INETD.SEC(5)             Series 300 Only             INETD.SEC(5)

     NAME
          inetd.sec - optional security file for inetd(1M)

     HP-UX COMPATIBILITY
          Level:    HP-UX/NON-STANDARD

          Origin:   HP-UX

          Remarks:  Implemented on the Series 300 only.

     DESCRIPTION
          When inetd(1M) accepts a connection from a remote system, it
          checks  the  address  of  the  host  requesting  the service
          against the list of hosts  allowed  or  denied  to  use  the
          specific  service.   The  file  inetd.sec  allows the system
          administrator  to  determine  how  many  remote  users   can
          simultaneously  start  remote  services  in the local system
          and, additionally, which hosts (or networks in general)  are
          allowed  to  remotely use the system.  This file constitutes
          an extra layer of security, beyond the normal checks done by
          the services.  It precedes the security of the servers; that
          is, a server will not be  started  by  the  internet  daemon
          unless  the  host  requesting  the  service  is a valid host
          according to inetd.sec.

          If inetd.sec is not found in  the  /usr/adm  directory,  the
          security is only that implemented by the servers.  Inetd.sec
          and the directory /usr/adm should be writable only by  their
          owners.   Changes  to  inetd.sec  apply  to  any  subsequent
          connections.

          Comments in inetd.sec have a `#' at  the  beginning  of  the
          line.  They are not allowed at the end of a line of data.

          The first line of data in the file contains  the  number  of
          remote  services  that can be started simultaneously.  It is
          not necessary to define MAXNUM.  If this line is not present
          MAXNUM is defined as 1000.  The format of that line is:

               MAXNUM       number

          where MAXNUM is a keyword and number is the  maximum  number
          of  simultaneous  remote  services  allowed.   MAXNUM can be
          separated from number by any number of blanks and/or tabs.

          The  other  lines  in  the  file  contain  a  service  name,
          permission  field,  and  the  internet addresses or official
          names of the hosts  and/or  networks  allowed  to  use  that
          service  in  the local host.  The fields of this line are as
          follows:

               <service name>   <allow/deny>   <host/network addresses, host/network names>

     Hewlett-Packard               - 1 -             (printed 7/16/86)

     INETD.SEC(5)             Series 300 Only             INETD.SEC(5)

          Service name is the name of a  valid  service  in  the  file
          /etc/services.

          Allow/deny determines if the list of  remote  hosts  in  the
          next field is allowed or denied to use a service.  It is not
          possible to maintain two lists  of  remote  hosts,  one  for

          allowed services and another one for denied services.

          The addresses and names are separated by white spaces.   Any
          mix  of  addresses  and  names  is  allowed.   A line can be
          continued if it terminates with `\'.

          The addresses are the official  internet  addresses  of  the
          hosts  or  networks  as used in such files as /etc/hosts.  A
          wildcard  character  `*'  and  a  range  character  `-'  are
          allowed.   The  `*' and the `-' can be present in any of the
          fields of the address.  An address  field  is  a  string  of
          characters separated by a `.'.

          A wildcard character permits a whole network,  for  example,
          to  communicate  with  the local host without having to list
          all the hosts in that network.

          For example:

               login          allow     10.*  192.54.24.5

          allows all the hosts with network addresses starting with  a
          10,  as well as the single host with address 192.54.24.5, to
          use rlogin.

          A range is a field containing a `-' character. For example:

               shell          deny 10.3-5.*

          does not allow hosts in network 10  (arpa)  with  subnets  3
          through 5 to use remsh.

          The names are the official names of the hosts as  listed  in
          /etc/hosts  and the official names of the networks as listed
          in /etc/networks.

          For example, if ``testlan'' and ``testhost'' are entries  in
          /etc/networks     and     /etc/hosts    respectively,    and
          ``192.54.24.5''  is  a  correct  host  address,   then   the
          following entry for rlogin is acceptable:

               login          deny 192.54.24.5 testlan testhost

          Access to the local  host  through  rlogin  from  the  above
          network and hosts will be denied.

     Hewlett-Packard               - 2 -             (printed 7/16/86)

     INETD.SEC(5)             Series 300 Only             INETD.SEC(5)

          If a remote service is not listed in the security file or if
          it  is  listed  but  it is not followed by an allow or deny,
          then all remote hosts can attempt to use it.  The  level  of
          security is then that provided by the servers.

          For example, the following  line  in  inetd.sec  allows  all
          hosts to use ftp:

               ftp

          To allow access to a service,  for  example,  remsh  to  any
          host, the following line should be used in inetd.sec:

               shell     allow

          To deny access to a service to  any  host  allow  should  be

          replaced with deny in the previous example.

     SEE ALSO
          inetd(1M),     hosts(5),     inetd.conf(5),     networks(5),
          protocols(5), services(5).

     Hewlett-Packard               - 3 -             (printed 7/16/86)