The following is a good example of how to run chrooted services using xinetd.

From lburns@sasquatch.com Wed Sep  6 22:40:58 1995
Received: from wormhole.topsail.org (root@wormhole.topsail.org [192.132.57.129]) by khan.topsail.org (8.6.12/8.6.9.1) with ESMTP id WAA00859 for <chuck@khan>; Wed, 6 Sep 1995 22:40:58 -0400
Received: from gw0.topsail.org (root@gw0.topsail.org [192.132.57.130]) by wormhole.topsail.org (8.6.12/8.6.9.1) with ESMTP id WAA02815 for <chuck@topsail.org>; Wed, 6 Sep 1995 22:55:59 -0400
Received: from ns.sasquatch.com  by gw0.topsail.org id WAA18746 for <chuck@topsail.org>; Wed, 6 Sep 1995 22:41:37 -0400
Received: (lburns@localhost) by ns.sasquatch.com (8.6.12/8.6.12.sasquatch) id TAA18368 for chuck@topsail.org; Wed, 6 Sep 1995 19:38:07 -0700
Message-Id: <199509070238.TAA18368@ns.sasquatch.com>
From: lburns@sasquatch.com (Len Burns)
Date: Wed, 6 Sep 1995 19:38:06 -0700
X-Mailer: Mail User's Shell (7.2.3 5/22/91)
To: chuck@topsail.org
Subject: Your thoughts?
Status: OR

I have been attempting to simplify my life a bit and am wondering what you
think of the following. I have on here an anonymous lynx account that is a
telnetd running on an alternative port.  It is limited to only accessing a
couple of pages on here, but its existence is important.  That account
along with our httpd server and gopher server all are chrooted.  Up
until now I have had a separate inetd running in the chrooted
environment to fire off the alternative telnetd.  I would prefer to
have everyting under the control of xinetd which makes it much easier
to manage and also control.  So this is what I have done.  It does
work, and does not seem to me like any bigger security risk that the
thign was as it was set up before.

service telnet_chroot
{
	log_on_success	= HOST PID DURATION USERID
	log_on_failure = HOST RECORD USERID
no_access = 152.30.11.93
	socket_type     = stream
	protocol        = tcp
port = 8000
	wait            = no
	user            = root
	server          = /usr/sbin/chroot
server_args = /var/public/servers /usr/libexec/telnetd
}

I am not thrilled with the anonymous account, but if it must be there
then it seems a lot safer chrooted.  Any thoughts would be much
appreciated.

-Len
lburns@sasquatch.com

---

A more better solution is IMHO to *first* do a chroot and than start 
a (via -host option or interface attribute, see README.SBC) 
virtualized xinetd. I designed and setup a virtual machine (VM) 
environment which is based on this feature.
	Jan Wedekind <jw@Germany.EU.net>, jan@ping.de

