path: root/usr/src/man/man1m/in.rlogind.1m

'\" te
.\" Copyright 1989 AT&T
.\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH IN.RLOGIND 1M "Oct 29, 2015"
.SH NAME
in.rlogind, rlogind \- remote login server
.SH SYNOPSIS
.LP
.nf
\fB/usr/sbin/in.rlogind\fR [\fB-k5eExXciPp\fR] [\fB-s\fR \fItos\fR] [\fB-S\fR \fIkeytab\fR]
     [\fB-M\fR \fIrealm\fR]
.fi

.SH DESCRIPTION
.sp
.LP
\fBin.rlogind\fR is the server for the \fBrlogin\fR(1) program.  The server
provides a remote login facility with authentication based on Kerberos V5 or
privileged port numbers.
.sp
.LP
\fBin.rlogind\fR is invoked by \fBinetd\fR(1M) when a remote login connection
is established. When Kerberos V5 authentication is required (see option
\fB-k\fR below), the authentication sequence is as follows:
.RS +4
.TP
.ie t \(bu
.el o
Check Kerberos V5 authentication.
.RE
.RS +4
.TP
.ie t \(bu
.el o
Check authorization according to the rules in \fBkrb5_auth_rules\fR(5).
.RE
.RS +4
.TP
.ie t \(bu
.el o
Prompt for a password if any checks fail and \fB/etc/pam.conf\fR is configured
to do so.
.RE
.sp
.LP
In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
Kerberos principal must exist for each Fully Qualified Domain Name associated
with the \fBin.rlogind\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR
principals must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR
file on the \fBin.rlogind\fR server. An example principal might be:
.sp
.LP
\fBhost/bigmachine.eng.example.com\fR
.sp
.LP
See \fBkadmin\fR(1M) for instructions on adding a principal to a
\fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
authentication.
.sp
.LP
If Kerberos V5 authentication is not enabled, then the authentication procedure
follows the standard \fBrlogin\fR protocol:
.RS +4
.TP
.ie t \(bu
.el o
The server checks the client's source port. If the port is not in the range
512-1023, the server aborts the connection.
.RE
.RS +4
.TP
.ie t \(bu
.el o
The server checks the client's source address. If an entry for the client
exists in both \fB/etc/hosts\fR and \fB/etc/hosts.equiv\fR, a user logging in
from the client is not prompted for a password. If the address is associated
with a host for which no corresponding entry exists in \fB/etc/hosts\fR, the
user is prompted for a password, regardless of  whether or not an entry for the
client is present in  \fB/etc/hosts.equiv\fR. See \fBhosts\fR(4) and
\fBhosts.equiv\fR(4).
.RE
.sp
.LP
Once the source port and address have been checked, \fBin.rlogind\fR allocates
a pseudo-terminal and manipulates file descriptors so that the slave half of
the pseudo-terminal becomes the \fBstdin\fR, \fBstdout\fR, and \fBstderr\fR for
a login process. The login process is an instance of the \fBlogin\fR(1)
program, invoked with the \fB-r\fR.
.sp
.LP
The login process then proceeds with the \fBpam\fR(3PAM) authentication
process. See \fBSECURITY\fR below.  If automatic authentication fails, it
reprompts the user to login.
.sp
.LP
The parent of the login process manipulates the master side of the
pseudo-terminal, operating as an intermediary between the login process and the
client instance of the \fBrlogin\fR program.  In normal operation, a packet
protocol is invoked to provide Ctrl-S and Ctrl-Q type facilities and propagate
interrupt signals to the remote programs. The login process propagates the
client terminal's baud rate and terminal type, as found in the environment
variable, \fBTERM\fR.
.SH OPTIONS
.sp
.LP
The following options are supported:
.sp
.ne 2
.na
\fB\fB-5\fR\fR
.ad
.RS 13n
Same as \fB-k\fR, for backwards compatibility.
.RE

