samba: running swat from xinetd

(swat - the web-based tool for managing samba servers and accounts)...well, on some (possibly most these days) linux distros it's run out of xinetd, which makes it pretty manageable: After you install your 'samba-swat' package, edit /etc/xinetd.d/swat to enable & configure it.

the critical lines being:
only_from = IP addresses/ranges you want access from
disable = no # the default being 'yes'

Now, less commonly-know it seems is the xinetd directive (ie. would work for all the apps you can wrap with it):

server_args = as-read-from-the-man-page

The server_args in this case being '-P' which limits swat to really only showing the password-change page by hiding the server config and monitoring elements. I don't want normal users to be able to see any of those items.