rlogin entries in inetd.conf - Vulnerability

[sapoguheman]

Hi All,

My security team has raised a concern reagring the rlogin entry in the inetd.conf and asked me to hash stop the service.

I dont have any rhosts or hosts.equiv files on my server .

My Question is :

1. I have rlogin entry in inetd.conf file but dont have  rhosts or hosts.equiv will rlogin still work or could it be still considered as rlogin as vulnerable.

Thanks In advance

[Bill Hassell]

>> will rlogin still work or could it be still considered as rlogin as vulnerable.

Absolutely yes, 100% of the so-called 'r' commands (rlogin, remsh, rexec and rcp) are NOT secure since the passwords are sent without encryption. The lack of .rhosts and hosts.equiv means that rlogin will ask you for the password first, then log you in but the 'r' commands still work.

However the passwords will be transmitted in plain text so any network trace can see them. For this reason, all Unix systems should disable telnet, ftp and the 'r' commands, and use nothing but ssh and scp.

 In inetd.conf, these lines should be commented:

#  login        stream tcp6 nowait root /usr/lbin/rlogind  rlogind
#  shell        stream tcp6 nowait root /usr/lbin/remshd   remshd
#  exec         stream tcp6 nowait root /usr/lbin/rexecd   rexecd

[RJHall]

You can also make sure the r* commands remain blocked with the inetd.sec(4) file. For example:

$ cat /var/adm/inetd.sec
login   deny
exec    deny
shell   deny

and so forth...

[sapoguheman]

Hi Bill,

Can i get any supporting documents for the same .

Thanks

[Bill Hassell]

>> Can i get any supporting documents for the same.

I am very unclear about your question.

Do you need documents about how edit the inetd.conf file?

Or how to signal the changes in inetd.conf?

Or how rlogin/rexec/remsh work?

Or somethng stating that the 'r' commands transmit unexncrypted passwords?

Or that telnet and ftp have the same vulnerability?

[sapoguheman]

I need some supporting documents which mentions even keeping rlogin entry in inetd.conf is vulnerable even though it doesnt have ant rhosts / hosts.equiv files.

I tried on few servers where rhosts / hosts.equiv files are not present but still am able to login from root to root with passord for fews server and on some servers it doesnt works.

Thanks

[Bill Hassell]

How about this:

https://en.wikipedia.org/wiki/Rlogin

If you are concerned about security, disabling rlogin is a miniscule step towards reducing system vulnerabilities.

Why are you using rlogin rather than telnet?

But more important, why are you not using ssh?

[Bill Hassell]

>> I tried on few servers where rhosts / hosts.equiv files are not present but still am able to login from root to root with passord for fews server and on some servers it doesnt works.

...doesn't work...

That is not helpful to determine the problem. "Some servers don't work" could mean that the servers are dead, or that rlogind is not enabled. The .rhosts and hosts.equiv files simply allow login without having to type a password. The password that you type using rlogin is visible to anyone looking at your network traffic.

[sapoguheman]

I am using ssh.

I wanted to justify few teams that even keeping rlogin entry in inetd.conf is vulnerable .

[Bill Hassell]

>> I wanted to justify few teams that even keeping rlogin entry in inetd.conf is vulnerable .

Keeping rlogin in inetd.conf isn't the issue. Using rlogin is the problem. You stop users from running rlogin (and rcp and remsh and rexec and telneet and ftp) by turning off the daemons in inetd.conf. Most data centers forbid the use of these services. And good Unix auditors will write findings when these services are discovered.