2KKUU7ita

240
Part IV: Hacking Operating Systems
Figure 12-10:
The rexec
file showing
the disable
option.
Countermeasures against .rhosts
and hosts.equiv file attacks
Use both of the following countermeasures to prevent hacker attacks against
the .rhosts and hosts.equiv files in your Linux system.
Disabling commands
A good way to prevent abuse of these files is to disable the BSD r-commands.
This can be done in two ways:
✓ Comment out the lines starting with shell, login, and exec in inetd.
conf.
✓ Edit the rexec, rlogin, and rsh files located in the /etc/xinetd.d
directory. Open each file in a text editor and change disable=no to
disable=yes, as shown in Figure 12-10.
In Red Hat Enterprise Linux, you can disable the BSD r-commands with the
setup program:
1. Enter setup at a command prompt.
2. Choose System Services from the menu.
3. Remove the asterisks next to each of the r-services.
Blocking access
A couple of countermeasures can block rogue access of the .rhosts and
hosts.equiv files: