, success, or failure for the telnet service. Ensure correct line endings for banner files.

```bash
# /etc/xinetd.d/telnet-banners
service telnet
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/in.telnetd

    # Banner shown to ALL connections (before access control)
    banner          = /etc/xinetd.d/banners/welcome.txt

    # Banner shown only when access is GRANTED
    banner_success  = /etc/xinetd.d/banners/motd.txt

    # Banner shown when access is DENIED
    banner_fail     = /etc/xinetd.d/banners/denied.txt

    only_from       = 192.168.1.0/24
}
```

```text
# Banner file example (/etc/xinetd.d/banners/denied.txt):
# Note: Use proper line endings (CR-LF for telnet protocol)
#
# ****************************************
# * Access Denied                        *
# * Your IP has been logged              *
# * Contact admin@example.com for access *
# ****************************************
```

--------------------------------

### Configure UDP Service

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Sets up a UDP-based service using the dgram socket type, typically requiring wait=yes for single-threaded execution.

```bash
# /etc/xinetd.d/tftp
service tftp
{
    disable         = no

    # Datagram socket for UDP
    socket_type     = dgram
    protocol        = udp

    # UDP services typically use wait=yes (single-threaded)
    wait            = yes

    user            = nobody
    group           = nogroup

    server          = /usr/sbin/in.tftpd
    server_args     = -s /tftpboot

    # Strict access control for TFTP
    only_from       = 192.168.1.0/24

    # Logging
    log_on_success  = PID HOST
    log_on_failure  = HOST

    # Per-source limit for UDP
    per_source      = 5
}
```

--------------------------------

### Configure IPv6 Services

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Settings for forcing IPv6-only operation or enabling dual-stack support for network services.

```bash
# /etc/xinetd.d/ssh-ipv6
service ssh
{
    disable         = no
    id              = ssh-ipv6
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/sshd
    server_args     = -i

    # Force IPv6 only
    flags           = IPv6

    # IPv6 access control
    only_from       = ::1 2001:db8::/32 fe80::/10

    # Bind to specific IPv6 address
    bind            = 2001:db8::1
}
```

```bash
# /etc/xinetd.d/http-dual-stack
# Service available on both IPv4 and IPv6
service http
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = www-data
    server          = /usr/sbin/httpd

    # IPv6 socket accepts IPv4 mapped addresses by default
    # Use v6only in defaults or per-service to control this
}
```

--------------------------------

### Configure Internal Services

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Defines built-in xinetd services like echo, time, and discard using the INTERNAL type.

```bash
# /etc/xinetd.d/echo-stream - TCP echo service
service echo
{
    disable         = no
    id              = echo-stream
    type            = INTERNAL
    socket_type     = stream
    wait            = no

    # Access restrictions for internal services
    only_from       = localhost 192.168.1.0/24
}

# /etc/xinetd.d/echo-dgram - UDP echo service
service echo
{
    disable         = no
    id              = echo-dgram
    type            = INTERNAL
    socket_type     = dgram
    wait            = no
}

# /etc/xinetd.d/time-stream - RFC 868 time service (TCP)
service time
{
    disable         = no
    id              = time-stream
    type            = INTERNAL
    socket_type     = stream
    wait            = no
}

# /etc/xinetd.d/daytime-stream - RFC 867 daytime service
service daytime
{
    disable         = no
    id              = daytime-stream
    type            = INTERNAL
    socket_type     = stream
    wait            = no
    only_from       = localhost
}

# /etc/xinetd.d/chargen-stream - Character generator service
service chargen
{
    disable         = yes
    id              = chargen-stream
    type            = INTERNAL
    socket_type     = stream
    wait            = no
    # Disabled by default - can be used for DoS attacks
}

# /etc/xinetd.d/discard - Discard/null service
service discard
{
    disable         = no
    id              = discard-stream
    type            = INTERNAL
    socket_type     = stream
    wait            = no
}
```

