Very Computer

On several Solaris 7 and 8 systems I am observing inetd processes that
are spawning other inetd processes.

Why is that?

So you have multiple 'inetd' processes in the 'ps' list?  Can you
provide any more information?

Quote:> Why is that?

Something's screwed up.

I'd worry about the inetd.conf, then I'd worry about binaries and
patches.

--

Unix System Administrator                    Taos - The SysAdmin Company
Got some Dr Pepper?                           San Francisco, CA bay area
         < This line left intentionally blank to confuse you. >

Quote:> On several Solaris 7 and 8 systems I am observing inetd processes that
> are spawning other inetd processes.

Multiple inetd processes are a feature of a number of security
break-ings and the resulting hacked systems. Are you sure the
extras were spawned by inetd?

Of course, inetd will fork just before execing a spawned command,
but you wouldn't normally notice the duplicate inetd for the
very short period it exists before it exec's.

--
Andrew Gabriel

|Of course, inetd will fork just before execing a spawned command,
|but you wouldn't normally notice the duplicate inetd for the
|very short period it exists before it exec's.

I have seen it occasionally when the process to be exec'ed is on a down
NFS server - but you should be able to truss and see if it's* in
exec or somewhere else.

--
________________________________________________________________________


  Working for, but definitely not speaking for, Sun Microsystems, Inc.

Maybe the longer-lived ones are due to the "internal" services like
"echo".  While I expect the main inetd process handles the datagram
services simply by sending the appropriate reply immediately, it probably
forks a new process to handle the stream versions.

Try "telnet localhost echo" and see if this causes a new inetd child
process to be spawned.  When you exit "telnet" it should disappear.

--

Genuity, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.