who used r-commands?

[SAST]

Hi everybody,

Is there a way to know who used r-commands to access to my server?

[Rita C Workman]

By r-commands I'll assume you mean the Berkley group of r.

Well....for them to gain access to "your" server by using the Berkley commands, you would have had to set up an .rhost file giving them the right. So I might start by checking the .rhost files on all "my" boxes and see what is in them.

Just a thought,
Rita

[Pete Randall]

The last command will identify those who may have "remsh'd" to your server, but I expect it to be near impossible to identify the source of rcopy's and the like.


Pete

[Ninad_1]

Hi,

Check your /var/adm/syslog/syslog.log on the destination server.
I have seen r- commands getting logged into syslog.log

Regards,
Ninad

[Armin Kunaschik]

You can use nettl (or tcpdump) to monitor present/future connections to the r-ports 512, 513 and 514.
But this will not tell you about the past.
r-commands rarely log something. Most of the time you'll see login failures in syslog.

Maybe a bit more aggressive approach: Configure ssh, tell all potential users to migrate to ssh and simply deactivate r-services.

My 2 cents,
Armin

PS: Assign points if you find answers useful!

[SAST]

I've tested rlogin and remsh connections to my box. last command and syslog doesn't show any activity.

Oh sorry, i've this output using last :

root pts/0 Fri Nov 21 11:26 - 11:33 (00:07)

But no other indication.

[SAST]

Thanks everybody for your help. It was my first post and your replies was helpful for me.

[SAST]

the best way as explained is to deactivate r* services.