track rlogin,remsh,rcmd

[Pradep]

Hi, Is there anyway to track which users are using these services and login to the servers using above remote services, so that i can contact them not to use that and then i can safely disable these services, without impacting business.

[Matti_Kurkela · Accepted solution]

Add the '-l' option to INETD_ARGS variable in /etc/rc.config.d/netdaemons, then restart inetd with "sh /sbin/init.d/inetd stop; sh /sbin/init.d/inetd start".

Now inetd will log the source hostname, IP and the service used on every connection.

Read /var/adm/syslog/syslog.log to find out where the connection attempts are coming from and which user account they're using. Then track down the users with this information.

MK

[Hakki Aydin Ucar]

Use whodo:

it is for which users are doing what

For long list, use:

# whodo -l

[Hakki Aydin Ucar]

I want to add that for a specific users it is useful to issue:

# whodo -l | grep -i

for more info check the man page

# man whodo

[Mel Burslan]

I know this is not a direct response to your question, but contacting users to convince them to change from r-series commands to using ssh based commands is not easy, if not totally impossible. People do not like to give up their tested and true ways of doing things no matter what you say.

Best way to accomplish your goal is to put a message display block in the /etc/profile starting 30 days before you cut off the r-commands. And make sure it is read by asking for the user to hit enter after reading, by putting something like

read dummy

at the end of message echo statements. At the end of the 30 day period, just plain cut them off. They will be forced to comply. First few days after that will be a little harsh on the support team, but slowly, they will resume functioning properly.

HTH

[Pradep]

Hi Mel,
good suggestion of /etc/profile.
But i am looking for helping users moving out of r* commands. like finding alternative ways for executing scripts/ automated processed which use these commands.

my first step is to find out if anyone is using these commands in manual or automated ways. more difficult is to find out where these cmd used in automation.

any ideas around that pls ?

[James R. Ferguson]

Hi:

> But i am looking for helping users moving out of r* commands. like finding alternative ways for executing scripts/ automated processed which use these commands.

First, I wholly agree with Mel. Advertise the demise of the unsecure r-commands and then cut those off when you say you will.

As for finding their use in automated processes, start by examining the processes listed in the 'crontabs' of any users with them. You could 'grep' for 'rcp', 'remsh', 'rlogin', 'rexec', etc. When found you could advise the user via mail that these methods will be prohibited after some date --- a fix it or it won't work dictum. Of course you need the support of management. Company auditors make excellent "bad-guys" too.

Regards!

...JRF...

[Pradep]

Hi Matti.
thanks for the valuable suggestion.
I am testing it. rlogin attempt shows as login/tcp in syslog and remsh attempt as shell/tcp. still need to test rcmd,rcp etc.
thanks.

[Suraj K Sankari]

Hi Pradep,
Please make a habit to assign points, people who give there valuable time to your problem you also take some time to assign points to there work.
If you donâ t know how to assign please see this below link.

http://forums13.itrc.hp.com/service/forums/helptips.do?#33

Suraj

[Pradep]

Hey, sure..i always assing points to every reply. infact to every reply, whether it helps to solve problem or not. ( it is to appreciate the time people spend in replyign to my queries). thanks for the reminders. i am still working on the issue.

Please let me know if you have any suggestions about this problem.

regards.