Index for Section 8

Alphabetical listing for R

Bottom of page

rshd(8)
NAME
  rshd - The remote shell server

SYNOPSIS
  rshd [-aeln]

FLAGS
  -a	    The addresses for the hostname are requested, verifying that the
	    name and address correspond.

  -e	    Causes rshd to check for the /etc/nologin_{hostname} and
	    /etc/nologin files.	 If either exists, rshd prints its contents
	    and exits.

  -l	    Prevents the ruserok command from doing any validation based on
	    the user's .rhosts file, unless the user is the superuser.

  -n	    Disables transport-level, keep-alive messages.

SECURITY NOTE
  This security-sensitive command uses the SIA (Security Integration
  Architecture) routine as an interface to the security mechanisms. See the
  matrix.conf(4) reference page for more information.

DESCRIPTION
  The rshd daemon is the server for the rcmd(3) routine and, consequently,
  for the rsh(1) program.  The server provides remote execution facilities
  with authentication based on privileged port numbers from trusted hosts.

  The rshd daemon listens for service requests at the port indicated in the
  cmd service specification; see services(4).  When a service request is
  received, the following protocol is initiated:

   1.  The server checks the client's source port.  If the port is not in the
       range 512 to 1023, the server aborts the connection.

   2.  The server reads bytes from the socket up to a null (`\0') byte.	 The
       resultant string is interpreted as an ASCII number, base 10.

   3.  If the number received in step 2 is nonzero, it is interpreted as the
       port number of a secondary stream to be used for the stderr option.  A
       second connection is then created to the specified port on the
       client's machine.  The source port of this second connection is also
       in the range 512 to 1023.

   4.  The server checks the client's source address and requests the
       corresponding hostname (see gethostbyaddr(3), hosts(4), and named(8)).
       If the hostname cannot be determined, the dot-notation representation
       of the host address is used.  If the hostname is in the same domain as
       the server (according to the last two components of the domain name),
       or if the -a flag is given, the addresses for the hostname are
       requested, verifying that the name and address correspond.  If address
       verification fails, the connection is aborted with the message Host
       address mismatch.

   5.  A null-terminated username of at most 16 bytes is retrieved on the
       initial socket.	This username is interpreted as the user identity on
       the client 's machine.

   6.  A null-terminated username of at most 16 bytes is retrieved on the
       initial socket.	This username is interpreted as a user identity to
       use on the server's machine.

   7.  A null-terminated command to be passed to a shell is retrieved on the
       initial socket.	The length of the command is limited by the upper
       bound on the size of the system's argument list.

   8.  The rshd daemon then validates the user using ruserok(3), which uses
       the file /etc/hosts.equiv and the .rhosts file found in the user's
       home directory.	The -l flag prevents ruserok(3) from doing any
       validation based on the user's .rhosts file, unless the user is the
       superuser.

   9.  If rshd was started with the -e flag, the user is not the superuser,
       and either the /etc/nologin_{hostname} or /etc/nologin file exists,
       rshd prints the contents of the first file found and aborts the
       connection.  If the file has a zero length, rshd prints a "logins
       disabled" message.

   10. A null byte is returned on the initial socket and the command line is
       passed to the normal login shell of the user.  The shell inherits the
       network connections established by rshd.

  Transport-level, keep-alive messages are enabled unless the -n flag is
  present.  The use of keep-alive messages allows sessions to be timed out if
  the client crashes or becomes unreachable.

CAUTIONS
  The authentication procedure used here assumes the integrity of each client
  machine and the connecting medium.  This is insecure, but is useful in an
  open environment.

DIAGNOSTICS
  Except for the last diagnostic message listed, all diagnostic messages are
  returned on the initial socket, after which any network connections are
  closed.  An error is indicated by a leading byte with a value of 1 (0 is
  returned in step 9 above upon successful completion of all the steps prior
  to the execution of the login shell).

  Locuser too long.
	    The name of the user on the client's machine is longer than 16
	    characters.

  Remuser too long.
	    The name of the user on the remote machine is longer than 16
	    characters.

  Command too long.
	    The command line passed exceeds the size of the argument list (as
	    configured into the system).

  Login incorrect.
	    No password file entry for the username existed.

  Logins disabled.
	    The server is currently not accepting connections.

  No remote directory.
	    The chdir command to the home directory failed.

  Permission denied.
	    The authentication procedure previously described failed.

  Can't make pipe.
	    The pipe needed for the stderr option, but it was not created.

  Can't fork; try again.
	    A fork by the server failed.

  <shellname>: ...
	    The user's login shell could not be started.  This message is
	    returned on the connection associated with the stderr option, and
	    is not preceded by a flag byte.

FILES
  /usr/sbin/rshd
	    Specifies the command path

  /etc/nologin
	    Stops logins.  In a cluster, there is also
	    /etc/nologin_{hostname}.

RELATED INFORMATION
  Commands:  rsh(1)

  Functions:  rcmd(3), ruserok(3)

Index for Section 8

Alphabetical listing for R

Top of page