|
|
| |
RSHD(8) |
FreeBSD System Manager's Manual |
RSHD(8) |
rshd —
remote shell server
The rshd utility is the server for the
rcmd(3)
routine and, consequently, for the
rsh(1)
utility. The server provides remote execution facilities with authentication
based on privileged port numbers from trusted hosts.
The rshd utility listens for service
requests at the port indicated in the “cmd” service
specification; see
services(5).
When a service request is received the following protocol is initiated:
- The server checks the client's source port. If the port is not in the
range 512-1023, the server aborts the connection.
- The server reads characters from the socket up to a NUL (`\0') byte. The
resultant string is interpreted as an ASCII number, base 10.
- If the number received in step 2 is non-zero, it is interpreted as the
port number of a secondary stream to be used for the
stderr. A second connection is then created to the
specified port on the client's machine. The source port of this second
connection is also in the range 512-1023.
- The server checks the client's source address and requests the
corresponding host name (see
gethostbyaddr(3),
hosts(5)
and
named(8)).
If the hostname cannot be determined or the hostname and address do not
match after verification, the dot-notation representation of the host
address is used.
- A null terminated user name of at most 16 characters is retrieved on the
initial socket. This user name is interpreted as the user identity on the
client's machine.
- A null terminated user name of at most 16 characters is retrieved on the
initial socket. This user name is interpreted as a user identity to use on
the server's machine.
- A null terminated command to be passed to a shell is retrieved on the
initial socket. The length of the command is limited by the upper bound on
the size of the system's argument list.
- The
rshd utility then validates the user using
ruserok(3),
which uses the file /etc/hosts.equiv and the
.rhosts file found in the user's home directory.
The -l option prevents
ruserok(3)
from doing any validation based on the user's
.rhosts file, unless the user is the
superuser.
- A NUL byte is returned on the initial socket and the command line is
passed to the normal login shell of the user. The shell inherits the
network connections established by
rshd .
The options are as follows:
-a
- This flag is ignored, and is present for compatibility purposes.
-D
- Sets the TCP_NODELAY socket option, which improves the performance of
small back-to-back writes at the expense of additional network
traffic.
-L
- Causes all successful accesses to be logged to
syslogd(8)
as
auth.info messages.
-l
- Do not use the user's .rhosts file for
authentication, unless the user is the superuser.
-n
- Turn off transport level keepalive messages. This will prevent sessions
from timing out if the client crashes or becomes unreachable.
- /etc/hosts
-
- /etc/hosts.equiv
-
- /etc/login.conf
-
$HOME /.rhosts
-
- /etc/pam.conf
rshd uses /etc/pam.conf
entries with service name “rsh”. Authentication modules
requiring passwords (such as pam_unix ) are not
supported.
Except for the last one listed below, all diagnostic messages are returned on
the initial socket, after which any network connections are closed. An error
is indicated by a leading byte with a value of 1 (0 is returned in step 10
above upon successful completion of all the steps prior to the execution of
the login shell).
- Locuser too long.
- The name of the user on the client's machine is longer than 16
characters.
- Ruser too long.
- The name of the user on the remote machine is longer than 16
characters.
- Command too long.
- The command line passed exceeds the size of the argument list (as
configured into the system).
- Login incorrect.
- No password file entry for the user name existed or the authentication
procedure described above failed.
- Remote directory.
- The
chdir(2)
function to the home directory failed.
- Logins not available right now.
- The
rsh(1)
utility was attempted outside the allowed hours defined in
/etc/login.conf for the local user's login
class.
- Can't make pipe.
- The pipe needed for the stderr, was not created.
- Can't fork; try again.
- A
fork(2)
by the server failed.
- <shellname>: ...
- The user's login shell could not be started. This message is returned on
the connection associated with the stderr, and is not
preceded by a flag byte.
rlogin(1),
rsh(1),
gethostbyaddr(3),
rcmd(3),
ruserok(3),
hosts(5),
hosts.equiv(5),
login.conf(5),
services(5),
named(8),
rlogind(8),
syslogd(8)
IPv6 support was added by WIDE/KAME project.
The authentication procedure used here assumes the integrity of each client
machine and the connecting medium. This is insecure, but is useful in an
“open” environment.
A facility to allow all data exchanges to be encrypted should be
present.
Post-PAM, FreeBSD also needs the following
patch applied besides properly configuring
.rhosts:
--- etc/pam.d/rsh.orig Wed Dec 17 14:36:20 2003
+++ etc/pam.d/rsh Wed Dec 17 14:30:43 2003
@@ -9 +9 @@
-auth required pam_rhosts.so no_warn
+auth required pam_rhosts.so no_warn allow_root
A more extensible protocol (such as Telnet) should be used.
Visit the GSP FreeBSD Man Page Interface. Output converted with ManDoc. |