path: root/usr/src/man/man1m/in.rshd.1m

'\" te
.\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
.\" Copyright 1989 AT&T
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH IN.RSHD 1M "June 20, 2021"
.SH NAME
in.rshd, rshd \- remote shell server
.SH SYNOPSIS
.nf
\fBin.rshd\fR [\fB-k5eciU\fR] [\fB-s\fR \fItos\fR] [\fB-S\fR \fIkeytab\fR] [\fB-M\fR \fIrealm\fR]
     [\fB-L\fR \fIenv_var\fR] \fIhost.port\fR
.fi

.SH DESCRIPTION
\fBin.rshd\fR is the server for the \fBrsh\fR(1) program. The server provides
remote execution facilities with authentication based on Kerberos V5 or
privileged port numbers.
.sp
.LP
\fBin.rshd\fR is invoked by \fBinetd\fR(1M) each time a shell service is
requested.
.sp
.LP
When Kerberos V5 authentication is required (this can be set with
Kerberos-specific options listed below), the following protocol is initiated:
.RS +4
.TP
1.
Check Kerberos V5 authentication.
.RE
.RS +4
.TP
2.
Check authorization according to rules in \fBkrb5_auth_rules\fR(5).
.RE
.RS +4
.TP
3.
A null byte is returned on the initial socket and the command line is passed
to the normal login shell of the user. (The \fBPATH\fR variable is set to
\fB/usr/bin\fR.) The shell inherits the network connections established by
\fBin.rshd\fR.
.RE
.sp
.LP
In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
Kerberos principal must exist for each Fully Qualified Domain Name associated
with the \fBin.rshd\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR principals
must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR file on the
\fBin.rshd\fR server. An example principal might be:
.sp
.LP
\fBhost/bigmachine.eng.example.com\fR
.sp
.LP
See \fBkadmin\fR(1M) for instructions on adding a principal to a
\fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
authentication.
.sp
.LP
If Kerberos V5 authentication is not enabled, then \fBin.rshd\fR executes the
following protocol:
.RS +4
.TP
1.
The server checks the client's source port. If the port is not in the range
512-1023, the server aborts the connection. The client's host address (in hex)
and port number (in decimal) are the arguments passed to \fBin.rshd\fR.
.RE
.RS +4
.TP
2.
The server reads characters from the socket up to a null (\fB\e0\fR) byte.
The resultant string is interpreted as an \fBASCII\fR number, base 10.
.RE
.RS +4
.TP
3.
If the number received in step 2 is non-zero, it is interpreted as the port
number of a secondary stream to be used for the \fBstderr\fR. A second
connection is then created to the specified port on the client's machine. The
source port of this second connection is also in the range 512-1023.
.RE
.RS +4
.TP
4.
A null-terminated user name of at most 16 characters is retrieved on the
initial socket. This user name is interpreted as the user identity on the
\fIclient\fR's machine.
.RE
.RS +4
.TP
5.
A null terminated user name of at most 16 characters is retrieved on the
initial socket. This user name is interpreted as a user identity to use on the
\fIserver\fR's machine.
.RE
.RS +4
.TP
6.
A null terminated command to be passed to a shell is retrieved on the
initial socket. The length of the command is limited by the upper bound on the
size of the system's argument list.
.RE
.RS +4
.TP
7.
\fBin.rshd\fR then validates the user according to the following steps. The
remote user name is looked up in the password file and a \fBchdir\fR is
performed to the user's home directory. If the lookup fails, the connection is
terminated. If the \fBchdir\fR fails, it does a \fBchdir\fR to \fB/\fR (root).
If the user is not the superuser, (user \fBID\fR 0), and if the pam_rhosts_auth
\fBPAM\fR module is configured for authentication, the file
\fB/etc/hosts.equiv\fR is consulted for a list of hosts considered
"equivalent". If the client's host name is present in this file, the
authentication is considered successful. See the SECURITY section below for a
discussion of \fBPAM\fR authentication.
.sp
If the lookup fails, or the user is the superuser, then the file
\fB\&.rhosts\fR in the home directory of the remote user is checked for the
machine name and identity of the user on the client's machine. If this lookup
fails, the connection is terminated
.RE
.RS +4
.TP
8.
A null byte is returned on the initial connection and the command line is
passed to the normal login shell of the user. The \fBPATH\fR variable is set to
\fB/usr/bin\fR. The shell inherits the network connections established by
\fBin.rshd\fR.
.RE
.SH OPTIONS
The following options are supported:
.sp
.ne 2
.na
\fB\fB-5\fR\fR
.ad
.RS 14n
Same as \fB-k\fR, for backwards compatibility
.RE

