z/OS V1R9.0 UNIX System Services Command ... - Christian Grothoff

logind
Options
Note
rlogind should always be invoked from inetd through the /etc/inetd.conf file.
It should not be invoked from the shell. inetd sets up certain files and sockets
needed by rlogind. Invoking rlogind directly gives unpredictable results.
–a Specifies that the requester’s Internet address be checked against the local
gethostbyname() file. This option has no effect because the rlogin program
never uses the .rhosts file for authentication.
–d Specifies that the debugging option be enabled. Informational messages on
the rlogin process is written to the system log.
–l Specifies that the .rhosts file for authentication not be used. This option
has no effect because the rlogin program never uses the .rhosts file for
authentication.
–L Allows the calling of an ruserok exit that lives in /usr/sbin. A return code
zero will allow bypassing of password checking. The installation is
responsible for providing the ruserok exit.
Note: IBM does not recommend using this capability. Using this capability
may open security holes, allowing unauthorized users to access and
modify files and MVS data sets. Even with the most rigorous
checking in the ruserok exit, it is important to keep in mind the
well-known IP spoofing attacks that make it impossible to accurately
idenfity the remote user’s identity.
IBM recommends that the -L flag not be specified. IBM will not
accept APARS for security problems resulting from the use of this
facility.
When the -L flag is specified, /usr/sbin/ruserok is called, passing:
v the name of the progrem, /usr/sbin/ruserok
v ″hostname″ or ″hostname.domainname″ of the client
v a superuser flag, an integer set to 1 if the user wants to be superuser
v client user name, the username on the client system
v server user name, the username on this (server’s) system
If the ruserok program exits with a zero return value, the user is allowed to
login. Otherwise, normal password checking will be done.
Note: If the facility class is active, and the bpx.daemon is defined, then
both inetd’s and rlogind’s usernames must be permitted to
bpx.daemon and the ruserok program (as well as inetd and rlogind)
must be marked program controlled.
–m Specifies that multiprocessing support in the user’s address space be
enabled. Using the –m option uses fewer system resources and provides
faster performance for the end user.
530 z/OS V1R9.0 UNIX System Services Command Reference
If you do not specify –m, each rlogin request causes two MVS address
spaces to be consumed. The first address space is the rlogind code, which