| blob | d1bd3d70cf24ec882be23539e6c8815fdbbb3f5d |
1 '\" te
2 .\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
3 .\" Copyright 1989 AT&T
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH IN.RSHD 1M "Oct 29, 2015"
8 .SH NAME
9 in.rshd, rshd \- remote shell server
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fBin.rshd\fR [\fB-k5eciU\fR] [\fB-s\fR \fItos\fR] [\fB-S\fR \fIkeytab\fR] [\fB-M\fR \fIrealm\fR]
14 [\fB-L\fR \fIenv_var\fR] \fIhost.port\fR
15 .fi
17 .SH DESCRIPTION
18 .sp
19 .LP
20 \fBin.rshd\fR is the server for the \fBrsh\fR(1) program. The server provides
21 remote execution facilities with authentication based on Kerberos V5 or
22 privileged port numbers.
23 .sp
24 .LP
25 \fBin.rshd\fR is invoked by \fBinetd\fR(1M) each time a shell service is
26 requested.
27 .sp
28 .LP
29 When Kerberos V5 authentication is required (this can be set with
30 Kerberos-specific options listed below), the following protocol is initiated:
31 .RS +4
32 .TP
33 1.
34 Check Kerberos V5 authentication.
35 .RE
36 .RS +4
37 .TP
38 2.
39 Check authorization according to rules in \fBkrb5_auth_rules\fR(5).
40 .RE
41 .RS +4
42 .TP
43 3.
44 A null byte is returned on the initial socket and the command line is passed
45 to the normal login shell of the user. (The \fBPATH\fR variable is set to
46 \fB/usr/bin\fR.) The shell inherits the network connections established by
47 \fBin.rshd\fR.
48 .RE
49 .sp
50 .LP
51 In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
52 Kerberos principal must exist for each Fully Qualified Domain Name associated
53 with the \fBin.rshd\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR principals
54 must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR file on the
55 \fBin.rshd\fR server. An example principal might be:
56 .sp
57 .LP
58 \fBhost/bigmachine.eng.example.com\fR
59 .sp
60 .LP
61 See \fBkadmin\fR(1M) for instructions on adding a principal to a
62 \fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
63 authentication.
64 .sp
65 .LP
66 If Kerberos V5 authentication is not enabled, then \fBin.rshd\fR executes the
67 following protocol:
68 .RS +4
69 .TP
70 1.
71 The server checks the client's source port. If the port is not in the range
72 512-1023, the server aborts the connection. The client's host address (in hex)
73 and port number (in decimal) are the arguments passed to \fBin.rshd\fR.
74 .RE
75 .RS +4
76 .TP
77 2.
78 The server reads characters from the socket up to a null (\fB\e0\fR) byte.
79 The resultant string is interpreted as an \fBASCII\fR number, base 10.
80 .RE
81 .RS +4
82 .TP
83 3.
84 If the number received in step 2 is non-zero, it is interpreted as the port
85 number of a secondary stream to be used for the \fBstderr\fR. A second
86 connection is then created to the specified port on the client's machine. The
87 source port of this second connection is also in the range 512-1023.
88 .RE
89 .RS +4
90 .TP
91 4.
92 A null-terminated user name of at most 16 characters is retrieved on the
93 initial socket. This user name is interpreted as the user identity on the
94 \fIclient\fR's machine.
95 .RE
96 .RS +4
97 .TP
98 5.
99 A null terminated user name of at most 16 characters is retrieved on the
100 initial socket. This user name is interpreted as a user identity to use on the
101 \fIserver\fR's machine.
102 .RE
103 .RS +4
104 .TP
105 6.
106 A null terminated command to be passed to a shell is retrieved on the
107 initial socket. The length of the command is limited by the upper bound on the
108 size of the system's argument list.
109 .RE
110 .RS +4
111 .TP
112 7.
113 \fBin.rshd\fR then validates the user according to the following steps. The
114 remote user name is looked up in the password file and a \fBchdir\fR is
115 performed to the user's home directory. If the lookup fails, the connection is
116 terminated. If the \fBchdir\fR fails, it does a \fBchdir\fR to \fB/\fR (root).
117 If the user is not the superuser, (user \fBID\fR 0), and if the pam_rhosts_auth
118 \fBPAM\fR module is configured for authentication, the file
119 \fB/etc/hosts.equiv\fR is consulted for a list of hosts considered
120 "equivalent". If the client's host name is present in this file, the
121 authentication is considered successful. See the SECURITY section below for a
122 discussion of \fBPAM\fR authentication.
123 .sp
124 If the lookup fails, or the user is the superuser, then the file
125 \fB\&.rhosts\fR in the home directory of the remote user is checked for the
126 machine name and identity of the user on the client's machine. If this lookup
127 fails, the connection is terminated
128 .RE
129 .RS +4
130 .TP
131 8.
