topic Re: remsh problem in Operating System - HP-UX

remsh problem

dictum9 — Tue, 30 Jan 2007 16:13:55 GMT

Trying to remsh to an Itanium 11.23 box and the remsh asks for a password. I set up the ~/.rhosts file but the problem persists.

Once I enter the password, it logs me in, but cannot do passwordless logins.

Looking at /etc/inetd.conf and /etc/services, everthing looks reasonable.

Any idea what is going on?

Re: remsh problem

John Dvorchak — Tue, 30 Jan 2007 16:18:23 GMT

Are you trying to remsh to the 11.23 box as root? What is the perms of ~root/.rhosts? It should be 400.

Re: remsh problem

A. Clay Stephenson — Tue, 30 Jan 2007 16:22:33 GMT

Is this a non-root user and is the -l remshd option in effect? (Check /etc/inetd.conf for this).

Re: remsh problem

James R. Ferguson — Tue, 30 Jan 2007 16:23:49 GMT

Hi:

I'd review the contents of your '.rhosts' file. Make sure, too that your file is readable and writeable only by the owner.

Regards!

...JRF...

Re: remsh problem

dictum9 — Tue, 30 Jan 2007 16:25:44 GMT

I forgot to mention that I am doing it as a regular user.

When I try to remsh to execute a command on there, it says login incorrect.

when I try to login in via remsh, it asks for the password, and when I enter the password, it logs me in.

But it doesn't do password-less authentication.

Re: remsh problem

John Dvorchak — Tue, 30 Jan 2007 16:29:45 GMT

Are you logged on to the originating box as the same userid as on the target box? If not you have to use the -l userid switch. From the man remsh page:

remsh -l user_on_host hostname command

Also does the host use password authentication or some sort of SecurID card where the password changes every minute or so?

Re: remsh problem

dictum9 — Tue, 30 Jan 2007 16:42:03 GMT

#:grep remsh /etc/inetd.conf
shell stream tcp6 nowait root /usr/lbin/remshd remshd
# The standard remshd and rlogind do not include the Kerberized
kshell stream tcp nowait root /usr/lbin/remshd remshd -K

$ ll .rhosts
-r-------- 1 test1 sap 76 Jan 30 15:58 .rhosts

Re: remsh problem

Denver Osborn — Tue, 30 Jan 2007 16:49:36 GMT

Are you using the shortname or fqdn in .rhosts file?

After you rlogin using password, what host does "who -mR" display? This string doesn't match the .rhosts entry. You could also change the hostname to the ip for testing in .rhosts

Hope this helps,
-denver

Re: remsh problem

Denver Osborn — Tue, 30 Jan 2007 16:58:33 GMT

ew. I need to reword that or stop playing on the ITRC and take a nap. :)

Anyhow, should've been... run "who -mR" and if the host string doesn't match what's in your ~/.rhosts entry, fix it.

-denver

Re: remsh problem

dictum9 — Tue, 30 Jan 2007 17:16:18 GMT

Bingo - that fixed it. It was resolving to hostname.backups.com, not the primary name. Don't know why, but I included it in the .rhosts - and it works, without the password now.

quote-----------------------

who -mR" and if the host string doesn't match what's in your ~/.rhosts entry, fix it.

Re: remsh problem

Bill Hassell — Tue, 30 Jan 2007 20:56:33 GMT

And to amplify the solution a bit: remsh is a good metric for bad DNS configurations. Since remsh is bypassing the usual interactive login authentication, it resorts to the only security available: DNS reverse lookup. Unfortunately, DNS is often assigned to the PC admins who think in terms of domains and WINS. Reverse IP lookup may be missing as well as MX (mail delivery).

Now if you don't use DNS (no /etc/resolv.conf file) then /etc/hosts will govern what remsh will see. The two commands to check name resolution are nslookup and nsquery:

nslookup abc
nslookup 12.34.56.78
nsquery hosts abc

Re: remsh problem

Dennis Handly — Tue, 30 Jan 2007 23:15:59 GMT

I've had cases where rlogin didn't work so I had to use the IP address in my .rhosts file until the sysadmin could figure out why DNS or NIS wasn't working.