.sp
.ne 2
.na
\fB\fB-c\fR\fR
.ad
.RS 14n
Requires Kerberos V5 clients to present a cryptographic checksum of initial
connection information like the name of the user that the client is trying to
access in the initial authenticator. This checksum provides additionl security
by preventing an attacker from changing the initial connection information.
This option is mutually exclusive with the \fB-i\fR option.
.RE

.sp
.ne 2
.na
\fB\fB-e\fR\fR
.ad
.RS 14n
Requires the client to encrypt the connection.
.RE

.sp
.ne 2
.na
\fB\fB-i\fR\fR
.ad
.RS 14n
Ignores authenticator checksums if provided. This option ignores authenticator
checksums presented by current Kerberos clients to protect initial connection
information. Option \fB-i\fR is the opposite of option \fB-c\fR.
.RE

.sp
.ne 2
.na
\fB\fB-k\fR\fR
.ad
.RS 14n
Allows Kerberos V5 authentication with the \fB\&.k5login\fR access control file
to be trusted. If this authentication system is used by the client and the
authorization check is passed, then the user is allowed to log in.
.RE

.sp
.ne 2
.na
\fB\fB-L\fR \fIenv_var\fR\fR
.ad
.RS 14n
List of environment variables that need to be saved and passed along.
.RE

.sp
.ne 2
.na
\fB\fB-M\fR \fIrealm\fR\fR
.ad
.RS 14n
Uses the indicated Kerberos V5 realm. By default, the daemon will determine its
realm from the settings in the \fBkrb5.conf\fR(4) file.
.RE

.sp
.ne 2
.na
\fB\fB-s\fR \fItos\fR\fR
.ad
.RS 14n
Sets the \fBIP\fR \fBTOS\fR option.
.RE

.sp
.ne 2
.na
\fB\fB-S\fR \fIkeytab\fR\fR
.ad
.RS 14n
Sets the \fBKRB5\fR keytab file to use. The \fB/etc/krb5/krb5.keytab\fR file is
used by default.
.RE

.sp
.ne 2
.na
\fB\fB-U\fR\fR
.ad
.RS 14n
Refuses connections that cannot be mapped to a name through the
\fBgetnameinfo\fR(3SOCKET) function.
.RE

.SH USAGE
\fBrshd\fR and \fBin.rshd\fR are IPv6-enabled. See \fBip6\fR(7P). \fBIPv6\fR is
not currently supported with Kerberos V5 authentication.
.sp
.LP
The Kerberized \fBrshd\fR service runs on port 544 (kshell). The corresponding
FMRI entry is: :
.sp
.in +2
.nf
svc:/network/shell:kshell (rshd with kerberos (ipv4 only))
.fi
.in -2
.sp

.SH SECURITY
\fBin.rshd\fR uses \fBpam\fR(3PAM) for authentication, account management, and
session management. The \fBPAM\fR configuration policy, listed through
\fB/etc/pam.conf\fR, specifies the modules to be used for \fBin.rshd\fR. Here
is a partial \fBpam.conf\fR file with entries for the \fBrsh\fR command using
rhosts authentication, \fBUNIX\fR account management, and session management
module.
.sp

