As root, can't rlogin from particular server without password

[Jay Core]

Hello,

strange problem. As root, I want to be able to rlogin from host7 and host8 to host9, without supplying a password. While I am able to do this from host8 to host9 with no problem, whenever I rlog from host7 to host9, the system asks for a password. inetd.sec is not setup on any of the servers, and here is the .rhosts file on host9:

#more .rhosts
host7
host7.long.name.net
host8
host8.long.name.net

I do not want to add +root to .rhosts, because I only want to be able to rlogin as root without a password from these 2 specified servers.

What am I missing??

Thanks,
Joe

[Chris Watkins_1]

Make sure host7's entry is correct in host9's /etc/hosts file,
or that it gets the correct info from DNS if you're using DNS.

[Uday_S_Ankolekar]

Try with ipaddress instead of ipaddress
Also put root infront of ipaddress or hostname

host7.long.name.net root
xx.xx.xx.xx root

-USA..

[Vijaya Kumar_3]

Some more thoughts for troubleshooting:

Check host7 is able to connect to any other host using rlogin? Can you check the permission for .rhosts file? Any DNS issues with host7?

One more link:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=64497

-Vijay

[Jay Core]

Chris - thanks - good thought - the IP was correct in /etc/hosts

Uday - thanks - I tried with short name, long name, and IP, and put root after them, and it didn't work.

I'll keep looking.

Thanks,
Joe

[Chris Watkins_1]

You might try adding a hosts.equiv file, but that's masking the problem.

In the same format as .rhosts, ie...

cat /etc/hosts.equiv

hostname root
hostname2 root
etc... root

[Jay Core]

Vijay,

thanks. host7 can connect to any other host with no problem. .rhosts is set at 600, on host9, and DNS is fine, both forward and reverse.

Joe

[Jay Core]

Chris,

thanks - like you intimated, I do want to get to the "root" of the problem - so I'll use your solution as a last resort.

No offense
Thanks,
Joe

[Vijaya Kumar_3]

One more thought:

Is Host7 running MC/Serviceguard?

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=138299

-Vijay

[Jay Core]

Vijay - no ServiceGuard

thanks,
Joe

[G. Vrijhoeven]

Hi,

just a question but do you have NIS configured?
Do you have the same OS levels/patch levels on all servers?

Gideon

[Jay Core]

Hi G.,

We do have NIS configured on host7, not host8 or host9. I didn't think this would be an issue?? Also, all 3 servers are at very similar patch levels running 11.0.

Thanks,
Joe

[G. Vrijhoeven]

Hi Joe,

I found a patch that might interest you.

http://www5.itrc.hp.com/service/patch/patchDetail.do?BC=patch.breadcrumb.main|patch.breadcrumb.search|&patchid=PHNE_23003&context=hpux:800:11:00

Check:

PHNE_17028:

1. When the patch PHNE_16091 is installed, remshd/rexecd
fails to transmit the error message to the client. When
the user gives invalid input to remsh/rexec, then the
error message will not be displayed to the user.
This happens only when the user is in ksh.

2. In NIS environment, rlogin prompts for the password
even if there is an entry in the .rhosts file. Even
if the user tries to give the password, it will report
as Login incorrect.



HTH.

Gideon

[Jay Core]

Gideon,

thanks! I do have this patch on my system. Let me check this out fully tomorrow, and I'll assign you the full 10 points if this fixes it - thanks!

Joe

[Elmar P. Kolkman]

One more thing you can test: do the rlogin to get to host9 from host7 and look at the output of 'netstat -af inet'. Look for lines on the login port and see what name host7 has in those lines. Perhaps there is a IP domain issue or it is using a network route you didn't anticipate...

[Todd McDaniel_1]

Joe,

First, I would recommend that you make sure your services are all running just in case.


Next, I would NOT recommend using /etc/hosts.equiv, It can be more dangerous than merely using .rhosts. From the manpage....

quote: "The
/etc/hosts.equiv file defines system-wide equivalency, whereas a
user's .rhosts file defines equivalency between the local user and any
remote users to whom the local user chooses to allow or deny access."

end quote

Of course with root you will have full equivalency but .rhosts is less of a hole than hosts.equiv will be. As a rule, I usu avoid it, if at all possible.


IN addition, I would ask you to check the file /etc/hosts.allow and hosts.deny... to ensure you dont have anything configured there to prevent connection.

OR you may need to ADD a lines like this...

rlogind : all : banners=/usr/localcw/opt/sysguard/banners : allow
remshd: all : banners=/usr/localcw/opt/sysguard/banners : allow
rexecd : all : banners=/usr/localcw/opt/sysguard/banners : allow

[Jay Core]

Gideon,

thanks again, but I do have the PHNE_23003 on our server, and we are able to log into the server when
the password is entered.

Thanks again,
Joe



Elmar,

something on the login lines of the output of the "netstat -af inet" command looks a little
kludgy. I am holding off issuing ppoints, because if this solves the problem
I want to give you the full 10.

Thanks,
Joe



Todd,

thanks - all my services are running. I am not using hosts.equiv. I do not have a hosts.allow
or a hosts.deny file. As far as adding those lines, I'm a little leery doing this because none
of the other servers need these entries and are working fine.

Thank you, though, for all your input.
Joe

[Todd McDaniel_1]

No points here...

yes that was only a suggestion if you were using the hosts.allow and deny files...

If you aren't using them then you won't usually have the files at all. so disregard that portion.

[Jay Core]

Thanks Todd,

Dude - I gotta give at least 1 point for the reply - thanks.

Joe

[Jay Core]

Hmmm, it didn't let me give you a point - sorry.

[Michael Schulte zur Sur]

Hi,

when I rlogin to a machine and it requires me to enter the password even though it shouldn't, I do it and use w to look, what the machine thinks, I am coming from. This I put in .rhosts and /etc/hosts.

greetings,

Michael

[Jay Core]

Thanks to all who replied - still no solution - I'm going to break down and call the Response Center.

Joe

[Sridhar Bhaskarla · Accepted solution]

Hi Joe,

There are quite a few messages in this thread. This suggestion probably might have been given.

Try enabling logging with inetd and observe as what this server is getting in as.

inetd -l (on host9)

tail -f /var/adm/syslog/syslog.log (on host9)

from host7, now do a 'rlogin host9' and now see what system name is appearing in the syslog and make sure that system name is specified in your .rhosts.

-Sri

[Kenneth Platz]

When you login to your system from host7 and host8, run the command "who -u am i", and use that hostname in your .rhosts.

It may be that you are on a multihomed system, and coming in over an IP address you're not necessarily expecting.

[Jay Core]

Kenneth - no luck - only coming up as root, which I already knew about - thanks, though.

Sridhar - congrats! This tracking option pointed me to the problem! An old/invalid IP showed up in the syslog after I enabled logging - now I can troubleshoot it - thanks again.

Joe