--------------------------------

### xinetd Global Defaults Configuration

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Define global default settings for all services in the main xinetd.conf file. These settings can be overridden by individual service configurations. Includes logging, rate limiting, instance limits, and IPv6 behavior.

```bash
# /etc/xinetd.conf - Master configuration file

defaults
{
    # Logging configuration
    log_type        = SYSLOG daemon info
    log_on_failure  = HOST
    log_on_success  = PID HOST DURATION EXIT

    # Connection rate limiting - 50 connections/sec, disable for 10 sec if exceeded
    cps             = 50 10

    # Maximum concurrent instances per service
    instances       = 50

    # Maximum instances per source IP address
    per_source      = 10

    # Enable supplementary groups for server processes
    groups          = yes

    # Default umask for child processes
    umask           = 002

    # IPv6 configuration
    v6only          = no
}

# Include all files from /etc/xinetd.d/ directory
includedir /etc/xinetd.d

```

--------------------------------

### Configure TCP Redirect/Proxy Service

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Uses the redirect attribute to forward incoming connections to another host and port without requiring a server executable.

```bash
# /etc/xinetd.d/redirect-example
# Redirect local port 8080 to internal web server
service http-proxy
{
    disable         = no
    type            = UNLISTED
    socket_type     = stream
    protocol        = tcp
    wait            = no
    user            = nobody

    # Port to listen on (required for UNLISTED services)
    port            = 8080

    # Redirect to internal host:port
    # Note: server attribute is NOT required with redirect
    redirect        = 192.168.1.100 80

    # Can also use hostname (resolved once at startup)
    # redirect      = internal-web.example.com 80

    # Access control
    only_from       = 0.0.0.0/0
    no_access       = 10.0.0.0/8

    # Log traffic statistics
    log_on_success  = PID HOST DURATION TRAFFIC

    # Bind to specific interface
    bind            = 203.0.113.1
}

# Redirect telnet to internal server
service telnet-redirect
{
    disable         = no
    id              = telnet-internal
    type            = UNLISTED
    socket_type     = stream
    protocol        = tcp
    port            = 2323
    wait            = no
    user            = nobody
    redirect        = 10.0.0.50 23

    # Only allow from specific networks
    only_from       = 192.168.0.0/16

    # Show banner when connection denied
    banner_fail     = /etc/xinetd.d/banners/access-denied.txt
}
```

--------------------------------

### Enable and Disable Services

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Control service availability globally via defaults or individually using the 'disable' attribute or 'DISABLE' flag.

```bash
# /etc/xinetd.conf
defaults
{
    # Disable specific services globally
    disabled        = rstatd rusersd rquotad

    # OR enable only specific services (whitelist approach)
    # enabled       = ssh ftp http

    # Other defaults...
}

# Per-service disable
service rsh
{
    # Boolean disable attribute
    disable         = yes

    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/in.rshd
}

# Using flags for disable (alternative)
service rlogin
{
    # DISABLE flag achieves same result
    flags           = DISABLE

    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/in.rlogind
}
```

--------------------------------

### Integrate TCP Wrappers with xinetd using NAMEINARGS

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Configure xinetd to use TCP Wrappers (tcpd) for enhanced access control. The NAMEINARGS flag is crucial for tcpd to identify the actual service.

```bash
# /etc/xinetd.d/telnet-tcpd
service telnet
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = root

    # Use tcpd as the server
    server          = /usr/sbin/tcpd

    # NAMEINARGS: first server_arg becomes argv[0]
    # This allows tcpd to identify the real service
    flags           = NAMEINARGS
    server_args     = /usr/sbin/in.telnetd
}
```

```bash
# Alternative: Use built-in libwrap support
# (requires xinetd compiled with --with-libwrap)
service telnet
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/in.telnetd

    # Disable internal libwrap to use tcpd explicitly
    flags           = NOLIBWRAP NAMEINARGS
    server          = /usr/sbin/tcpd
    server_args     = /usr/sbin/in.telnetd
}
```

```text
# /etc/hosts.allow example for libwrap:
# in.telnetd: 192.168.1.0/24
# in.ftpd: ALL

# /etc/hosts.deny example:
# ALL: ALL
```

