rlogin not working now...

[Todd McDaniel_1]

Okay I have a weird problem.

I have made no changes to my servers... but this morning I cant rlogin/remsh from one certain box to two others... which I have always been able to do so in the past.

I can rlogin/remsh from the other boxes, back to the first box. I think I have a service down or similar...

Help!!!

[David Child_1]

Todd,

Maybe run a DNS query from the server you are trying to connect to. See if the origin host is coming up correctly.

David

[Florian Heigl (new acc)]

It will fail due to DNS issues - check that the target server is able to perform the reverse lookup for the connecting server *AND* localhost / 127.0.0.1

[Jeff Schussele]

Hi Todd,

I agree - probably DNS.
Make sure you do forward & reverse lookups from each box on the other as well as itself.
And make sure you bypass the hosts file & query the DNS server(s).

Rgds,
Jeff

[Peter Godron]

Todd,
If you have not changed anything, either something has failed or been added.
Can you ping between the machines (both directions), using ip address and dns names?
If this fails problem with physical network or DNS server.
If this works check that inetd is working.
Please let us know how you get on.
Regards

[Florian Heigl (new acc) · Accepted solution]

If this does not appear to be an DNS issue, check the permissions on .rhosts and the syslog (You never know :))

[Todd McDaniel_1]

Thanks for your replys... it was the result of incorrect ownership of .rhosts

It seems that the rhosts file ownership was changed somehow?

Very odd indeed... In one case they were changed to a userid/GID... in the other case got changed to an application user/GID???

[Florian Heigl (new acc)]

Todd - this means that somehow someones permissions were elevated beyond a level that would be tolerable, and I don't think it can happen without someone intending it to happen.

check Your history files a bit, this might
happen by using chown -R instead of chown -Rh if someone soft-linked /.rhosts to ~/.rhosts

otherwise You will have to go through Your backups and identify when the change of permissions happened, and what other files' owners changed. If it really was yesterday, You should hopefully to identify if this was by mistake (sh_history) or a malicious action (last, last -b, syslog, rkhunter(!!!))