Commit | Line | Data |
---|---|---|
d8a59ffe KM |
1 | .\" Copyright (c) 1983 Regents of the University of California. |
2 | .\" All rights reserved. The Berkeley software License Agreement | |
3 | .\" specifies the terms and conditions for redistribution. | |
4 | .\" | |
3e7075be | 5 | .\" @(#)rshd.8 6.2 (Berkeley) %G% |
d8a59ffe | 6 | .\" |
2ca7130d | 7 | .TH RSHD 8C "" |
d8a59ffe KM |
8 | .UC 5 |
9 | .SH NAME | |
10 | rshd \- remote shell server | |
11 | .SH SYNOPSIS | |
12 | .B /etc/rshd | |
13 | .SH DESCRIPTION | |
14 | .I Rshd | |
15 | is the server for the | |
16 | .IR rcmd (3X) | |
17 | routine and, consequently, for the | |
18 | .IR rsh (1C) | |
19 | program. The server provides remote execution facilities | |
20 | with authentication based on privileged port numbers. | |
21 | .PP | |
22 | .I Rshd | |
23 | listens for service requests at the port indicated in | |
24 | the ``cmd'' service specification; see | |
25 | .IR services (5). | |
26 | When a service request is received the following protocol | |
27 | is initiated: | |
28 | .IP 1) | |
29 | The server checks the client's source port. | |
30 | If the port is not in the range 0-1023, the server | |
31 | aborts the connection. | |
32 | .IP 2) | |
33 | The server reads characters from the socket up | |
34 | to a null (`\e0') byte. The resultant string is | |
35 | interpreted as an ASCII number, base 10. | |
36 | .IP 3) | |
37 | If the number received in step 1 is non-zero, | |
38 | it is interpreted as the port number of a secondary | |
39 | stream to be used for the | |
40 | .BR stderr . | |
41 | A second connection is then created to the specified | |
42 | port on the client's machine. The source port of this | |
43 | second connection is also in the range 0-1023. | |
44 | .IP 4) | |
45 | The server checks the client's source address. | |
46 | If the address is associated with a host for which no | |
47 | corresponding entry exists in the host name data base (see | |
48 | .IR hosts (5)), | |
49 | the server aborts the connection. | |
50 | .IP 5) | |
51 | A null terminated user name of at most 16 characters | |
52 | is retrieved on the initial socket. This user name | |
3e7075be JL |
53 | is interpreted as the user identity on the |
54 | .BR client 's | |
d8a59ffe KM |
55 | machine. |
56 | .IP 6) | |
57 | A null terminated user name of at most 16 characters | |
58 | is retrieved on the initial socket. This user name | |
3e7075be JL |
59 | is interpreted as a user identity to use on the |
60 | .BR server 's | |
d8a59ffe KM |
61 | machine. |
62 | .IP 7) | |
63 | A null terminated command to be passed to a | |
64 | shell is retrieved on the initial socket. The length of | |
65 | the command is limited by the upper bound on the size of | |
66 | the system's argument list. | |
67 | .IP 8) | |
68 | .I Rshd | |
69 | then validates the user according to the following steps. | |
70 | The remote user name is looked up in the password file | |
71 | and a | |
72 | .I chdir | |
73 | is performed to the user's home directory. If either | |
74 | the lookup or | |
75 | .I chdir | |
76 | fail, the connection is terminated. | |
77 | If the user is not the super-user, (user id 0), the file | |
78 | .I /etc/hosts.equiv | |
79 | is consulted for a list of hosts considered ``equivalent''. | |
80 | If the client's host name is present in this file, the | |
81 | authentication is considered successful. If the lookup | |
82 | fails, or the user is the super-user, then the file | |
83 | .I .rhosts | |
84 | in the home directory of the remote user is checked for | |
85 | the machine name and identity of the user on the client's | |
86 | machine. If this lookup fails, the connection is terminated. | |
87 | .IP 9) | |
3e7075be | 88 | A null byte is returned on the initial socket |
d8a59ffe KM |
89 | and the command line is passed to the normal login |
90 | shell of the user. The | |
91 | shell inherits the network connections established | |
92 | by | |
93 | .IR rshd . | |
94 | .SH DIAGNOSTICS | |
3e7075be JL |
95 | Except for the last one listed below, |
96 | all diagnostic messages | |
97 | are returned on the initial socket, | |
d8a59ffe KM |
98 | after which any network connections are closed. |
99 | An error is indicated by a leading byte with a value of | |
100 | 1 (0 is returned in step 9 above upon successful completion | |
3e7075be | 101 | of all the steps prior to the execution of the login shell). |
d8a59ffe KM |
102 | .PP |
103 | .B ``locuser too long'' | |
104 | .br | |
105 | The name of the user on the client's machine is | |
106 | longer than 16 characters. | |
107 | .PP | |
108 | .B ``remuser too long'' | |
109 | .br | |
110 | The name of the user on the remote machine is | |
111 | longer than 16 characters. | |
112 | .PP | |
113 | .B ``command too long '' | |
114 | .br | |
115 | The command line passed exceeds the size of the argument | |
116 | list (as configured into the system). | |
117 | .PP | |
3e7075be | 118 | .B ``Host name for your address unknown.'' |
d8a59ffe KM |
119 | .br |
120 | No entry in the host name database existed for | |
121 | the client's machine. | |
122 | .PP | |
123 | .B ``Login incorrect.'' | |
124 | .br | |
125 | No password file entry for the user name existed. | |
126 | .PP | |
127 | .B ``No remote directory.'' | |
128 | .br | |
129 | The | |
130 | .I chdir | |
131 | command to the home directory failed. | |
132 | .PP | |
133 | .B ``Permission denied.'' | |
134 | .br | |
135 | The authentication procedure described above failed. | |
136 | .PP | |
137 | .B ``Can't make pipe.'' | |
138 | .br | |
139 | The pipe needed for the | |
140 | .BR stderr , | |
141 | wasn't created. | |
142 | .PP | |
143 | .B ``Try again.'' | |
144 | .br | |
145 | A | |
146 | .I fork | |
147 | by the server failed. | |
148 | .PP | |
3e7075be | 149 | .B ``<shellname>: ...'' |
d8a59ffe | 150 | .br |
3e7075be JL |
151 | The user's login shell could not be started. This message is returned |
152 | on the connection associated with the | |
153 | .BR stderr , | |
154 | and is not preceded by a flag byte. | |
d8a59ffe KM |
155 | .SH SEE ALSO |
156 | rsh(1C), | |
157 | rcmd(3X) | |
158 | .SH BUGS | |
159 | The authentication procedure used here assumes the integrity | |
160 | of each client machine and the connecting medium. This is | |
161 | insecure, but is useful in an ``open'' environment. | |
162 | .PP | |
163 | A facility to allow all data exchanges to be encrypted should be | |
164 | present. |