.sp
.TS
l l l l
l l l l .
rsh	auth	required	pam_rhosts_auth.so.1

rsh	account	required	pam_unix_roles.so.1
rsh	session	required	pam_unix_projects.so.1
rsh	session	required	pam_unix_account.so.1

rsh	session	required	pam_unix_session.so.1
.TE

.sp
.LP
If there are no entries for the \fBrsh\fR service, then the entries for the
"other" service are used. To maintain the authentication requirement for
\fBin.rshd\fR, the rsh entry must always be configured with the
\fBpam_rhosts_auth.so.1\fR module.
.sp
.LP
\fBin.rshd\fR can authenticate using Kerberos V5 authentication or
\fBpam\fR(3PAM). For Kerberized \fBrsh\fR service, the appropriate \fBPAM\fR
service name is \fBkrsh\fR.
.SH FILES
\fB/etc/hosts.equiv\fR
.sp
.ne 2
.na
\fB\fB$HOME/.k5login\fR\fR
.ad
.RS 23n
File containing Kerberos principals that are allowed access.
.RE

.sp
.ne 2
.na
\fB\fB/etc/krb5/krb5.conf\fR\fR
.ad
.RS 23n
Kerberos configuration file.
.RE

.SH SEE ALSO
\fBrsh\fR(1), \fBsvcs\fR(1), \fBinetadm\fR(1M),
\fBinetd\fR(1M), \fBkadmin\fR(1M), \fBsvcadm\fR(1M), \fBpam\fR(3PAM),
\fBgetnameinfo\fR(3SOCKET), \fBhosts\fR(4), \fBkrb5.conf\fR(4),
\fBpam.conf\fR(4), \fBattributes\fR(5), \fBenviron\fR(5),
\fBkrb5_auth_rules\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
\fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
\fBpam_rhosts_auth\fR(5), \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5),
\fBpam_unix_session\fR(5), \fBsmf\fR(5), \fBip6\fR(7P)
.sp
.LP
\fI\fR
.SH DIAGNOSTICS
The following diagnostic messages are returned on the connection associated
with \fBstderr\fR, after which any network connections are closed. An error is
indicated by a leading byte with a value of 1 in step 8 above (\fB0\fR is
returned above upon successful completion of all the steps prior to the command
execution).
.sp
.ne 2
.na
\fB\fBlocuser too long\fR\fR
.ad
.sp .6
.RS 4n
The name of the user on the client's machine is longer than 16 characters.
.RE

.sp
.ne 2
.na
\fB\fBremuser too long\fR\fR
.ad
.sp .6
.RS 4n
The name of the user on the remote machine is longer than 16 characters.
.RE

.sp
.ne 2
.na
\fB\fBcommand too long\fR\fR
.ad
.sp .6
.RS 4n
The command line passed exceeds the size of the argument list (as configured
into the system).
.RE

.sp
.ne 2
.na
\fB\fBHostname for your address unknown.\fR\fR
.ad
.sp .6
.RS 4n
No entry in the host name database existed for the client's machine.
.RE

.sp
.ne 2
.na
\fB\fBLogin incorrect.\fR\fR
.ad
.sp .6
.RS 4n
No password file entry for the user name existed.
.RE

.sp
.ne 2
.na
\fB\fBPermission denied.\fR\fR
.ad
.sp .6
.RS 4n
The authentication procedure described above failed.
.RE

.sp
.ne 2
.na
\fB\fBCan't make pipe.\fR\fR
.ad
.sp .6
.RS 4n
The pipe needed for the \fBstderr\fR was not created.
.RE

.sp
.ne 2
.na
\fB\fBTry again.\fR\fR
.ad
.sp .6
.RS 4n
A \fIfork\fR by the server failed.
.RE

.SH NOTES
The authentication procedure used here assumes the integrity of each client
machine and the connecting medium. This is insecure, but it is useful in an
"open" environment.
.sp
.LP
A facility to allow all data exchanges to be encrypted should be present.
.sp
.LP
The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
provided by \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
\fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
\fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), and
\fBpam_unix_session\fR(5).
.sp
.LP
The \fBin.rshd\fR service is managed by the service management facility,
\fBsmf\fR(5), under the service identifier:
.sp
.in +2
.nf
svc:/network/shell:default
.fi
.in -2
.sp

.sp
.LP
Administrative actions on this service, such as enabling, disabling, or
requesting restart, can be performed using \fBsvcadm\fR(1M). Responsibility for
initiating and restarting this service is delegated to \fBinetd\fR(1M). Use
\fBinetadm\fR(1M) to make configuration changes and to view configuration
information for this service. The service's status can be queried using the
\fBsvcs\fR(1) command.