--------------------------------

### Configure Load-Based Service Control

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Disable services when system load exceeds a specified threshold. This requires xinetd to be compiled with the --with-loadavg option.

```bash
# /etc/xinetd.d/ftp-loadavg
service ftp
{
    disable         = no
    socket_type     = stream
    wait            = no
    user            = root
    server          = /usr/sbin/vsftpd

    # Stop accepting connections when 1-minute load average exceeds 2.5
    max_load        = 2.5

    # Combined with other limits
    instances       = 20
    per_source      = 5
    cps             = 25 10
}
```

--------------------------------

### Control xinetd Runtime with Signals

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Send Unix signals to the xinetd process using its PID to control its runtime behavior, such as reloading configurations, dumping state, or terminating the daemon.

```bash
kill -HUP $(cat /var/run/xinetd.pid)
```

```bash
kill -USR2 $(cat /var/run/xinetd.pid)
```

```bash
kill -USR1 $(cat /var/run/xinetd.pid)
```

```bash
kill -TERM $(cat /var/run/xinetd.pid)
```

```bash
kill -QUIT $(cat /var/run/xinetd.pid)
```

```bash
kill -ABRT $(cat /var/run/xinetd.pid)
```

--------------------------------

### Define Restricted Service Access

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Configure service access using IP ranges, CIDR, hostnames, and network names. Use 'no_access' to explicitly deny specific hosts or domains.

```text
# /etc/xinetd.d/restricted-service
service myservice
{
    disable         = no
    type            = UNLISTED
    socket_type     = stream
    protocol        = tcp
    port            = 12345
    wait            = no
    user            = myuser
    server          = /usr/local/bin/myserver

    # Numeric IP addresses (trailing 0 = wildcard)
    only_from       = 192.168.1.0        # 192.168.1.*
    only_from      += 10.0.0.0           # 10.*.*.*
    only_from      += 172.16.0.0         # 172.16.*.*

    # CIDR notation
    only_from      += 203.0.113.0/24

    # Factorized addresses
    only_from      += 192.168.10.{1,2,3,4,5}

    # Hostnames (reverse DNS lookup performed)
    only_from      += trusted.example.com

    # Domain suffix (matches *.example.com)
    only_from      += .example.com

    # Network name from /etc/networks
    only_from      += localnet

    # Explicit denials (more specific match wins)
    no_access       = 192.168.1.100
    no_access      += badhost.example.com
    no_access      += .untrusted.com

    # IPv6 examples
    only_from      += ::1                 # localhost
    only_from      += 2001:db8::/32       # CIDR
    only_from      += fe80::/10           # link-local
}
```

--------------------------------

### Implement SENSOR Flag for Intrusion Detection

Source: https://context7.com/xinetd-org/xinetd/llms.txt

Use the SENSOR flag to create traps that detect port scans and block offending IP addresses for a specified duration.

```bash
# /etc/xinetd.d/ftp-sensor
# Sensor on unused FTP port - detects scanners
service ftp
{
    disable         = no
    id              = ftp-sensor

    # SENSOR makes this an intrusion detection trap
    type            = INTERNAL
    flags           = SENSOR

    socket_type     = stream
    wait            = no

    # Time to deny access from offending IP (in minutes)
    # FOREVER = until xinetd restart
    # NEVER = log only, don't block
    deny_time       = 120

    # Enhanced logging for detected intrusions
    log_on_failure  = HOST
}
```

```bash
# /etc/xinetd.d/telnet-sensor
# Sensor on telnet port
service telnet
{
    disable         = no
    id              = telnet-sensor
    type            = INTERNAL
    flags           = SENSOR
    socket_type     = stream
    wait            = no
    deny_time       = 60
}
```
Tokens:
Raw