1 .\" Copyright (c) 2002 - 2003 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
54 and then executes the specified
58 copies its standard input to the remote command, and the standard
59 output and error of the remote command to its own.
69 option requests Kerberos 4 authentication. Normally all supported
70 authentication mechanisms will be tried, but in some cases more
71 explicit control is desired.
78 option requests Kerberos 5 authentication. This is analogous to the
87 option turns off all Kerberos authentication. The security in this
88 mode relies on reserved ports. The long name is an indication of how
96 option directs the input from the
100 section of this manual page).
109 Don't use a separate socket for the stderr stream. This can be
110 necessary if rsh-ing through a NAT bridge.
117 option enables encryption for all data exchange. This is only valid
118 for Kerberos authenticated connections (see the
120 section for limitations).
126 This is the default, and is mainly useful if encryption has been
127 enabled by default, for instance in the
131 when using Kerberos 5.
136 Forward Kerberos 5 credentials to the remote host.
145 Make the forwarded credentials re-forwardable.
152 .Fl Fl user= Ns Ar string
154 By default the remote username is the same as the local. The
158 format allow the remote name to be specified.
169 .Fl p Ar number-or-service ,
170 .Fl Fl port= Ns Ar number-or-service
172 Connect to this port instead of the default (which is 514 when using
173 old port based authentication, 544 for Kerberos 5 and non-encrypted
174 Kerberos 4, and 545 for encrytpted Kerberos 4; subject of course to
176 .Pa /etc/services ) .
179 .Fl Fl protocol= Ns Ar N|O|1|2
181 Specifies the protocol version to use with Kerberos 5.
185 select protocol version 2, while
189 select version 1. Version 2 is believed to be more secure, and is the
190 default. Unless asked for a specific version,
192 will try both. This behaviour may change in the future.
197 Make sure the remote credentials cache is unique, that is, don't reuse
198 any existing cache. Mutually exclusive to
202 .Fl Fl tkfile= Ns Pa string
204 Name of the remote credentials cache. Mutually exclusive to
212 option enables encryption for all data exchange. This is only valid
213 for Kerberos authenticated connections (see the
215 section for limitations).
219 This is the default, but encryption can be enabled when using
220 Kerberos 5, by setting the
221 .Li libdefaults/encrypt
231 .\"with the same arguments.
233 Care should be taken when issuing commands containing shell meta
234 characters. Without quoting, these will be expanded on the local
237 The following command:
239 .Dl rsh otherhost cat remotefile \*[Gt] localfile
241 will write the contents of the remote
247 .Dl rsh otherhost 'cat remotefile \*[Gt] remotefile2'
249 will write it to the remote
253 .Bl -tag -width /etc/hosts -compact
259 .Xr krb_realmofhost 3 ,
273 This implementation of
275 was written as part of the Heimdal Kerberos 5 implementation.
281 to block if run in the background, unless the standard input is directed away from the terminal. This is what the
287 options enables encryption for the session, but for both Kerberos 4
288 and 5 the actual command is sent unencrypted, so you should not send
289 any secret information in the command line (which is probably a bad
290 idea anyway, since the command line can usually be read with tools
293 Forthermore in Kerberos 4 the command is not even integrity
294 protected, so anyone with the right tools can modify the command.