.sp
.ne 2
.na
\fB\fB-c\fR\fR
.ad
.RS 13n
Requires Kerberos V5 clients to present a cryptographic checksum of initial
connection information like the name of the user that the client is  trying  to
access in the initial authenticator. This checksum provides additionl security
by preventing an attacker from changing the initial connection information.
This option is mutually exclusive with the \fB-i\fR option.
.RE

.sp
.ne 2
.na
\fB\fB-e\fR\fR
.ad
.RS 13n
Creates an encrypted session.
.RE

.sp
.ne 2
.na
\fB\fB-E\fR\fR
.ad
.RS 13n
Same as \fB-e\fR, for backwards compatibility.
.RE

.sp
.ne 2
.na
\fB\fB-i\fR\fR
.ad
.RS 13n
Ignores authenticator checksums if provided. This option ignores authenticator
checksums presented by current Kerberos clients to protect initial connection
information. Option \fB-i\fR is the opposite of option \fB-c\fR.
.RE

.sp
.ne 2
.na
\fB\fB-k\fR\fR
.ad
.RS 13n
Allows Kerberos V5 authentication with the \fB\&.k5login\fR access control file
to be trusted. If this authentication system is used by the client and the
authorization check is passed, then the user is allowed to log in.
.RE

.sp
.ne 2
.na
\fB\fB-M\fR \fIrealm\fR\fR
.ad
.RS 13n
Uses the indicated Kerberos V5 realm. By default, the daemon will determine its
realm from the settings in the \fBkrb5.conf\fR(4) file.
.RE

.sp
.ne 2
.na
\fB\fB-p\fR\fR
.ad
.RS 13n
Prompts for authentication only if other authentication checks fail.
.RE

.sp
.ne 2
.na
\fB\fB-P\fR\fR
.ad
.RS 13n
Prompts for a password in addition to other authentication methods.
.RE

.sp
.ne 2
.na
\fB\fB-s\fR \fItos\fR\fR
.ad
.RS 13n
Sets the \fBIP\fR \fBTOS\fR option.
.RE

.sp
.ne 2
.na
\fB\fB-S\fR \fIkeytab\fR\fR
.ad
.RS 13n
Sets the \fBKRB5\fR keytab file to use. The\fB/etc/krb5/krb5.keytab\fR file is
used by default.
.RE

.sp
.ne 2
.na
\fB\fB-x\fR\fR
.ad
.RS 13n
Same as \fB-e\fR, for backwards compatibility.
.RE

.sp
.ne 2
.na
\fB\fB-X\fR\fR
.ad
.RS 13n
Same as \fB-e\fR, for backwards compatibility.
.RE

.SH USAGE
.sp
.LP
\fBrlogind\fR and \fBin.rlogind\fR are IPv6-enabled. See \fBip6\fR(7P).
\fBIPv6\fR is not currently supported with Kerberos V5 authentication.
.sp
.LP
Typically, Kerberized \fBrlogin\fR service runs on port 543 (klogin) and
Kerberized, encrypted \fBrlogin\fR service runs on port 2105 (eklogin). The
corresponding FMRI entries are:
.sp
.in +2
.nf
svc:/network/login:klogin (rlogin with kerberos)
svc:/network/login:eklogin (rlogin with kerberos and encryption)
.fi
.in -2
.sp

.SH SECURITY
.sp
.LP
\fBin.rlogind\fR uses \fBpam\fR(3PAM) for authentication, account management,
and session management. The \fBPAM\fR configuration policy, listed through
\fB/etc/pam.conf\fR, specifies the modules to be used for \fBin.rlogind\fR.
Here is a partial \fBpam.conf\fR file with entries for the \fBrlogin\fR command
using the "rhosts" and UNIX authentication modules, and the UNIX account,
session management, and password management modules.
.sp

