mirror of
https://github.com/troglobit/finit.git
synced 2026-10-30 12:50:34 +00:00
Remove last traces of inetd support
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg committed
1 parent
e843be4540
commit
10d4964106
16 files changed
+26
-256
No files matched your search
+1
-1
@@ -1,4 +1,4 @@
|
||||
docsdir := @docdir@/doc
|
||||
docs_DATA = config.md conditions.md distro.md inetd.md plugins.md \
|
||||
docs_DATA = config.md conditions.md distro.md plugins.md \
|
||||
service.md signals.md svc-machine.png cmdline.md
|
||||
EXTRA_DIST = $(docs_DATA)
|
||||
@@ -12,9 +12,6 @@ value in the project turned out to be:
|
||||
Near Future
|
||||
-----------
|
||||
|
||||
* Remove native inetd support. Relocate to a stand-alone application,
|
||||
possibly even outside of the Finit project. Will greatly simplify
|
||||
the remaining bits ...
|
||||
* ... when inetd support has been removed, we can refactor the .conf
|
||||
parser, parse user input in a separate process, move process monitor
|
||||
to separate process (same as parser?), and possibly even ...
|
||||
|
||||
@@ -49,8 +49,6 @@ Below are a few of the main switches to configure:
|
||||
|
||||
* `--localstatedir=..`: follows `--prefix`, you likely want `/var`
|
||||
|
||||
* `--disable-inetd`: Disable the built-in inetd server.
|
||||
|
||||
* `--enable-static`: Build Finit statically. The plugins will be
|
||||
built-ins (.o files) and all external libraries, except the C library
|
||||
will be linked statically.
|
||||
@@ -81,9 +79,6 @@ Then configure, build and install:
|
||||
```shell
|
||||
$ ./configure --prefix=/usr --exec-prefix= \
|
||||
--sysconfdir=/etc --localstatedir=/var \
|
||||
--enable-inetd-echo-plugin \
|
||||
--enable-inetd-chargen-plugin --enable-inetd-daytime-plugin \
|
||||
--enable-inetd-discard-plugin --enable-inetd-time-plugin \
|
||||
--with-heading="Alpine Linux 3.13" --with-hostname=alpine
|
||||
$ make
|
||||
.
|
||||
|
||||
+5
-33
@@ -247,33 +247,6 @@ Syntax
|
||||
use the option `kill:SEC`, e.g., `kill:10` to wait 10 seconds before
|
||||
sending `SIGKILL`.
|
||||
|
||||
* `inetd service/proto[@iflist] <wait|nowait> [LVLS] /path/to/daemon args`
|
||||
Launch a daemon when a client initiates a connection on an Internet
|
||||
port. Available services are listed in the UNIX `/etc/services` file.
|
||||
Finit can filter access to from a list of interfaces, `@iflist`, per
|
||||
inetd service as well as listen to custom ports.
|
||||
|
||||
```shell
|
||||
inetd ftp/tcp nowait @root /usr/sbin/uftpd -i -f
|
||||
inetd tftp/udp wait @root /usr/sbin/uftpd -i -t
|
||||
```
|
||||
|
||||
The following example listens to port 2323 for telnet connections and
|
||||
only allows clients connecting from `eth0`:
|
||||
|
||||
```shell
|
||||
inetd 2323/tcp@eth0 nowait [2345] /sbin/telnetd -i -F
|
||||
```
|
||||
|
||||
The interface list, `@iflist`, is of the format `@iface,!iface,iface`,
|
||||
where a single `!` means to deny access. Notice how interfaces are
|
||||
comma separated with no spaces.
|
||||
|
||||
The `inetd` directive can also have ` -- Optional Description`, only
|
||||
Finit does not output this text on the console when launching inetd
|
||||
services. Instead this text is sent to syslog and also shown by the
|
||||
`initctl` tool. More on inetd below.
|
||||
|
||||
* `runparts <DIR>`
|
||||
Call [run-parts(8)][] on `DIR` to run start scripts. All executable
|
||||
files, or scripts, in the directory are called, in alphabetic order.
|
||||
@@ -376,8 +349,8 @@ be installed since system requirements differ too much. Try out the
|
||||
Debian 6.0 example `/usr/share/doc/finit/finit.conf` configuration that
|
||||
is capable of service monitoring SSH, sysklogd, gdm and getty!
