rshd — remote
shell server
rshd is deprecated and will be removed
from future versions of the FreeBSD base system. If
rshd is still required, it can be installed from
ports or packages (net/bsdrcmds).
The rshd utility is the server for the
rcmd(3) routine and,
consequently, for the rsh(1)
utility. The server provides remote execution facilities with authentication
based on privileged port numbers from trusted hosts.
The rshd utility listens for service
requests at the port indicated in the “cmd” service
specification; see
services(5). When a
service request is received the following protocol is initiated:
- The server checks the client's source port. If the port is not in the
range 512-1023, the server aborts the connection.
- The server reads characters from the socket up to a NUL (`\0') byte. The
resultant string is interpreted as an ASCII number, base 10.
- If the number received in step 2 is non-zero, it is interpreted as the
port number of a secondary stream to be used for the
stderr. A second connection is then created to the
specified port on the client's machine. The source port of this second
connection is also in the range 512-1023.
- The server checks the client's source address and requests the
corresponding host name (see
gethostbyaddr(3),
hosts(5) and
named(8)). If the
hostname cannot be determined or the hostname and address do not match
after verification, the dot-notation representation of the host address is
used.
- A null terminated user name of at most 16 characters is
retrieved on the initial socket. This user name is interpreted as the user
identity on the
client's
machine.
- A null terminated user name of at most 16 characters is
retrieved on the initial socket. This user name is interpreted as a user
identity to use on the
server's
machine.
- A null terminated command to be passed to a shell is retrieved on the
initial socket. The length of the command is limited by the upper bound on
the size of the system's argument list.
- The
rshd utility then validates the user using
ruserok(3), which uses
the file /etc/hosts.equiv and the
.rhosts file found in the user's home directory.
The -l option prevents
ruserok(3) from doing
any validation based on the user's .rhosts file,
unless the user is the superuser.
- A NUL byte is returned on the initial socket and the command line is
passed to the normal login shell of the user. The shell inherits the
network connections established by
rshd.
The options are as follows:
-a- This flag is ignored, and is present for compatibility purposes.
-D- Sets the TCP_NODELAY socket option, which improves the performance of
small back-to-back writes at the expense of additional network
traffic.
-L- Causes all successful accesses to be logged to
syslogd(8) as
auth.info messages.
-l- Do not use the user's .rhosts file for
authentication, unless the user is the superuser.
-n- Turn off transport level keepalive messages. This will prevent sessions
from timing out if the client crashes or becomes unreachable.
- /etc/hosts
-
- /etc/hosts.equiv
-
- /etc/login.conf
-
$HOME/.rhosts-
- /etc/pam.conf
rshd uses /etc/pam.conf
entries with service name “rsh”. Authentication modules
requiring passwords (such as pam_unix) are not
supported.
Except for the last one listed below, all diagnostic messages are
returned on the initial socket, after which any network connections are
closed. An error is indicated by a leading byte with a value of 1 (0 is
returned in step 10 above upon successful completion of all the steps prior
to the execution of the login shell).
- Locuser
too long.
- The name of the user on the client's machine is longer than 16
characters.
- Ruser too
long.
- The name of the user on the remote machine is longer than 16
characters.
- Command
too long.
- The command line passed exceeds the size of the argument list (as
configured into the system).
- Login
incorrect.
- No password file entry for the user name existed or the authentication
procedure described above failed.
- Remote
directory.
- The chdir(2) function to
the home directory failed.
- Logins not
available right now.
- The rsh(1) utility was
attempted outside the allowed hours defined in
/etc/login.conf for the local user's login
class.
- Can't make
pipe.
- The pipe needed for the stderr, was not created.
- Can't
fork; try again.
- A fork(2) by the server
failed.
- <shellname>:
...
- The user's login shell could not be started. This message is returned on
the connection associated with the stderr, and is not
preceded by a flag byte.
rlogin(1),
rsh(1),
gethostbyaddr(3),
rcmd(3),
ruserok(3),
hosts(5),
hosts.equiv(5),
login.conf(5),
services(5),
named(8),
rlogind(8),
syslogd(8)
IPv6 support was added by WIDE/KAME project.
The authentication procedure used here assumes the integrity of
each client machine and the connecting medium. This is insecure, but is
useful in an “open” environment.
A facility to allow all data exchanges to be encrypted should be
present.
Post-PAM, FreeBSD also needs the following
patch applied besides properly configuring
.rhosts:
--- etc/pam.d/rsh.orig Wed Dec 17 14:36:20 2003
+++ etc/pam.d/rsh Wed Dec 17 14:30:43 2003
@@ -9 +9 @@
-auth required pam_rhosts.so no_warn
+auth required pam_rhosts.so no_warn allow_root
A more extensible protocol (such as Telnet) should be used.