topic Re: rexec in Operating System - HP-UX

rexec

Ihab Zaki — Mon, 03 Nov 2003 01:53:47 GMT

Hello,

Is there a way to ban only one user from using rexec.

I know that I can comment the 'exec' line in /etc/inetd.conf but this will ban all users.

Thanks,
Ihab

Re: rexec

Mark Grant — Mon, 03 Nov 2003 01:58:09 GMT

You can use /var/adm/inetd.sec to limit individual IP's and hosts from running services.

It will look something like the following but check out "man inetd.sec"

exec deny 10.0.8.231

Re: rexec

Graham Cameron_1 — Mon, 03 Nov 2003 03:16:50 GMT

Further to Mark's suggestion, note that you will have to modify the inetd.sec file on each remote system you want to stop the user getting out to.

You could consider writing a wrapper for rexec on the local system, but it's not so clean a solution.

-- Graham

Re: rexec

Ihab Zaki — Mon, 03 Nov 2003 06:46:18 GMT

This applies to host / IP but not to user level, in my case I want to ban a user not a machine

Re: rexec

Mark Grant — Mon, 03 Nov 2003 08:39:48 GMT

You can do this but it's going to be really annoying. You can make sure that each user that uses rexec has a .rhosts file except the one you want to stop and that /etc/hosts.equiv does not contain a reference to the originating host.

This is going to be a pain to manage if you have a lot of users using rexec.

Re: rexec

Graham Cameron_1 — Mon, 03 Nov 2003 08:53:40 GMT

I don't think the suggestion re .rhosts will help.
Unlike remsh, rexec dies not use .rhosts (or hosts.equiv). It prompts for a password and uses login authentication.

-- Graham

Re: rexec

Mark Grant — Mon, 03 Nov 2003 08:56:35 GMT

Graham,

"man rexec"

Re: rexec

Jeff Schussele — Mon, 03 Nov 2003 08:57:23 GMT

Hi Ihab,

Another option would be to obtain & install Tcp_wrappers software. Using it's /etc/hosts.allow & /etc/hosts.deny files granularity can be taken down to the user level as well as host & subnet levels.

Tcp_wrappers can be obtained here:

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/

Rgds,
Jeff

Re: rexec

Mark Grant — Mon, 03 Nov 2003 08:59:33 GMT

Graham,

Apologies!! You are right, it's a long time since I read the man page for "rexec".

rexec authenticates the same as login!