Berkeley r-commands#Security

The original Berkeley package that provides {{code|rlogin}} also features {{code|rcp}} (remote-copy, allowing files to be copied over the network) and rsh (remote-shell, allowing commands to be run on a remote machine without the user logging into it).

As an example, the protocol is as follows:{{Cite report |url=https://datatracker.ietf.org/doc/rfc1282/ |title=BSD Rlogin |last=Kantor |first=Brian |date=December 1991 |publisher=Internet Engineering Task Force |issue=RFC 1282}}

Client:

user name on the client

user name on the server

terminal type/terminal baud rate

Server:

The server would check that the user should have access. If so, it returns a message with nothing in it (not even a null character), meaning the connection is established.

For example:

Client:

bostic

kbostic

vt100/9600

Server:

Both {{code|rlogin}} and {{code|rsh}} share the {{code|/etc/hosts.equiv}} (applies to all users on the server) and {{code|$HOME/.rhosts}} (applies to only the user that puts the file in its home folder) access-control scheme, although they connect to different daemons. {{code|rlogin}} connects to {{code|rlogind}}, while {{code|rsh}} connects to {{code|rshd}}.

{{code|hosts.equiv}} and {{code|.rhosts}} uses the same format. The following shows some aspects of the format:{{Cite web |title=.rhosts File Format for TCP/IP |url=https://www.ibm.com/docs/en/aix/7.2?topic=formats-rhosts-file-format-tcpip |access-date=2023-11-29 |website=www.ibm.com |language=en-us}}{{Cite web |title=hosts.equiv File Format for TCP/IP |url=https://www.ibm.com/docs/en/aix/7.2?topic=formats-hostsequiv-file-format-tcpip |access-date=2023-11-29 |website=www.ibm.com |language=en-us}}

host1

host2 user_a

-host3

+@group1 -user_b

-@group2

This allows all users from host1 to login, user_a from host2 to login, no users from host3, all users on group1 except user_b, and no users on group2.

{{See also|Telnet}}

{{code|rlogin}} enables a user to log in on another server via computer network, using TCP network port 513.

{{code|rlogin}} is also the name of the application layer protocol used by the software, part of the TCP/IP protocol suite. Authenticated users can act as if they were physically present at the computer. RFC 1282, in which it was defined, states: "The {{code|rlogin}} facility provides a remote-echoed, locally flow-controlled virtual terminal with proper flushing of output." {{code|rlogin}} communicates with a daemon, {{code|rlogind}}, on the remote host. {{code|rlogin}} is similar to the Telnet command, but is not as customizable and is able to connect only to Unix-like hosts.

{{Further|Remote Shell}}

{{code|rsh}} opens a shell on a remote computer without a login procedure. Once connected, the user can execute commands on the remote computer through the shell's command-line interface. {{code|rsh}} passes input and output through the standard streams, and it sends standard output to the user's console. Over the network, standard input and standard out flow through TCP port 514, while Standard Error flows through a different TCP port, which the {{code|rsh}} daemon ({{code|rshd}}) opens.{{cite book |url=https://books.google.com/books?id=-hF7sqwrcrwC&pg=PA154 |title=CCSP: Secure PIX and Secure VPN Study Guide |last1=Edwards |first1=Wade |last2=Lancaster |first2=Tom |last3=Quinn |first3=Eric |last4=Rohm |first4=Jason |last5=Tow |first5=Bryant|publisher=Sybex |page=154 |isbn=0-7821-4287-7 |year=2004 |via=Google Books |access-date=2018-03-07}}

Like {{code|rsh}}, {{code|rexec}} enables the user to run shell commands on a remote computer. However, unlike the rsh server, the {{code|rexec}} server ({{code|rexecd}}) requires login: it authenticates users by reading the username and password (unencrypted) from the network socket.{{cite web |url=http://www.manpagez.com/man/8/rexecd/ |title=rexecd(8) |website=manpagez.com |access-date=2018-03-03}} {{code|rexec}} uses TCP port 512.

{{code|rcp}} can copy a file or directory from the local system to a remote system, from a remote system to the local system, or from one remote system to another.{{cite web |url=https://earthsci.stanford.edu/computing/unix/netcommands/rcp.php |title=rcp |last=Farrell |first=Phillip |date=3 August 2004 |website=earthsci.stanford.edu |publisher=Stanford University School of Earth, Energy & Environmental Sciences |access-date=2018-03-06 |archive-date=2021-02-07 |archive-url=https://web.archive.org/web/20210207204751/https://earthsci.stanford.edu/computing/unix/netcommands/rcp.php |url-status=dead }} The command line arguments of {{code|cp}} and {{code|rcp}} are similar, but in {{code|rcp}} remote files are prefixed with the name of the remote system:

rcp file.txt subdomain.domain:~/home/foo/file.txt

As with the Unix copy command cp, {{code|rcp}} overwrites an existing file of the same name in the target; unlike {{code|cp}}, it provides no mechanism for warning the user before overwriting the target file. Like {{code|rsh}}, {{code|rcp}} uses TCP port 514.{{cite web |url=http://sourcedaddy.com/networking/rlogin-rsh-and-rcp.html |title=Rlogin, RSH, and RCP |website=SourceDaddy |access-date=2018-02-18}}

