Date: Sun, 27 Jun 1999 18:37:51 -0700 From: Doug <Studded@gorean.org> To: Sheldon Hearn <sheldonh@uunet.co.za> Cc: current@freebsd.org Subject: Re: HEADS UP! Inetd wrapping OFF by default Message-ID: <3776D1EF.D4D4021E@gorean.org> References: <32068.930508133@axl.noc.iafrica.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is going to sound like I'm attacking sheldon, but I'm not since he's already stated that the got approval for this change from Jordan. Sheldon Hearn wrote: > Inetd now takes command-line options to enable wrapping. This was a > decision taken with the approval of our release engineer in an attempt > to revert a backward-compatibility problem introduced in 3.2-RELEASE. > > The relevant changes to the manpage follow: > " > SYNOPSIS > inetd [-d] [-l] [-w] [-c maximum] [-C rate] [-a address] [-p filename] > [-R rate] [configuration file] > [...] > DESCRIPTION > [...] > -w Turn on TCP Wrapping. If this option is specified > twice, internal services will also be wrapped. See the > IMPLEMENTATION NOTES section for more information on TCP > Wrappers support. > > [...] > IMPLEMENTATION NOTES > > When given the -w option, inetd will wrap all services specified as > ``stream tcp nowait'' except for ``internal'' services. If the -w > option is given twice, such ``internal'' services will be wrapped > as well. > > When wrapping is enabled, the tcpd daemon is not required, as that > functionality is builtin. For more information on TCP Wrappers; > see the relevant documentation ( hosts_access(5) ). First, the setting in /etc/defaults/rc.conf should default to off, as defaulting it to on violates POLA for the many many people who haven't updated to 3.x from 2.2 yet. The fact that one release had it on by default IMO does not mean that POLA switches to having it on by default, since the majority of users have not yet upgraded, and the comments and questions on the lists have clearly indicated that having it on is causing more problems than it solves. Also, if the decision is made to leave it on by default, there should be a hosts.allow file installed by default that has nothing but "ALL : ALL" in it. Second, this command line switch is horrible UI design for several reasons. First, any command line option that requires that the same flag be applied twice is bad design, historical precedents aside. Second, what if I want to wrap my internal services, but not wrap my external ones? This design is still presupposing that everyone will want to wrap everything, instead of trying to give the maximum amount of flexibility (and the least amount of surprise) to the average user. I propose that the -w flag be changed to take parameters. To start with, you would have [-w <[e] [i]>] to control wrapping for external and internal services respectively. This would also allow the system to be extensible in the future to include other types or subtypes of services. I really hope that this design will be reconsidered before it gets sent to -stable. Doug To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3776D1EF.D4D4021E>