Logging In to a Remote System (rlogin)
The rlogin command enables you to log in to a remote system. After
you are logged in, you can navigate through the remote file system and
manipulate its contents (subject to authorization), copy files, or execute remote commands.
If the system you are logging in to is in a remote
domain, be sure to append the domain name to the system name. In
this example, SOLAR is the name of the remote domain:
rlogin pluto.SOLAR
Also, you can interrupt a remote login operation at any time by
typing Control-d.
Authentication for Remote Logins (rlogin)
Authentication (establishing who you are) for rlogin operations can be performed either by
the remote system or by the network environment.
The main difference between these forms of authentication lies in the type of
interaction they require from you and the way they are established. If a
remote system tries to authenticate you, you are prompted for a password, unless
you set up the /etc/hosts.equiv or .rhosts file. If the network tries to
authenticate you, you are not asked for a password, because the network already
knows who you are.
When the remote system attempts to authenticate you, it relies on information in
its local files, specifically if one of the following is true:
Your system name and user name appear in the remote system's /etc/hosts.equiv file.
Your system name and user name appear in the remote user's .rhosts file, under the remote user's home directory.
Network authentication relies on one of these two methods:
A “trusting network environment” that has been set up with your local network information service and the automounter.
One of the network information services that is pointed to by the remote system's /etc/nsswitch.conf file contains information about you.
Note - Network authentication generally supersedes system authentication.
/etc/hosts.equiv File
The /etc/hosts.equiv file contains a list of trusted hosts for a remote system,
one per line. If a user attempts to log in remotely (using rlogin)
from one of the hosts that is listed in this file, and if
the remote system can access the user's password entry, the remote system allows
the user to log in without a password.
A typical hosts.equiv file has the following structure:
host1
host2 user_a
+@group1
-@group2
When a simple entry for a host is made in hosts.equiv, such as
the previous entry for host1, it means that the host is trusted, and
so is any user at that machine.
If the user name is also mentioned, as in the second entry
in the example, then the host is trusted only if the specified user
is attempting access.
A group name that is preceded by a plus sign (+) means
that all the machines in that netgroup are considered trusted.
A group name that is preceded by a minus sign (–) means that
none of the machines in that netgroup is considered trusted.
Security Risks When Using the /etc/hosts.equiv File
The /etc/hosts.equiv file presents a security risk. If you maintain a /etc/hosts.equiv file
on your system, you should include only trusted hosts in your network. The
file should not include any host that belongs to a different network, or
any machines that are in public areas. For example, do not include a
host that is located in a terminal room.
The use of hosts that are not trusted can create a serious
security problem. Either replace the /etc/hosts.equiv file with a correctly configured one, or remove
the file altogether.
A single line of + in the /etc/hosts.equiv file indicates that every
known host is trusted.
.rhosts File
The .rhosts file is the user equivalent of the /etc/hosts.equiv file. This
file contains a list of host-user combinations, rather than hosts in general. If
a host-user combination is listed in this file, the specified user is granted
permission to log in remotely from the specified host without having to supply
a password.
Note that a .rhosts file must reside at the top level of a
user's home directory. .rhost files that are located in subdirectories are not consulted.
Users can create .rhosts files in their home directories. Using the .rhosts file
is another way to allow trusted access between users' own accounts on different
systems without using the /etc/hosts.equiv file.
Security Risks When Using the .rhosts File
Unfortunately, the .rhosts file presents a major security problem. While the /etc/hosts.equiv file is
under the system administrator's control and can be managed effectively, any user can
create a .rhosts file that grants access to whomever the user chooses without
the system administrator's knowledge.
In a situation in which all of the users' home directories are
on a single server and only certain people have superuser access on that
server, a good way to prevent a user from using a .rhosts file is
to create an empty file as superuser in their home directory. You
would then change the permissions in this file to 000 so that it
would be difficult to change it, even as superuser. This change would effectively
prevent a user from risking system security by using a .rhosts file irresponsibly. The
change would not, however, solve anything if the user is able to change
the effective path to his or her home directory.
The only secure way to manage .rhosts files is to completely disallow them.
See How to Search for and Remove .rhosts Files for detailed instructions. As system administrator, you can check the system
often for violations of this policy. One possible exception to this policy is
for the root account; you might need to have a .rhosts file to
perform network backups and other remote services.
Linking Remote Logins
If your system is configured properly, you can link remote logins. For
example, a user on earth logs in to jupiter, and from there decides
to log in to pluto.
The user could have logged out of jupiter and then logged in directly
to pluto, but this type of linking can be more convenient.
To link remote logins without having to supply a password, you must have
the /etc/hosts.equiv or .rhosts file set up correctly.
Direct or Indirect Remote Logins
The rlogin command allows you to log in to a remote system directly
or indirectly.
A direct remote login is attempted with the default user name, that is,
the user name of the individual who is currently logged in to
the local system. This is the most common form of remote login.
An indirect remote login is attempted with a different user name, which is
supplied during the remote login operation. This is the type
of remote login you might attempt from a workstation that you borrowed temporarily. For
instance, if you were in a coworker's office and needed to examine
files in your home directory, you might log in to your system remotely,
from your coworker's system. However, you would perform an indirect remote login, supplying your
own user name.
The dependencies between direct and indirect logins and authentication methods are summarized in
the following table.