|
||||
|
||||
Every `run`, `task`, `service`, or `inetd` can also list the privileges
|
||||
the `/path/to/cmd` should be executed with. Simply prefix the path with
|
||||
Every `run`, `task`, or `service` can also list the privileges the
|
||||
`/path/to/cmd` should be executed with. Simply prefix the path with
|
||||
`[@USR[:GRP]]` like this:
|
||||
|
||||
```shell
|
||||
@@ -396,9 +369,9 @@ multiple web servers, add `:ID` somewhere between the `run`, `task`,
|
||||
Without the `:ID` to the service the latter will overwrite the former
|
||||
and only the old web server would be started and supervised.
|
||||
|
||||
The `run`, `task`, `service`, or `inetd` stanzas also allow the keyword
|
||||
`log` to redirect `stderr` and `stdout` of the application to a file or
|
||||
syslog using the native `logit` tool. The full syntax is:
|
||||
The `run`, `task`, and `service` stanzas also allow the keyword `log` to
|
||||
redirect `stderr` and `stdout` of the application to a file or syslog
|
||||
using the native `logit` tool. The full syntax is:
|
||||
|
||||
log:/path/to/file
|
||||
log:prio:facility.level,tag:ident
|
||||
@@ -455,7 +428,6 @@ the following:
|
||||
- `service`
|
||||
- `task`
|
||||
- `run`
|
||||
- `inetd`
|
||||
- `rlimit`
|
||||
- `tty`
|
||||
|
||||
|
||||
-125
@@ -1,125 +0,0 @@
|
||||
Internet Super Server
|
||||
=====================
|
||||
|
||||
Inetd
|
||||
-----
|
||||
|
||||
A built-in *Internet Super Server* support was added in Finit v1.12 and
|
||||
v1.13, along with an internal `time` inetd service, RFC 868 (rdate).
|
||||
The latter is supplied as a plugin to illustrate how simple it is to
|
||||
extend finit with more internal inetd services. Today more built-in
|
||||
services are available.
|
||||
|
||||
> Please note, not all UNIX daemons are prepared to run as inetd services.
|
||||
> In the example below `sshd` also need the command line argument `-i`.
|
||||
|
||||
The inetd support in finit is quite advanced. Not only does it launch
|
||||
services on demand, it can do so on custom ports and also filter inbound
|
||||
traffic using a poor man's [TCP wrappers][]. The syntax is very similar
|
||||
to the traditional `/etc/inetd.conf`, yet keeping with the style of
|
||||
Finit:
|
||||
|
||||
```shell
|
||||
# Launch SSH on demand, in runlevels 2-5 as root
|
||||
inetd ssh/tcp nowait [2345] @root:root /usr/sbin/sshd -i
|
||||
```
|
||||
|
||||
A more advanced example is listed below, please note the *incompatible
|
||||
syntax change* that was made between Finit v1.12 and v1.13 to support
|
||||
deny filters:
|
||||
|
||||
```shell
|
||||
# Start sshd if inbound connection on eth0, port 222, or
|
||||
# inbound on eth1, port 22. Ignore on other interfaces.
|
||||
inetd 222/tcp@eth0 nowait [2345] /usr/sbin/sshd -i
|
||||
inetd ssh/tcp@eth1,eth1 nowait [2345] /usr/sbin/sshd -i
|
||||
```
|
||||
|
||||
If `eth0` is your Internet interface you may want to avoid using the
|
||||
default port. To run ssh on port 222, and all others on port 22:
|
||||
|
||||
```shell
|
||||
inetd 222/tcp@eth0 nowait [2345] /usr/sbin/sshd -i
|
||||
inetd ssh/tcp@*,!eth0 nowait [2345] /usr/sbin/sshd -i
|
||||
```
|
||||
|
||||
Compared to Finit v1.12 you must *explicitly deny* access from `eth0`!
|
||||
|
||||
To protect against looping attacks, the inetd server will refuse UDP
|
||||
service if the reply port corresponds to any internal service. Similar
|
||||
to how the FreeBSD inetd operates.
|
||||
|
||||
|
||||
**Internal Services**
|
||||
|
||||
Like the original `inetd`, Finit has a few standard services built-in.
|
||||
They are realized as plugins to provide a simple means of testing the
|
||||
inetd functionality stand-alone. But this also provides both a useful
|
||||
network testing/availability, as well as a rudimentary time server for
|
||||
`rdate` clients.
