RSHD(8) | System Manager's Manual | RSHD(8) |
rshd
— remote
shell server
rshd |
[-aLln ] |
The rshd
server is the server for the
rcmd(3) routine and,
consequently, for the rsh(1)
program. The server provides remote execution facilities with authentication
based on privileged port numbers from trusted hosts.
The rshd
server listens for service
requests at the port indicated in the “cmd” service
specification; see
services(5). When a service
request is received the following protocol is initiated:
-a
option is given, the addresses for the hostname
are requested, verifying that the name and address correspond. If address
verification fails, the connection is aborted with the message
“Host address mismatch.”rshd
then validates the user using
ruserok(3), which uses the
file /etc/hosts.equiv and the
.rhosts file found in the user's home directory.
The -l
option prevents
ruserok(3) from doing any
validation based on the user's
“.rhosts” file, unless the user is
the superuser.rshd
.Transport-level keepalive messages are enabled unless the
-n
option is present. The use of keepalive messages
allows sessions to be timed out if the client crashes or becomes
unreachable.
The -L
option causes all successful
accesses to be logged to
syslogd(8) as
auth.info
messages.
Except for the last one listed below, all diagnostic messages are returned on the initial socket, after which any network connections are closed. An error is indicated by a leading byte with a value of 1 (0 is returned in step 10 above upon successful completion of all the steps prior to the execution of the login shell).
rsh(1), ssh(1), rcmd(3), ruserok(3), hosts_access(5), login.conf(5), sshd(8)
The authentication procedure used here assumes the integrity of every machine and every network that can reach the rshd/rlogind ports on the server. This is insecure, but is useful in an “open” environment. sshd(8) or a Kerberized version of this server are much more secure.
A facility to allow all data exchanges to be encrypted should be present.
A more extensible protocol (such as Telnet) should be used.
rshd
intentionally rejects accesses from
IPv4 mapped address on top of AF_INET6
socket, since
IPv4 mapped address complicates host-address based authentication. If you
would like to accept connections from IPv4 peers, you will need to run
rshd
on top of an AF_INET
socket, not an AF_INET6
socket.
March 9, 2005 | NetBSD 10.99 |