rexec

[Ihab Zaki]

Hello,

Is there a way to ban only one user from using rexec.

I know that I can comment the 'exec' line in /etc/inetd.conf but this will ban all users.

Thanks,
Ihab

[Mark Grant]

You can use /var/adm/inetd.sec to limit individual IP's and hosts from running services.

It will look something like the following but check out "man inetd.sec"

exec deny 10.0.8.231

[Graham Cameron_1]

Further to Mark's suggestion, note that you will have to modify the inetd.sec file on each remote system you want to stop the user getting out to.

You could consider writing a wrapper for rexec on the local system, but it's not so clean a solution.

-- Graham

[Ihab Zaki]

This applies to host / IP but not to user level, in my case I want to ban a user not a machine

[Mark Grant · Accepted solution]

You can do this but it's going to be really annoying. You can make sure that each user that uses rexec has a .rhosts file except the one you want to stop and that /etc/hosts.equiv does not contain a reference to the originating host.

This is going to be a pain to manage if you have a lot of users using rexec.

[Graham Cameron_1]

I don't think the suggestion re .rhosts will help.
Unlike remsh, rexec dies not use .rhosts (or hosts.equiv). It prompts for a password and uses login authentication.

-- Graham

[Mark Grant]

Graham,

"man rexec"

[Jeff Schussele]

Hi Ihab,

Another option would be to obtain & install Tcp_wrappers software. Using it's /etc/hosts.allow & /etc/hosts.deny files granularity can be taken down to the user level as well as host & subnet levels.

Tcp_wrappers can be obtained here:

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/

Rgds,
Jeff

[Mark Grant]

Graham,

Apologies!! You are right, it's a long time since I read the man page for "rexec".

rexec authenticates the same as login!