inetd (pronounced “inet-dee”) stands for Internet Daemon. Because it oversees a wide range of services and acts as their supervisor, it is also known as the Internet Superserver.

inetd provides two main benefits:

An extended version of inetd called xinetd is provided in some Linux distributions. xinetd adds security enhancements like access control lists, rate limiting, and better logging. For xinetd details, see: http://www.xinetd.org/

inetd is normally started during system boot. After going through the normal daemon startup process (closing file descriptors, detaching from terminal, etc.), inetd performs the following sequence of steps:

Child Process Setup Steps (Step 4 detail)

Before the child process calls exec() to run the actual server, it does the following:

1. Close all inherited file descriptors except the one socket that has activity (the connected TCP socket or the UDP socket with data)
2. Duplicate the socket onto fds 0, 1, and 2 (stdin, stdout, stderr) using dup2(). This means the server program can simply use read()/write() or even fgets()/printf() on standard file descriptors.
3. Close the original socket fd (since it is now duplicated on 0, 1, 2 and no longer needed at its original number)
4. Optionally change UID/GID to values specified in /etc/inetd.conf, so the server runs as a less-privileged user rather than as root

Code: What the Child Does Before exec()

/* Simplified pseudocode showing what inetd's child process does
   before exec()-ing the actual server */

int conn_fd = /* the accepted TCP socket or UDP socket with data */;

/* Step a: Close all other file descriptors */
int max_fd = sysconf(_SC_OPEN_MAX);
for (int fd = 0; fd < max_fd; fd++) {
    if (fd != conn_fd) {
        close(fd);   /* ignore errors — fd may not be open */
    }
}

/* Step b: Duplicate socket onto stdin(0), stdout(1), stderr(2) */
if (conn_fd != STDIN_FILENO) {
    dup2(conn_fd, STDIN_FILENO);   /* fd 0 = socket */
    dup2(conn_fd, STDOUT_FILENO);  /* fd 1 = socket */
    dup2(conn_fd, STDERR_FILENO);  /* fd 2 = socket */
    close(conn_fd);  /* original no longer needed */
}

/* Step c: Optionally drop privileges */
setgid(server_gid);   /* set group ID first */
setuid(server_uid);   /* then set user ID */

/* Step d: exec the actual server — it reads/writes via fds 0,1,2 */
execv("/usr/sbin/in.ftpd", argv);
/* If execv returns, it failed */
_exit(127);

inetd’s behavior is controlled entirely by its configuration file at /etc/inetd.conf. Each line in this file describes one service. Lines beginning with # are comments.

Example Lines from /etc/inetd.conf

# echo stream tcp nowait root internal
# echo dgram  udp wait   root internal
ftp    stream tcp nowait root /usr/sbin/tcpd in.ftpd
telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
login  stream tcp nowait root /usr/sbin/tcpd in.rlogind

The first two lines (commented out) are the TCP and UDP echo services implemented internally by inetd itself. The remaining three are real services that invoke the tcpd TCP wrapper.

Field-by-Field Explanation

Each line has the following whitespace-separated fields:

Reloading inetd Configuration

When you modify /etc/inetd.conf, inetd is not restarted — you simply send it a SIGHUP signal to ask it to re-read the configuration file:

# Send SIGHUP to reload /etc/inetd.conf
killall -HUP inetd

# Alternatively, find inetd's PID and signal it directly
kill -HUP $(pidof inetd)