why does rsh -l ignore .rhosts?

June 05th, 2012 - 07:41 am ET by Ralph | Report spam
I know rsh is old not used anymore, and ssh is the way to go, and rsh
has security issues, but i'm just testing it on a small network of 2
computers where i'm the only user and it's not open to the internet.
It's just for familiarity with it.

I see the man page for rshd says as quoted..

My question Why is it that when you do rsh -l (to specify a different
username than the current one) Why does it ignore .rhosts?



http://linux.die.net/man/8/in.rshd
"8. Rshd then validates the user using ruserok(3), which uses the file
/etc/hosts.equiv and the .rhosts file found in the user's home
directory. The -l option prevents ruserok(3) from doing any validation
based on the user's ''.rhosts'' file (unless the user is the superuser
and the -h option is used.) If the -h option is not used, superuser
accounts may not be accessed via this service at all.

The -l option should not be trusted without verifying that it works as
expected with the particular version of libc installed on your system
(and should be tested again after any libc update) because some
versions of libc may not honor the flags used by rshd.

Also note that the design of the .rhosts system is COMPLETELY INSECURE
except on a carefully firewalled private network. Under all other
circumstances, rshd should be disabled entirely."



email Follow the discussionReplies 5 repliesReplies Make a reply

Replies

#1 Chris Davies
June 05th, 2012 - 04:57 pm ET | Report spam
Ralph wrote:
I know rsh is old not used anymore, and ssh is the way to go, and rsh
has security issues, but i'm just testing it on a small network of 2
computers where i'm the only user and it's not open to the internet.



I'd still go with ssh, and if you want equivalence logins then set up
public/private certificates. (This is all "easy"... just ask if you're
struggling.)


It's just for familiarity with it.



Mmm, I suppose. But why bother wasting life becoming familiar with
outdated, obsolete, and insecure software for which a better replacement
is available?


My question Why is it that when you do rsh -l (to specify a different
username than the current one) Why does it ignore .rhosts?



Fundamentally it's because the trust is applied on the client side, not
on the server, and the rsh application tries hard to pretend to be fair.


http://linux.die.net/man/8/in.rshd
Also note that the design of the .rhosts system is COMPLETELY INSECURE
except on a carefully firewalled private network. Under all other
circumstances, rshd should be disabled entirely."



I'd go further than that and remove the clause "Under all other
circumstances" entirely.

Really, there are NO circumstances where rsh is better than ssh, and
many where ssh beats rsh hands down.

Chris

Similar topics