Table 29-2 Dependencies Between Login Method and Authentication Method (rlogin)
Type of Login |
User Name Supplied By |
Authentication |
Password |
|---|
Direct |
System |
Network |
None |
|
|
System |
Required |
Indirect |
User |
Network |
None |
|
|
System |
Required |
What Happens After You Log In Remotely
When you log in to a remote system, the rlogin command attempts to
find your home directory. If the rlogin command can't find your home directory,
it assigns you to the remote system's root (/) directory. For example:
Unable to find home directory, logging in with /
However, if the rlogin command finds your home directory, it sources both your
.cshrc and .login files. Therefore, after a remote login, your prompt is your
standard login prompt, and the current directory is the same as when you
log in locally.
For example, if your usual prompt displays your system name and working directory,
and when you log in, your working directory is your home directory, your
login prompt resembles the following:
earth(/home/smith):
Then when you log in to a remote system, you see a
similar prompt and your working directory is your home directory, regardless of the
directory from which you entered the rlogin command:
earth(/home/smith): rlogin pluto
.
.
.
pluto(/home/smith):
The only difference is that the name of the remote system would
substitute for your local system at the beginning of the prompt. The remote
file system is parallel to your home directory.
Effectively, if you change directory to /home and then run ls, you see
the following:
earth(home/smith): cd ..
earth(/home): ls
smith jones
How to Search for and Remove .rhosts Files
- Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
To configure a role with the Primary Administrator profile, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.
- Search for and remove .rhosts files by using the find(1) command.
# find home-directories -name .rhosts -print -exec rm {} \;- home-directories
Identifies the path to a directory where users' home directories are located. Note that you can enter multiple paths to search more than one home directory at a time.
- -name .rhosts
Identifies the file name.
- -print
Prints the current path name.
- -exec rm {} \;
Tells the find command to apply the rm command to all files that are identified by using the matching file name.
The find command starts at the designated directory and searches for any file
that is named .rhosts. If it finds such as file, find prints the
path on the screen and removes it.
Example 29-1 Searching for and Removing
.rhosts Files
The following example searches and removes .rhosts files in all the user's home
directories that are located in the /export/home directory.
# find /export/home -name .rhosts -print | xargs -i -t rm {} \;
How to Find Out If a Remote System Is Operating
Find out if a remote system is operating by using the ping
command.
$ ping system-name | ip-address
- system-name
The name of the remote system
- ip-address
The IP address of the remote system
The ping command returns one of three messages:
Status Message |
Explanation |
|---|
system-name
is alive |
The system can be accessed over the network. |
ping: unknown host system-name |
The system name is
unknown. |
ping: no answer from system-name |
The system is known, but is not currently operating. |
If the system you “ping” is located in a different domain, the return
message can also contain routing information, which you can ignore.
The ping command has a timeout of 20 seconds. Effectively, if it does
not receive a response within 20 seconds, it returns the third message. You
can force ping to wait longer (or less) by typing a time-out value,
in seconds:
$ ping system-name | ip-address time-out
For more information, see ping(1M).
How to Find Who Is Logged In to a Remote System
Find who is logged in to a remote system by using the
rusers(1) command.
$ rusers [-l] remote-system-name
- rusers
(No options) Displays the name of the system, followed by the name of users who are currently logged in to it, including root
- -l
Displays additional information about each user: the user's login window, login time and date, amount of time logged in, and the name of the remote system from which the user logged on
Example 29-2 Finding Who Is Logged In to a Remote System
The following example shows the short output of rusers.
$ rusers pluto
pluto smith jones
In the following example, the long version of rusers shows that two users
are logged in to the remote system starbug. The first user logged in
from the system console on September 10 and has been logged on for
137 hours and 15 minutes. The second user logged in from a
remote system, mars, on September 14.
$rusers -l starbug
root starbug:console Sep 10 16:13 137:15
rimmer starbug:pts/0 Sep 14 14:37 (mars)
How to Log In to a Remote System (rlogin)
Log in to a remote system by using the rlogin(1) command.
$ rlogin [-l user-name] system-name
- rlogin
(No options) Logs you in to the remote system directly, effectively, with your current user name
- -l user-name
Logs you into the remote system indirectly, effectively, with the user name you supply
If the network attempts to authenticate you, you are not prompted for a
password. If the remote system attempts to authenticate you, you are asked to
provide a password.
If the operation succeeds, the rlogin command displays brief information about your latest
remote login to that system, the version of the operating system that is
running on the remote system, and whether you have mail waiting for you
in your home directory.
Example 29-3 Logging In to a Remote System (
rlogin)
The following example shows the output of a direct remote login to
pluto. The user has been authenticated by the network.
$ rlogin starbug
Last login: Mon Jul 12 09:28:39 from venus
Sun Microsystems Inc. SunOS 5.8 February 2000
starbug:
The following example shows the output of an indirect remote login to pluto,
with the user being authenticated by the remote system.
$ rlogin -l smith pluto
password: user-password
Last login: Mon Jul 12 11:51:58 from venus
Sun Microsystems Inc. SunOS 5.8 February 2000
starbug:
How to Log Out From a Remote System (exit)
Log out from a remote system by using the exit(1) command.
$ exit
Example 29-4 Logging Out From a Remote System (
exit)
This example shows the user smith logging out from the system pluto.
$ exit
pluto% logout
Connection closed.
earth%