132 A null byte is returned on the initial connection and the command line is
133 passed to the normal login shell of the user. The \fBPATH\fR variable is set to
134 \fB/usr/bin\fR. The shell inherits the network connections established by
135 \fBin.rshd\fR.
136 .RE
137 .SH OPTIONS
138 .sp
139 .LP
140 The following options are supported:
141 .sp
142 .ne 2
143 .na
144 \fB\fB-5\fR\fR
145 .ad
146 .RS 14n
147 Same as \fB-k\fR, for backwards compatibility
148 .RE
150 .sp
151 .ne 2
152 .na
153 \fB\fB-c\fR\fR
154 .ad
155 .RS 14n
156 Requires Kerberos V5 clients to present a cryptographic checksum of initial
157 connection information like the name of the user that the client is trying to
158 access in the initial authenticator. This checksum provides additionl security
159 by preventing an attacker from changing the initial connection information.
160 This option is mutually exclusive with the \fB-i\fR option.
161 .RE
163 .sp
164 .ne 2
165 .na
166 \fB\fB-e\fR\fR
167 .ad
168 .RS 14n
169 Requires the client to encrypt the connection.
170 .RE
172 .sp
173 .ne 2
174 .na
175 \fB\fB-i\fR\fR
176 .ad
177 .RS 14n
178 Ignores authenticator checksums if provided. This option ignores authenticator
179 checksums presented by current Kerberos clients to protect initial connection
180 information. Option \fB-i\fR is the opposite of option \fB-c\fR.
181 .RE
183 .sp
184 .ne 2
185 .na
186 \fB\fB-k\fR\fR
187 .ad
188 .RS 14n
189 Allows Kerberos V5 authentication with the \fB\&.k5login\fR access control file
190 to be trusted. If this authentication system is used by the client and the
191 authorization check is passed, then the user is allowed to log in.
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fB-L\fR \fIenv_var\fR\fR
198 .ad
199 .RS 14n
200 List of environment variables that need to be saved and passed along.
201 .RE
203 .sp
204 .ne 2
205 .na
206 \fB\fB-M\fR \fIrealm\fR\fR
207 .ad
208 .RS 14n
209 Uses the indicated Kerberos V5 realm. By default, the daemon will determine its
210 realm from the settings in the \fBkrb5.conf\fR(4) file.
211 .RE
213 .sp
214 .ne 2
215 .na
216 \fB\fB-s\fR \fItos\fR\fR
217 .ad
218 .RS 14n
219 Sets the \fBIP\fR \fBTOS\fR option.
220 .RE
222 .sp
223 .ne 2
224 .na
225 \fB\fB-S\fR \fIkeytab\fR\fR
226 .ad
227 .RS 14n
228 Sets the \fBKRB5\fR keytab file to use. The\fB/etc/krb5/krb5.keytab\fR file is
229 used by default.
230 .RE
232 .sp
233 .ne 2
234 .na
235 \fB\fB-U\fR\fR
236 .ad
237 .RS 14n
238 Refuses connections that cannot be mapped to a name through the
239 \fBgetnameinfo\fR(3SOCKET) function.
240 .RE
242 .SH USAGE
243 .sp
244 .LP
245 \fBrshd\fR and \fBin.rshd\fR are IPv6-enabled. See \fBip6\fR(7P). \fBIPv6\fR is
246 not currently supported with Kerberos V5 authentication.
247 .sp
248 .LP
249 The Kerberized \fBrshd\fR service runs on port 544 (kshell). The corresponding
250 FMRI entry is: :
251 .sp
252 .in +2
253 .nf
254 svc:/network/shell:kshell (rshd with kerberos (ipv4 only))
255 .fi
256 .in -2
257 .sp
259 .SH SECURITY
260 .sp
261 .LP
262 \fBin.rshd\fR uses \fBpam\fR(3PAM) for authentication, account management, and
263 session management. The \fBPAM\fR configuration policy, listed through
264 \fB/etc/pam.conf\fR, specifies the modules to be used for \fBin.rshd\fR. Here
265 is a partial \fBpam.conf\fR file with entries for the \fBrsh\fR command using
266 rhosts authentication, \fBUNIX\fR account management, and session management
267 module.
268 .sp
270 .sp
271 .TS
272 l l l l
273 l l l l .
274 rsh auth required pam_rhosts_auth.so.1
276 rsh account required pam_unix_roles.so.1
277 rsh session required pam_unix_projects.so.1
278 rsh session required pam_unix_account.so.1
280 rsh session required pam_unix_session.so.1
281 .TE
283 .sp
284 .LP
285 If there are no entries for the \fBrsh\fR service, then the entries for the
286 "other" service are used. To maintain the authentication requirement for
287 \fBin.rshd\fR, the rsh entry must always be configured with the
288 \fBpam_rhosts_auth.so.1\fR module.
