2

If I run rsh, it works, but prints some strange “Connection refused” messages at the beginning:

$ rsh localhost pwd
connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
/home/service

But if I run rsh under strace, it doesn't connect to the server at all:

$ strace -c rsh localhost ulimit -n
connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
rcmd: socket: Permission denied
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 28.39    0.000113           2        58           read
 27.64    0.000110          16         7           write
 16.83    0.000067           1        47           open
 15.33    0.000061           2        27           munmap
 11.81    0.000047           1        80           mmap
  0.00    0.000000           0        58           close
  0.00    0.000000           0         1           stat
  0.00    0.000000           0        45           fstat
   ..........................................
   ..........................................
   ..........................................

Here is an extract from strace rsh localhost ulimit -n:

connect(3, {sa_family=AF_INET, sin_port=htons(544), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ECONNREFUSED (Connection refused)
write(2, "Connection refused\n", 19)    = 19
connect(3, {sa_family=AF_INET, sin_port=htons(544), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ECONNREFUSED (Connection refused)
write(2, "Connection refused\n", 19)    = 19

Questions

  1. What is causing port 544: Connection refused?
  2. Why does it show the error rcmd: socket: Permission denied? It should show some integer value (the output of ulimit -n on the remote machine).
devsda
  • 427
  • 3
  • 10
  • 19
  • I am aware that this won't answer your question, but please refrain from using rsh. It's insecure. – schaiba Mar 13 '13 at 10:04
  • You really enjoy posting your profiling data – daisy Mar 13 '13 at 10:06
  • @warl0ck Actually I am in problem, now I am tracing how many system calls are called in whole command. This question is also related to the same. From last question that you closed, I learnt a lesson that do any work, but that would be step by step, now I think you will help me, and promote my efforts. – devsda Mar 13 '13 at 10:23
  • @schaiba Thanks for your advice. I will follow this. But now my application totally uses rsh, so I have to debug in the same. But yes I will move to ssh very soon. But for current scenario I want to solve rsh problems, and yes, the above one also. – devsda Mar 13 '13 at 10:30
  • @warl0ck Help me, I searched a lot , try to free up that port, using command, `netstat -a | grep :544`. But it didn't show any output. Check EDIT part of question also. – devsda Mar 13 '13 at 11:07
  • @Mat I have single system, and I make rsh on my machine. – devsda Mar 13 '13 at 11:29
  • I didn't understand, what you want to say, actually I never rsh before this task. Can you ask in simple words? – devsda Mar 13 '13 at 11:32
  • @Mat See EDIT NO. 2, may be this will help you. – devsda Mar 13 '13 at 11:34
  • Can we do a discussion on chat, because I stuck in one position. I only take few minutes. – devsda Mar 13 '13 at 11:38
  • Here we go again. Which implementation of rsh (what package from what distribution, or where did you get the source and how did you compile it)? How is it configured (post every applicable file in `/etc` — which ones apply depends on your implementation)? – Gilles 'SO- stop being evil' Mar 13 '13 at 21:14
  • @Gilles My question is very simple to you, if I run `rsh localhost ulimit -n`(as in EDIT NO.2), it shows result. But when I run same command with strace utility, `strace rsh localhost ulimit -n`, it does not show any response. This is the problem that I want to ask in this problem, and yes this rsh is standard rsh, no changes in that. I think now you understand what I want to ask from you. – devsda Mar 14 '13 at 04:48
  • Ok, I think I understand what you mean now. The fact that it works without strace and not with strace is something you should have mentioned clearly from the beginning. – Gilles 'SO- stop being evil' Mar 14 '13 at 19:38
  • @Mat Actually, edit no.2 does show that a server is running, since the command `pwd` ran. – Gilles 'SO- stop being evil' Mar 14 '13 at 19:39

1 Answers1

5

The normal port for an rsh server is 514. Your rsh client supports Kerberos, and a Kerberos-enabled rsh server normally listens on port 544. Your rsh client first tries to log in with Kerberos authentication, probably first with Kerberos version 5 then with Kerberos version 4 (“krb4” for short). The error “connection refused” is due to the absence of a Kerberos rsh server (there could be other reasons such as a firewall blocking you, but that's highly unlikely to happen when the server is on localhost). Ignore this error unless you intended to use Kerberos.

Without kerberos, rsh allows two forms of authentication: either the user must type a password, or the user must be whitelisted in /etc/rhosts or ~/.rhosts. Whitelisting means that the file declares that user U on machine M is allowed to log in as user V on the server. The server only allows this if it can trust that the request is indeed coming from user U on machine M. The server trusts that a request comes from machine M if it comes from machine M's IP address (a valid assumption by the standards of the 1980s). It trusts that the request comes from user U because the client says so.

But because the client says so is not a reason to trust the client, not even by the standards of the 1980s. So there is an additional condition: rsh requests must have a source port below 1024. On Unix machines, only root can bind TCP or UDP ports below 1024. Therefore the rsh client runs as root. Since any user must be able to run it, the rsh binary is setuid root: it runs with root permissions no matter what user invoked it.

When you run a program under strace, it does not run with any elevated privilege, just the privileges of the invoking user. This is because the trace could reveal confidential data (and in fact the same mechanism allows you to completely hijack the process). So when you run strace rsh …, at the point where it tries to open a connection with a source port below 1024, it fails: rcmd: socket: Permission denied.

If you want to trace rsh, you'll have to run strace as root. Either let it run rsh as root, or pass the -u option so that the program runs with the privileges it normally has when started from your account:

strace -o rsh.strace -s9999 -u jhamb rsh localhost pwd
Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
  • Excellent explanation. +1 for that. But it shows `permission denied` in root privilage also. – devsda Mar 15 '13 at 05:49
  • The above Edit No. 1 is not expecting for me. Can you please elaborate me the above happening. – devsda Mar 15 '13 at 10:48
  • @jhamb That's a different issue. Ask a new question. And do tell us what operating system you're running, and where you got rsh and rshd from (e.g. “Ubuntu 12.04 with the `rsh-redone-client` and `rsh-server` packages”). – Gilles 'SO- stop being evil' Mar 15 '13 at 17:03
  • I am using CentOS OS. – devsda Mar 16 '13 at 03:58
  • I didn't understand the last paragraph of your solution. How your solution helpful to trace rsh? How to add process Id in strace command, because before starting rsh , ps aux didn't show rsh, `pgrep rsh` didn't show anything. – devsda Mar 17 '13 at 12:22
  • @jhamb You have to start rsh first, then start strace before the intersting stuff happens. Since rsh doesn't pause when it starts up, this isn't convenient, which is why I recommend either running rsh as root (if that doesn't affect what you're investigating) or recompiling rsh to pause when it starts up. – Gilles 'SO- stop being evil' Mar 17 '13 at 20:05
  • Its a humble request to you to please explain the above comment, as I didn't understand what you say in last comment. Please. – devsda Mar 18 '13 at 06:28
  • @jhamb Actually I'd forgotten about the `-u` option to strace, which lets you run the debuggee as another user (and lets setuid take effect). See my updated last paragraph. – Gilles 'SO- stop being evil' Mar 19 '13 at 18:20