1

Please don't even think of suggesting to use ssh. I use ssh and I know how to use it. But sometimes I just want to use rsh! There are good reasons to do so, if you know what you are doing!

actually I never really understood pam but I assume that pam is my problem on this amazon linux system I try to configure.

In our days password driven logins to machines is nothing you really want, and communicating with remote machines in plain-text is not usefull either. So anytime when I talk to a AWS Instance my communication flows through a VPN Tunnel and is encrypted by that tunnel.

So I'm trying to use rsh / rlogin for my AWS machines. I did that before in some gentoo linux distributions and it was easy enough to setup rsh to communicate through openvpn tunneled private IP addresses.

The whole r* stuff works fine and the .rhosts mechanism lets my user through and starts the login process to continue with the session.

The next thing I see then is just EXIT (in my remote console and in the syslog).

In the strace it looks as if login immediately hangs up.

I assume that is a PAM feature, but I cannot debug pam, nor can I read these interleaved pam configuration files. Using /etc/pam_debug does not work. I never got a pam_echo, I can't see any debug output from pam, though the syslogger has debug messages enabled and I can see these debug messages from other services. But not from pam.

I used the strace method, so I can see that the r* realm has already been left and the rlogind already started login for my user, to be logged in, so you don't need to answer what I might need to configure to get rsh / rlogin running. They just do.

If I could get a session for that rlogin from the login process, I think I would be ready to use rsh / rlogin.

Here is the login configuration file from /etc/pam.d:

#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       substack     system-auth
auth       include      postlogin
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    include      postlogin
-session   optional     pam_ck_connector.so

The working gentoo login configuration mainly comes from "system-login":

auth            required        pam_tally2.so onerr=succeed
auth            required        pam_shells.so
auth            required        pam_nologin.so
auth            include         system-auth
account         required        pam_access.so
account         required        pam_nologin.so
account         include         system-auth
account         required        pam_tally2.so onerr=succeed
password        include         system-auth
session         optional        pam_loginuid.so
session         required        pam_env.so
session         optional        pam_lastlog.so silent
session         include         system-auth
session         optional        pam_motd.so motd=/etc/motd
session         optional        pam_mail.so

Thanks for any hints!

  • 2
    Is there a reason not to just use SSH? – Daniel H Jan 25 '17 at 18:43
  • One reason is described in the text. There are some other reasons that are of no broader interest, such as better integration of plan9. A more theoretical reason is that the rsh design aligns to POSIX much better. But in the end there are several reasons. – ikrabbe Jan 26 '17 at 9:46
  • 1
    All I saw in the text is that you’re using rsh over an encrypted tunnel so it’s still secure, not why you prefer that to SSH, unless it was the host-based authentication (which SSH also has). Your comment gives some reasons that I’ll look into because they sound interesting. I don’t suppose you’d be willing to expand on the POSIX alignment issue? Unfortunately, I can’t help answer if SSH isn’t acceptable, but good luck. (From what I’ve found this still isn’t as secure, but I could be wrong there and you know more about your security requirements than I do) – Daniel H Jan 26 '17 at 16:13
  • You can shoot yourself heavily into the foot if you get things wrong. But its easy enough to control rsh. Basically its an infrastructure design topic: Security should be part of the infrastructure, not part of the software or systems you use. From this point of view using rsh wins over ssh. See harmful.cat-v.org/software/ssh if you want to read about more arguments from very solid spirits in the wild. Actually the more severe problem is PAM here, ah and RedHats meaning about what security might be. – ikrabbe Jan 26 '17 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.