.sp
.TS
l l l
l l l .
rlogin	auth sufficient	pam_rhosts_auth.so.1
rlogin	auth requisite	pam_authtok_get.so.1
rlogin	auth required	pam_dhkeys.so.1
rlogin	auth required	pam_unix_auth.so.1
		
rlogin	account required	pam_unix_roles.so.1
rlogin	account required	pam_unix_projects.so.1
rlogin	account required	pam_unix_account.so.1
		
rlogin	session required	pam_unix_session.so.1
.TE

.sp
.LP
With this configuration, the server checks the client's source address. If an
entry for the client exists in both \fB/etc/hosts\fR and
\fB/etc/hosts.equiv\fR, a user logging in from the client is not prompted for a
password. If the address is associated with a host for which no corresponding
entry exists in \fB/etc/hosts\fR, the user is prompted for a password,
regardless of whether or not an entry for the client is present in
\fB/etc/hosts.equiv\fR. See \fBhosts\fR(4) and \fBhosts.equiv\fR(4).
.sp
.LP
When running a Kerberized rlogin service (with or without the encryption
option), the pam service name that should be used is "\fBkrlogin\fR".
.sp
.LP
If there are no entries for the \fBrlogin\fR service, then the entries for the
"other" service will be used. If multiple authentication modules are listed,
then the user may be prompted for multiple passwords. Removing the
\fBpam_rhosts_auth.so.1\fR entry will disable the \fB/etc/hosts.equiv\fR and
\fB~/.rhosts\fR authentication protocol and the user would always be forced to
type the password. The \fIsufficient\fR flag indicates that authentication
through the \fBpam_rhosts_auth.so.1\fR module is sufficient to authenticate the
user. Only if this authentication fails is the next authentication module used.
.SH SEE ALSO
.sp
.LP
\fBlogin\fR(1), \fBsvcs\fR(1), \fBrlogin\fR(1),
\fBin.rshd\fR(1M), \fBinetadm\fR(1M), \fBinetd\fR(1M), \fBkadmin\fR(1M),
\fBsvcadm\fR(1M), \fBpam\fR(3PAM), \fBhosts\fR(4), \fBhosts.equiv\fR(4),
\fBkrb5.conf\fR(4), \fBpam.conf\fR(4), \fBattributes\fR(5), \fBenviron\fR(5),
\fBkrb5_auth_rules\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
\fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
\fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5),
\fBsmf\fR(5)
.sp
.LP
\fI\fR
.SH DIAGNOSTICS
.sp
.LP
All diagnostic messages are returned on the connection associated with the
\fBstderr\fR, after which any network connections are closed. An error is
indicated by a leading byte with a value of 1.
.sp
.ne 2
.na
\fB\fBHostname for your address unknown.\fR\fR
.ad
.sp .6
.RS 4n
No entry in the host name database existed for the client's machine.
.RE

.sp
.ne 2
.na
\fB\fBTry again.\fR\fR
.ad
.sp .6
.RS 4n
A \fIfork\fR by the server failed.
.RE

.sp
.ne 2
.na
\fB\fB/usr/bin/sh:\fR .\|.\|.\fR
.ad
.sp .6
.RS 4n
The user's login shell could not be started.
.RE

.SH NOTES
.sp
.LP
The authentication procedure used here assumes the integrity of each client
machine and the connecting medium.  This is insecure, but it is useful in an
``open'' environment.
.sp
.LP
A facility to allow all data exchanges to be encrypted should be present.
.sp
.LP
The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
provided by \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
\fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
\fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), and
\fBpam_unix_session\fR(5).
.sp
.LP
The \fBin.rlogind\fR service is managed by the service management facility,
\fBsmf\fR(5), under the service identifier:
.sp
.in +2
.nf
svc:/network/login:rlogin (rlogin)
svc:/network/login:klogin (rlogin with kerberos)
svc:/network/login:eklogin (rlogin with kerberos and encryption)
.fi
.in -2
.sp

.sp
.LP
Administrative actions on this service, such as enabling, disabling, or
requesting restart, can be performed using \fBsvcadm\fR(1M). Responsibility for
initiating and restarting this service is delegated to \fBinetd\fR(1M). Use
\fBinetadm\fR(1M) to make configuration changes and to view configuration
information for this service. The service's status can be queried using the
\fBsvcs\fR(1) command.