topic Re: rlogin entries in inetd.conf - Vulnerability in Operating System - HP-UX

rlogin entries in inetd.conf - Vulnerability

sapoguheman — Tue, 14 Jul 2015 15:43:04 GMT

Hi All,

My security team has raised a concern reagring the rlogin entry in the inetd.conf and asked me to hash stop the service.

I dont have any rhosts or hosts.equiv files on my server .

My Question is :

1. I have rlogin entry in inetd.conf file but dont have rhosts or hosts.equiv will rlogin still work or could it be still considered as rlogin as vulnerable.

Thanks In advance

Re: rlogin entries in inetd.conf - Vulnerability

Bill Hassell — Tue, 14 Jul 2015 18:14:01 GMT

>> will rlogin still work or could it be still considered as rlogin as vulnerable.

Absolutely yes, 100% of the so-called 'r' commands (rlogin, remsh, rexec and rcp) are NOT secure since the passwords are sent without encryption. The lack of .rhosts and hosts.equiv means that rlogin will ask you for the password first, then log you in but the 'r' commands still work.

However the passwords will be transmitted in plain text so any network trace can see them. For this reason, all Unix systems should disable telnet, ftp and the 'r' commands, and use nothing but ssh and scp.

In inetd.conf, these lines should be commented:

#  login        stream tcp6 nowait root /usr/lbin/rlogind  rlogind
#  shell        stream tcp6 nowait root /usr/lbin/remshd   remshd
#  exec         stream tcp6 nowait root /usr/lbin/rexecd   rexecd

Re: rlogin entries in inetd.conf - Vulnerability

RJHall — Tue, 14 Jul 2015 22:19:51 GMT

You can also make sure the r* commands remain blocked with the inetd.sec(4) file. For example:

$ cat /var/adm/inetd.sec
login   deny
exec    deny
shell   deny

and so forth...

Re: rlogin entries in inetd.conf - Vulnerability

sapoguheman — Wed, 15 Jul 2015 09:40:43 GMT

Hi Bill,

Can i get any supporting documents for the same .

Thanks

Re: rlogin entries in inetd.conf - Vulnerability

Bill Hassell — Wed, 15 Jul 2015 10:40:19 GMT

>> Can i get any supporting documents for the same.

I am very unclear about your question.

Do you need documents about how edit the inetd.conf file?

Or how to signal the changes in inetd.conf?

Or how rlogin/rexec/remsh work?

Or somethng stating that the 'r' commands transmit unexncrypted passwords?

Or that telnet and ftp have the same vulnerability?

Re: rlogin entries in inetd.conf - Vulnerability

sapoguheman — Wed, 15 Jul 2015 11:23:31 GMT

I need some supporting documents which mentions even keeping rlogin entry in inetd.conf is vulnerable even though it doesnt have ant rhosts / hosts.equiv files.

I tried on few servers where rhosts / hosts.equiv files are not present but still am able to login from root to root with passord for fews server and on some servers it doesnt works.

Thanks

Re: rlogin entries in inetd.conf - Vulnerability

Bill Hassell — Wed, 15 Jul 2015 11:27:11 GMT

How about this:

https://en.wikipedia.org/wiki/Rlogin

If you are concerned about security, disabling rlogin is a miniscule step towards reducing system vulnerabilities.

Why are you using rlogin rather than telnet?

But more important, why are you not using ssh?

Re: rlogin entries in inetd.conf - Vulnerability

Bill Hassell — Wed, 15 Jul 2015 11:38:14 GMT

>> I tried on few servers where rhosts / hosts.equiv files are not present but still am able to login from root to root with passord for fews server and on some servers it doesnt works.

...doesn't work...

That is not helpful to determine the problem. "Some servers don't work" could mean that the servers are dead, or that rlogind is not enabled. The .rhosts and hosts.equiv files simply allow login without having to type a password. The password that you type using rlogin is visible to anyone looking at your network traffic.

Re: rlogin entries in inetd.conf - Vulnerability

sapoguheman — Wed, 15 Jul 2015 11:49:42 GMT

I am using ssh.

I wanted to justify few teams that even keeping rlogin entry in inetd.conf is vulnerable .

Re: rlogin entries in inetd.conf - Vulnerability

Bill Hassell — Wed, 15 Jul 2015 12:11:20 GMT

>> I wanted to justify few teams that even keeping rlogin entry in inetd.conf is vulnerable .

Keeping rlogin in inetd.conf isn't the issue. Using rlogin is the problem. You stop users from running rlogin (and rcp and remsh and rexec and telneet and ftp) by turning off the daemons in inetd.conf. Most data centers forbid the use of these services. And good Unix auditors will write findings when these services are discovered.