rsh username limit with long Windows2k username?

[paul cummings]

We have a web site with active server pages that is setup to run health checks on Unix machines using the rsh command from the W2K side into the unix systems. The W2K username running the rsh is 19 characters long. the rsh execution just hangs and never completes and eventually gives the error message: "remshd: remuser too long rsh: can't establish connection". If we modify the health check.cmd file to use rexec, the health check works, but of course, prompts for the password on the remote unix system. Anybody know if there's a workaround for this other than making the W2K username shorter - like 8 or 14 characters?

[Patrick Wallek]

How about just specifying the '-l username' option in the windows command to go to the approrpiate HP-UX user?

From Windows:

rsh yourhost -l user1 whatever_command_you_run

[paul cummings]

That's what we've been doing all along.

[Sridhar Bhaskarla]

Hi,

Depending on whatever the product you use to connect through rexec, you should be able to create a file similar to .netrc that will allow you without prompting for the password. Look at the documentation of that product.

The name limitation is 16 characters for both remshd and rexecd. So, I am not sure even rexecd works.

-Sri

[RAC_1]

The unix rexec uses .netrc file. This allows executing a command without prompting for password. man rexec for details. Is such thing available on Windows's rexec???

Anil

[paul cummings]

I don't want to put passwords in files (like netrc)

[RAC_1]

If you do not want to put password in a file, then use ssh. Set it for exchange of keys.

Anil

[paul cummings]

ssh would take some work. we are bound by change control and not sure that we could get it installed/setup on HP-Ux 10.20.

[Sridhar Bhaskarla]

One way could be to install a software like Cygwin that supports 'su', create a shorter user and then su to that account then do rsh if the W2K account has admin capabilities.

-Sri

[Bill Hassell]

rexec and remsh/rsh are big security risks regardless of the source or destination. rexec is slightly better in that remote system do require any special files (ie, .rhosts). .netrc should not be a risk because the Windows system will be extremely tight on security and accessability. And because of this security, only Unix compatible user names are allowed (8 chars or less) If it is not secure, then don't allow ANY 'r' commands to be run from this box.

As far as ssh and 10.20, you're right. It's going to be tricky to get the code you need, especially if you don't have the expertise to compile and build the tools. I would hope that your change control understands that 10.20 is way beyond end of life and end of support.