Just as the who command lists the users who are logged in to the local Unix system, {{code|rwho}} lists those users who are logged into all multi-user Unix systems on the local network.{{cite web |url=https://www.systutorials.com/docs/linux/man/1-rwho/ |title=rwho (1) - Linux Man Pages |access-date=2018-03-07}} {{code|rwho}}'s daemon, {{code|rwhod}}, maintains a database of the status of Unix systems on the local network. The daemon and its database are also used by the {{code|ruptime}} program.{{cite web |url=https://www.systutorials.com/docs/linux/man/8-rwhod/ |title=rwhod (8) - Linux Man Pages |access-date=2018-03-07}}

{{code|rstat}} returns performance statistics from the kernel.

Just as the {{code|uptime}} command shows how long a Unix system has been running since the last restart, {{code|ruptime}} requests a status report from all computers on the local network. It then returns the uptime report. If a computer did not respond within the time limit, then {{code|ruptime}} reports that the system is down.{{cite web |url=https://www.systutorials.com/docs/linux/man/1-ruptime/ |title=ruptime (1) - Linux Man Pages |website=SysTutorials |access-date=2018-03-07}} This information is tracked and stored by the daemon {{code|rwhod}}, which is also used by the rwho command.

Those r-commands which involve user authentication ({{code|rcp}}, {{code|rexec}}, {{code|rlogin}}, and {{code|rsh}}) share several serious security vulnerabilities:

• All information, including passwords, is transmitted unencrypted (making it vulnerable to interception).
• The {{code|.rlogin}} (or {{code|.rhosts}}) file is easy to misuse. They are designed to allow logins without a password, but their reliance on remote usernames, hostnames, and IP addresses is exploitable. For this reason many corporate system administrators prohibit {{code|.rhosts}} files, and actively scrutinize their networks for offenders.
• The protocol partly relies on the remote party's {{code|rlogin}} client to provide information honestly, including source port and source host name. A malicious client can forge this and gain access, as the {{code|rlogin}} protocol has no means of authenticating the client is running on a trusted machine. It also cannot check if the requesting client on a trusted machine is the real {{code|rlogin}} client, meaning that malicious programs may pretend to be a standard-conforming {{code|rlogin}} client by using the same protocols.
• The common practice of mounting users' home directories via Network File System exposes rlogin to attack by means of fake {{code|.rhosts}} files - this means that any of its security faults automatically plague {{code|rlogin}}.

Due to these problems, the r-commands fell into relative disuse (with many Unix and Linux distributions no longer including them by default). Many networks that formerly relied on {{code|rlogin}} and {{code|telnet}} have replaced them with SSH and its {{code|rlogin}}-equivalent {{code|slogin}}.{{cite book|last=Sobell|first=Mark|title=A Practical Guide to Linux Commands, Editors, and Shell Programming|isbn=978-0-13-136736-4|date=2010|publisher=Pearson Education, Inc}}{{cite web|title=Unix job control command list|publisher=Indiana University|url=https://kb.iu.edu/d/afnw|accessdate=20 December 2014}}

• List of Unix commands

{{Reflist|30em}}

{{refbegin}}

• {{cite book |title=Sams Teach Yourself TCP/IP in 24 Hours |last=Casad |first=Joe |chapter=Berkeley Remote Utilities |year=2008 |publisher=Pearson Education |chapter-url=https://books.google.com/books?id=q81cs5140_YC&pg=PT346 |isbn=978-0-13-271513-3 |via=Google Books}}

{{refend}}

• {{cite book |title=Enterprise Security: Solaris Operating Environment, Security Journal, Solaris OE v2.51, 2.6, 7, and 8 |last=Noordergraaf |first=Alex |year=2003 |orig-year=2002 |publisher=Prentice Hall |isbn=978-0-13-100092-6 |chapter=Remote Access Services (rsh, rlogin, and rcp) |chapter-url=https://www.informit.com/articles/article.aspx?p=30294&seqNum=6}}
• {{cite book |title=UNIX User's Handbook |last=Poniatowski |first=Marty |publisher=Prentice Hall |year=2000 |pages=475–77 |isbn=978-0-13-027019-1 |oclc=43561861 |edition=1st}}
• {{cite web |url=http://www.cert.org/archive/pdf/98tr017.pdf |title=rlogin(1): The Untold Story |last=Rogers |first=Lawrence R. |date=November 1998 |archive-url=https://web.archive.org/web/20011217064050/http://www.cert.org/archive/pdf/98tr017.pdf |archive-date=2001-12-17}}
• {{cite web |url=https://pentestlab.blog/2012/04/10/unix-user-enumeration/ |title=Unix User Enumeration |website=Penetration Testing Lab |date=10 April 2012}}

• {{IETF RFC|1282}}, BSD Rlogin (1991)
• {{man|1|rlogin|die.net}}
• {{man|1|rlogin|Darwin|remote login}}
• {{man|1|rlogin|Solaris|remote login}}

{{Unix commands}}

Category:Internet protocols

Category:Internet Standards

Category:Unix network-related software