1

When I run command, rsh localhost pwd as a root

It shows below output.

connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
rcmd: socket: Permission denied

When I run the same command from normal user named service. Then it shows below output.

connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
/home/service

Why this behavior happening?

devsda
  • 427
  • 3
  • 10
  • 19
  • There seems to be a bit of confusion as to the way RCP reports. On some servers I don't have these error messages, however on another new RH server I noticed that the RCP is doing a "krb4" authentication (whatever that means). When this fails it then makes an attempt to copy the file using normal authentication. I noticed that despite all the messages the file does get copied. (not that I like RCP). – Peter Jan 11 '17 at 15:55

3 Answers3

3

The first example tries to login as root on the system and run pwd while the second example logins via service and runs pwd.

It is likely that your configuration does either not allow logins as root or from root at localhost.

To debug it further you can try to run rsh -l service localhost pwd and see if it works. Please also have a look at Why can't I use strace with rsh? which explains another possible issue.

Community
  • 1
Ulrich Dangel
  • 25,079
  • 3
  • 80
  • 80
  • When I run `rsh -l service localhost pwd` from root, it shows the same error. , .i.e., `Permission Denied` – devsda Mar 17 '13 at 06:04
  • @jhamb then have a look at the `rhosts`/`/etc/hosts.equiv` file of your service user and add an entry for the root user... – Ulrich Dangel Mar 17 '13 at 09:46
  • /etc/hosts.equiv only one line i.e., `+ service`. Now I added one more line `+ root`. Then I reboot, but when I run `rsh localhost pwd` from root , but I shows again `Permission Denied`. What can I do now ? – devsda Mar 17 '13 at 12:39
  • @jhamb use `rsh -l service localhost` and read the documentation of rsh to understand the issues. – Ulrich Dangel Mar 17 '13 at 13:51
  • In root, `rsh -l service localhost pwd` works, but `rsh localhost pwd` not works. – devsda Mar 17 '13 at 17:16
  • Can you give answer of above comment? – devsda Mar 20 '13 at 05:02
1

Erradicate rsh immediately. It is a huge security risk. No, "this is just an internal network, there won't be any evil chinese hackers" is totally irrelevant, attacks are either automated (to recruit for botnets) or targeted, and the second ones are (depending on the statistics you want to believe) initiated by internal users in 80 to 95% of the cases.

Use ssh, it gives almost the same benefits but is much more secure. Yes, it is a bit harder to set up, but not that much.

vonbrand
  • 18,156
  • 2
  • 37
  • 59
0

RSH is very insecure - Do you really want anyone with a packet sniffer to see any passwords go over with wire, with the user id, in PLAIN TEXT?

It should have been dropped from the distros as soon as SSH was made readily available, but someone still worried that it might break someone's ancient, highly insecure, script from 1986.

RSH is bad juju!

However, I'll let you shoot yourself in the foot - because it's UNIX, and you might really want an excuse when your boss fires you for allowing your servers to be hacked because you don't want to figure out SSH.

One possible reason is that your root account is denied direct login access to the server itself via rsh. Below is a link on how to disable remote shell for root, by only allowing root on /dev/console. You are doing the opposite.

http://home.shafe.com/docs/remoteroot.html

There's a similar setting for root with SSH. It's a simple flag in the sshd_config.

http://www.mydigitallife.info/disable-direct-root-login-and-user-access-via-ssh-to-server/

Please use SSH instead.

slm
  • 363,520
  • 117
  • 767
  • 871
StackXCHGR
  • 1