|
||||
|
||||
- echo
|
||||
- chargen
|
||||
- daytime
|
||||
- discard
|
||||
- time
|
||||
|
||||
For security reasons they are all disabled by default and have to be
|
||||
enabled with both the `configure` script and a special `inetd` stanza in
|
||||
the `finit.conf` or `finit.d/*.conf` like this:
|
||||
|
||||
```shell
|
||||
inetd echo/udp wait [2345] internal
|
||||
inetd echo/tcp nowait [2345] internal
|
||||
inetd chargen/udp wait [2345] internal
|
||||
inetd chargen/tcp nowait [2345] internal
|
||||
inetd daytime/udp wait [2345] internal
|
||||
inetd daytime/tcp nowait [2345] internal
|
||||
inetd discard/udp wait [2345] internal
|
||||
inetd discard/tcp nowait [2345] internal
|
||||
inetd time/udp wait [2345] internal
|
||||
inetd time/tcp nowait [2345] internal
|
||||
```
|
||||
|
||||
Then call `rdate` from a remote machine (or use localhost):
|
||||
|
||||
```shell
|
||||
rdate -p <IP>
|
||||
rdate -up <IP>
|
||||
```
|
||||
|
||||
Or `echoping` to reach the echo service:
|
||||
|
||||
```shell
|
||||
echoping -v <IP>
|
||||
echoping -uv <IP>
|
||||
```
|
||||
|
||||
Or `echoping -d` to reach the discard service:
|
||||
|
||||
```shell
|
||||
echoping -dv <IP>
|
||||
echoping -duv <IP>
|
||||
```
|
||||
|
||||
Or `echoping -c` to reach the chargen service:
|
||||
|
||||
```shell
|
||||
echoping -cv <IP>
|
||||
echoping -cuv <IP>
|
||||
```
|
||||
|
||||
If you use `time/udp` you must use the standard rdate implementation and
|
||||
then call it with `rdate -up` to connect using UDP. Without the `-p`
|
||||
argument rdate will try to set the system clock. Please note that rdate
|
||||
has been deprecated by the NTP protocol and this plugin should only be
|
||||
used for testing or environments where NTP for some reason is blocked.
|
||||
Also, remember the UNIX year 2038 bug, or in the case of RFC 868 (and
|
||||
some NTP implementations), year 2036!
|
||||
|
||||
**Note:** There is currently no verification that the same port is used
|
||||
more than once. So a standard `inetd http/tcp` service will clash
|
||||
with an ssh entry for the same port `inetd 80/tcp` …
|
||||
|
||||
|
||||
[TCP Wrappers]: https://en.wikipedia.org/wiki/TCP_Wrapper
|
||||
+1
-12
@@ -8,7 +8,7 @@ Hooks & Plugins
|
||||
* [Shutdown Hooks](#shutdown-hooks)
|
||||
|
||||
Finit can be extended to add general functionality in the form of I/O
|
||||
monitors, built-in inetd services, or hook plugins.
|
||||
monitors, or hook plugins.
|
||||
|
||||
The following sections detail existing plugins and hook points. For
|
||||
more information, see the plugins listed below.
|
||||
@@ -34,14 +34,6 @@ For your convenience a set of *optional* plugins are available:
|
||||
* *dbus.so*: Setup and start system message bus, D-Bus, at boot.
|
||||
_Optional plugin._
|
||||
|
||||
* *echo.so*: RFC 862 plugin. Start as inetd service, like time below.
|
||||
|
||||
* *chargen.so*: RFC 864 plugin. Start as inetd service, like time below.
|
||||
|
||||
* *daytime.so*: RFC 867 plugin. Start as inetd service, like time below.
|
||||
|
||||
* *discard.so*: RFC 863 plugin. Start as inetd service, like time below.
|
||||
|
||||
* *hotplug.so*: Setup and start either udev or mdev hotplug daemon, if
|
||||
available.
|
||||
|
||||
@@ -57,9 +49,6 @@ For your convenience a set of *optional* plugins are available:
|
||||
* *resolvconf.so*: Setup necessary files for `resolvconf` at startup.
|
||||
_Optional plugin._
|
||||
|
||||
* *time.so*: RFC 868 (rdate) plugin. Start as inetd service. Useful
|
||||
for testing inetd filtering — BusyBox has an rdate (TCP) client.
|
||||
|
||||
* *tty.so*: Watches `/dev`, using inotify, for new device nodes (TTY's)
|
||||
to start/stop getty consoles on them on demand. Useful when plugging
|
||||
in a usb2serial converter to login to your embedded device.
|
||||
|
||||
Reference in new issue
Block a user