looking for a trick to allow rlogin but not remsh

[Marc Ahrendt]

i want a remote user to be able to rlogin to hostB as frog without asking for a password but was wondering if their was a trick to prevent remsh from working ...since it too reads the .rhosts

"rlogin hostB -l frog" works as desired but i want to find a way to make "remsh hostB -l frog" to fail ...is there a way?

i need this feature because the account is "captive" and works great for my application BUT do not want the environment to be hacked via remsh

thx, marc

[Denver Osborn]

Have you considered using ssh instead?

-denver

[Con O'Kelly]

Hi Marc

I'd agree with Denver and look at using SSH. Using .rhosts and 'r' services presents a big security risk.
You can set up SSH to use Publickey authentication so you don't need to enter passwords. You'll have the same functionality as rlogin but far more secure.

Having said that if you want to use rlogin but not remsh, you can disable remsh in /etc/inetd.conf and then run inetd -c to pick up the changes.

Cheers
Con

[Marc Ahrendt]

i cannot use ssh in this particular situation but even if i could, wouldn't i have the same issue? slogin = rlogin and slogin = remsh ...or does slogin not act like remsh when using as "slogin frog@hostB uname -a" by bypassing the .profile?

regardless, i am stuck for the moment with thr r* commands

[Marc Ahrendt]

Con, my concern about modifying /etc/inetd.conf is that it is global ...and will impact more than user frog

i am looking for something that will only prevent remsh from accessing frog@hostB yet allow rlogin access. i do know that rlogin and remsh act differently when accessing the remote account ...so hoping there is a way to exploit that, but not sure how

[Biswajit Tripathy]

If I understand correctly, you want to allow rlogin
and block remsh into a system. One way to do this
would be to use IPFilter. Configure following IPFilter
rules:

$ /sbin/ipf -Fa -f -
pass in quick proto tcp from any to any port = 513
block in quick proto tcp from any to any port = 514
^D

- Biswajit

[Biswajit Tripathy]

One small correction. Since you want to block remsh
only from hostB, change the IPFilter rules to following:
---
pass in quick proto tcp from hostB to any port = 513
block in quick proto tcp from hostB to any port = 514
----

replace hostB with host B's IP address or hostname.

- Biswajit

[Elmar P. Kolkman · Accepted solution]

I'm sorry, but that is not possible...
remsh will use the rlogind when no command is used...
This is from the manual page of remsh:
If command, is not specified, instead of executing a single command, you will be logged in on the remote host using rlogin (see rlogin(1)).

So, unless you specify commands remsh should run on the other side, it is not possible to distinguish on that side of the connection with what command it was established... Sorry.


Good luck,

Elmar

[Marc Ahrendt]

thx Biswajit, i will look into IPF at some point ...just cannot add additional sooftware at this time

thx Elmar, i was hoping for something but was prepared for an answer like yours ...thx for the feedback