rsh configuration problem, permission denied

[migurus]

The goal is to remotely execute a command on the Windows system. I have hard time configuring my box to accept rsh/rcmd remote commands. The commands should be accepted from srv1 (192.168.1.2)

[migurus]

A bit more info about the system:

I have found a log where I see rshd error messages:

/var/adm/log$ tail logger
...
<38>Oct 7 18:31:03 rshd[2053]: auser@srv1 as auser: unknown login. cmd='w'
This is in response to command sent from srv1 (192.168.1.2)
~$ rcmd mybox -l auser "w"

[rodney]

> Added regular windows user auser and removed password, so rcmd would not be troubled by the password.

I would not recommend this.
There are several utilities coded to not allow a login with an account that has an empty password.
The error message will be the same as if the account does not exist or the password was wrong.
Removing the password doesn't make it easier.

So, go assign a password for the account.
Then login on this account, on the target machine, and run the "regpwd" command.
regpwd will allow for passwordless use of the account with certain utilities/daemons.

You should also assign the account a home directory.
When the home directory is assigned correctly you will see it in the output from "finger -l " (that's an 'ell').
Now in that home directory create the ".rhosts" file (mode 600, do "man rhosts" for more info).
The home directory should be mode 755 at it's most permissive (no write by group or other).

You have inetd going already.
So it should go now.

[migurus]

Thank you.
I don't have access to my systems now to try yor advise, but there are couple of points I am confused about.

1 - If I have a password on the user account, can I still rsh using that account?

2 - how to assign a home directory to the account? do I go through unix useradd? or windows side?

Your help is greatly appreciated!

[rodney]

> 1 - If I have a password on the user account, can I still rsh using that account?

Yes.
That was the original design of rsh and rlogin by BSD.
By placing the ".rhosts" file in the account's home directory a method of control could be used
to allow (or disallow) connections to the machine using this same account.
The security weakness of the protocol was known from the start, but given the machines were secure
and there were few of them in each network the environment of trust was very high.
The '.rhosts' file specifies which remote machine and remote user are allowed to this account without a password.

By registering the password for the account using regpwd on each target machine, then
the daemon (for rsh or rlogin) will know in conjunction with the '.rhosts' file that
these type of connections are being allowed.

The usual way to diagnose if rsh will work is to use rlogin and establish that rlogin
can work without providing a password. It's easier to see everything this way.

> 2 - how to assign a home directory to the account? do I go through unix useradd? or windows side?

There are a few ways to do this.
1) Through the Win32 User Account GUI. There's some variation between versions of Windows. But if
the user account is in the domain then you'll use AD and if it's a machine local account then the
(control Panel->Admin Tools->Computer Management). Look for Profile tab and something like "Home
Folder" path. If the account is in AD then specify the home directory as a network path because this
will make it uniform for all machines in the domain (this will be set in Win32-speak).

2) You can use the command line tools as well: the "NET.EXE" command. From an Interix shell there is
a script named "net" that connects to "NET.EXE".

3) If you have the "admin scripts" package installed from here you can use one of these scripts (which
in turn uses NET.EXE) named "usermod". Sorry, no manual page for it. Just run usermod and the
usage will be printed to get you going with it.

Note: for all of these you should be the administrator account for permission reasons.

There are other benefits to setting a home directory.
A chief benefit is that ssh can run correctly and securely.
You can set-up a passwordless rsh-like connection using ssh that does not have the
security pitfalls rsh and rlogin have. There's a white paper on this in the "SUA Articles"
section; see the menu choices at the top of web page.

[migurus]

Thank you very much, the regpwd and proper home directory worked, issue resolved.
Just for the record to establish a home directory I used:
net use auser /HOMEDIR:my-home-dir