IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.20 Use of the security mechanisms of rlogin, rsh
and rcp
Initiation responsibility: IT Security Management, Administrators
Implementation responsibility: Administrators
With the rlogin program and/or the associated daemon rlogind it is possible to
log in on another computer through a network connection; in that case,
however, only the password will be requested since the user name will be
passed on directly. With the commands rsh or rcp and the rshd daemon, it is
possible to execute a command on another computer. Both commands use
trusted hosts which are defined either user-specifically in the home directory
$HOME/.rhosts file or system-wide in the /etc/hosts.equiv file. Any computer
entered in one of these files will be considered trusted so that neither logging
on (with rlogin) nor command execution (with rsh) require entry of a
password.
Since it is very easy, especially from a PC, to impersonate any computer
name, steps must be taken to ensure that there are no $HOME/.rhosts and
/etc/hosts.equiv files or that if there are, they are empty and cannot be
accessed by ordinary users. To achieve this, users' home directories should be
regularly checked, or it should not be possible to start up the daemons rlogind
and rshd (for further information, see the /etc/inetd.conf file and safeguard S
5.16 Survey of network services). If use of the /etc/hosts.equiv file cannot be
avoided, steps must be taken to ensure that no "+" entry exists as that would
result in every computer becoming a trusted one.
Secure Shell (ssh) can be used as a substitute for the r services. It makes use
of extensive functions designed to ensure secure authentication and to
maintain confidentiality and integrity (see also S 5.64 Use of Secure Shell). If
ssh is used, then if possible the r services should be disabled to ensure that the
security safeguards cannot be circumvented. However, this presupposes that
all communication partners have suitable implementations of ssh.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Do not use .rhost and
hosts.equiv
Use Secure Shell as a
substitute