Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I run rsh, it works, but prints some strange “Connection refused” messages at the beginning:

$ rsh localhost pwd
connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
/home/service

But if I run rsh under strace, it doesn't connect to the server at all:

$ strace -c rsh localhost ulimit -n
connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
rcmd: socket: Permission denied
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 28.39    0.000113           2        58           read
 27.64    0.000110          16         7           write
 16.83    0.000067           1        47           open
 15.33    0.000061           2        27           munmap
 11.81    0.000047           1        80           mmap
  0.00    0.000000           0        58           close
  0.00    0.000000           0         1           stat
  0.00    0.000000           0        45           fstat
   ..........................................
   ..........................................
   ..........................................

Here is an extract from strace rsh localhost ulimit -n:

connect(3, {sa_family=AF_INET, sin_port=htons(544), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ECONNREFUSED (Connection refused)
write(2, "Connection refused\n", 19)    = 19
connect(3, {sa_family=AF_INET, sin_port=htons(544), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ECONNREFUSED (Connection refused)
write(2, "Connection refused\n", 19)    = 19

Questions

  1. What is causing port 544: Connection refused?
  2. Why does it show the error rcmd: socket: Permission denied? It should show some integer value (the output of ulimit -n on the remote machine).
share|improve this question
    
I am aware that this won't answer your question, but please refrain from using rsh. It's insecure. –  schaiba Mar 13 '13 at 10:04
    
You really enjoy posting your profiling data –  warl0ck Mar 13 '13 at 10:06
    
@warl0ck Actually I am in problem, now I am tracing how many system calls are called in whole command. This question is also related to the same. From last question that you closed, I learnt a lesson that do any work, but that would be step by step, now I think you will help me, and promote my efforts. –  devnull Mar 13 '13 at 10:23
    
@schaiba Thanks for your advice. I will follow this. But now my application totally uses rsh, so I have to debug in the same. But yes I will move to ssh very soon. But for current scenario I want to solve rsh problems, and yes, the above one also. –  devnull Mar 13 '13 at 10:30
    
@warl0ck Help me, I searched a lot , try to free up that port, using command, netstat -a | grep :544. But it didn't show any output. Check EDIT part of question also. –  devnull Mar 13 '13 at 11:07

1 Answer 1

The normal port for an rsh server is 514. Your rsh client supports Kerberos, and a Kerberos-enabled rsh server normally listens on port 544. Your rsh client first tries to log in with Kerberos authentication, probably first with Kerberos version 5 then with Kerberos version 4 (“krb4” for short). The error “connection refused” is due to the absence of a Kerberos rsh server (there could be other reasons such as a firewall blocking you, but that's highly unlikely to happen when the server is on localhost). Ignore this error unless you intended to use Kerberos.

Without kerberos, rsh allows two forms of authentication: either the user must type a password, or the user must be whitelisted in /etc/rhosts or ~/.rhosts. Whitelisting means that the file declares that user U on machine M is allowed to log in as user V on the server. The server only allows this if it can trust that the request is indeed coming from user U on machine M. The server trusts that a request comes from machine M if it comes from machine M's IP address (a valid assumption by the standards of the 1980s). It trusts that the request comes from user U because the client says so.

But because the client says so is not a reason to trust the client, not even by the standards of the 1980s. So there is an additional condition: rsh requests must have a source port below 1024. On Unix machines, only root can bind TCP or UDP ports below 1024. Therefore the rsh client runs as root. Since any user must be able to run it, the rsh binary is setuid root: it runs with root permissions no matter what user invoked it.

When you run a program under strace, it does not run with any elevated privilege, just the privileges of the invoking user. This is because the trace could reveal confidential data (and in fact the same mechanism allows you to completely hijack the process). So when you run strace rsh …, at the point where it tries to open a connection with a source port below 1024, it fails: rcmd: socket: Permission denied.

If you want to trace rsh, you'll have to run strace as root. Either let it run rsh as root, or pass the -u option so that the program runs with the privileges it normally has when started from your account:

strace -o rsh.strace -s9999 -u jhamb rsh localhost pwd
share|improve this answer
    
Excellent explanation. +1 for that. But it shows permission denied in root privilage also. –  devnull Mar 15 '13 at 5:49
    
The above Edit No. 1 is not expecting for me. Can you please elaborate me the above happening. –  devnull Mar 15 '13 at 10:48
    
@jhamb That's a different issue. Ask a new question. And do tell us what operating system you're running, and where you got rsh and rshd from (e.g. “Ubuntu 12.04 with the rsh-redone-client and rsh-server packages”). –  Gilles Mar 15 '13 at 17:03
    
I am using CentOS OS. –  devnull Mar 16 '13 at 3:58
    
I didn't understand the last paragraph of your solution. How your solution helpful to trace rsh? How to add process Id in strace command, because before starting rsh , ps aux didn't show rsh, pgrep rsh didn't show anything. –  devnull Mar 17 '13 at 12:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.