remsh and rlogin

[jim bidebo]

how does remsh and rlogin authenticate itself?
because if i make script with suid bit that executes remsh to a mashine where root got a .rhost file that allows the source-mashine to login without pass it doesnt work... (even doe it should be executed by root?(who is the owner of the script))
(i know this is kinda large security breach... but im just curious)

[Marco Paganini]

Hello,

I don't believe remsh would use the Effective UID, since that could be a security problem. Remember that when you set the suid bit, you give the program the EUID of 0. It's up to the program to use those provileges.

If you want to execute remsh as root, I'd suggest a wrapper like sudo. Sudo is fully configurable via a text file. You can even specify what arguments can be passed to remsh increasing security.

Regards,
Paga

[Uday_S_Ankolekar]

Hi,
If I understood your prombelm correctly then,

replace hostname with Ipaddress in .rhosts file check if it works. If yes then you have a problem with DNS. Check for DNS setup (/etc/nsswitch.conf /etc/resolve.conf etc)

Goodluck,
-USA..

[A. Clay Stephenson]

Hi Jim:

I am going to make a wild guess - you have not man'ed remshd and rlogind. Please do so; they give a step-by-step sequence of the authenication scheme. The basic problem with setuid is that it only applies to the local host - as it should. Would you like for me to be able to become the root user on one of your machines? The setuid is not sufficient. It also looks at hosts.equiv and .rhosts.

Clay

[jim bidebo]

well the script works if i run it as root

no i dont want anyone to get root at my mashine if i havent allowed it...

but in this case i have allowed it...
first by adding the mashine from which i run the script in the mashines .rhost... which allows a login (without passwd auth) from the mashine that executes the script.

so in the teori:
a user without root priviledge runs the script that have the suid bit. and thereby becomes root while executing the script...
from there he should be able to run all programs that requires root priviledge...
including remsh... and since the remote mashine got the host in roots .rhost, the user should also have root priviledge on the remote mashine... yes its insecure... =)

[Darrell Allen · Accepted solution]

Hi Jim,

I don't know if this will work for remsh but it may. I've had to write a program to call scripts for certain commands. I don't know which or why but this worked for me.

Check out http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xeb5a1012aa92d5118ff10090279cd0f9,00.html

My answer may be overkill but it may point you in the right direction.

Darrell