289 .sp
290 .LP
291 \fBin.rshd\fR can authenticate using Kerberos V5 authentication or
292 \fBpam\fR(3PAM). For Kerberized \fBrsh\fR service, the appropriate \fBPAM\fR
293 service name is \fBkrsh\fR.
294 .SH FILES
295 .sp
296 .LP
297 \fB/etc/hosts.equiv\fR
298 .sp
299 .ne 2
300 .na
301 \fB\fB$HOME/.k5login\fR\fR
302 .ad
303 .RS 23n
304 File containing Kerberos principals that are allowed access.
305 .RE
307 .sp
308 .ne 2
309 .na
310 \fB\fB/etc/krb5/krb5.conf\fR\fR
311 .ad
312 .RS 23n
313 Kerberos configuration file.
314 .RE
316 .SH SEE ALSO
317 .sp
318 .LP
319 \fBrsh\fR(1), \fBsvcs\fR(1), \fBinetadm\fR(1M),
320 \fBinetd\fR(1M), \fBkadmin\fR(1M), \fBsvcadm\fR(1M), \fBpam\fR(3PAM),
321 \fBgetnameinfo\fR(3SOCKET), \fBhosts\fR(4), \fBkrb5.conf\fR(4),
322 \fBpam.conf\fR(4), \fBattributes\fR(5), \fBenviron\fR(5),
323 \fBkrb5_auth_rules\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
324 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
325 \fBpam_rhosts_auth\fR(5), \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5),
326 \fBpam_unix_session\fR(5), \fBsmf\fR(5), \fBip6\fR(7P)
327 .sp
328 .LP
329 \fI\fR
330 .SH DIAGNOSTICS
331 .sp
332 .LP
333 The following diagnostic messages are returned on the connection associated
334 with \fBstderr\fR, after which any network connections are closed. An error is
335 indicated by a leading byte with a value of 1 in step 8 above (\fB0\fR is
336 returned above upon successful completion of all the steps prior to the command
337 execution).
338 .sp
339 .ne 2
340 .na
341 \fB\fBlocuser too long\fR\fR
342 .ad
343 .sp .6
344 .RS 4n
345 The name of the user on the client's machine is longer than 16 characters.
346 .RE
348 .sp
349 .ne 2
350 .na
351 \fB\fBremuser too long\fR\fR
352 .ad
353 .sp .6
354 .RS 4n
355 The name of the user on the remote machine is longer than 16 characters.
356 .RE
358 .sp
359 .ne 2
360 .na
361 \fB\fBcommand too long\fR\fR
362 .ad
363 .sp .6
364 .RS 4n
365 The command line passed exceeds the size of the argument list (as configured
366 into the system).
367 .RE
369 .sp
370 .ne 2
371 .na
372 \fB\fBHostname for your address unknown.\fR\fR
373 .ad
374 .sp .6
375 .RS 4n
376 No entry in the host name database existed for the client's machine.
377 .RE
379 .sp
380 .ne 2
381 .na
382 \fB\fBLogin incorrect.\fR\fR
383 .ad
384 .sp .6
385 .RS 4n
386 No password file entry for the user name existed.
387 .RE
389 .sp
390 .ne 2
391 .na
392 \fB\fBPermission denied.\fR\fR
393 .ad
394 .sp .6
395 .RS 4n
396 The authentication procedure described above failed.
397 .RE
399 .sp
400 .ne 2
401 .na
402 \fB\fBCan't make pipe.\fR\fR
403 .ad
404 .sp .6
405 .RS 4n
406 The pipe needed for the \fBstderr\fR was not created.
407 .RE
409 .sp
410 .ne 2
411 .na
412 \fB\fBTry again.\fR\fR
413 .ad
414 .sp .6
415 .RS 4n
416 A \fIfork\fR by the server failed.
417 .RE
419 .SH NOTES
420 .sp
421 .LP
422 The authentication procedure used here assumes the integrity of each client
423 machine and the connecting medium. This is insecure, but it is useful in an
424 "open" environment.
425 .sp
426 .LP
427 A facility to allow all data exchanges to be encrypted should be present.
428 .sp
429 .LP
430 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
431 provided by \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
432 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
433 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), and
434 \fBpam_unix_session\fR(5).
435 .sp
436 .LP
437 The \fBin.rshd\fR service is managed by the service management facility,
438 \fBsmf\fR(5), under the service identifier:
439 .sp
440 .in +2
441 .nf
442 svc:/network/shell:default
443 .fi
444 .in -2
445 .sp
447 .sp
448 .LP
449 Administrative actions on this service, such as enabling, disabling, or
450 requesting restart, can be performed using \fBsvcadm\fR(1M). Responsibility for
451 initiating and restarting this service is delegated to \fBinetd\fR(1M). Use
452 \fBinetadm\fR(1M) to make configuration changes and to view configuration
453 information for this service. The service's status can be queried using the
454 \fBsvcs\fR(1) command.