Please don't even think of suggesting to use ssh. I use ssh and I know how to use it. But sometimes I just want to use rsh! There are good reasons to do so, if you know what you are doing!
actually I never really understood pam but I assume that pam is my problem on this amazon linux system I try to configure.
In our days password driven logins to machines is nothing you really want, and communicating with remote machines in plain-text is not usefull either. So anytime when I talk to a AWS Instance my communication flows through a VPN Tunnel and is encrypted by that tunnel.
So I'm trying to use rsh / rlogin for my AWS machines. I did that before in some gentoo linux distributions and it was easy enough to setup rsh to communicate through openvpn tunneled private IP addresses.
The whole r* stuff works fine and the .rhosts mechanism lets my user through and starts the login process to continue with the session.
The next thing I see then is just EXIT (in my remote console and in the syslog).
In the strace it looks as if login immediately hangs up.
I assume that is a PAM feature, but I cannot debug pam, nor can I read these interleaved pam configuration files. Using /etc/pam_debug does not work. I never got a pam_echo, I can't see any debug output from pam, though the syslogger has debug messages enabled and I can see these debug messages from other services. But not from pam.
I used the strace method, so I can see that the r* realm has already been left and the rlogind already started login for my user, to be logged in, so you don't need to answer what I might need to configure to get rsh / rlogin running. They just do.
If I could get a session for that rlogin from the login process, I think I would be ready to use rsh / rlogin.
Here is the login configuration file from /etc/pam.d:
#%PAM-1.0 auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth substack system-auth auth include postlogin account required pam_nologin.so account include system-auth password include system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open session required pam_namespace.so session optional pam_keyinit.so force revoke session include system-auth session include postlogin -session optional pam_ck_connector.so
The working gentoo login configuration mainly comes from "system-login":
auth required pam_tally2.so onerr=succeed auth required pam_shells.so auth required pam_nologin.so auth include system-auth account required pam_access.so account required pam_nologin.so account include system-auth account required pam_tally2.so onerr=succeed password include system-auth session optional pam_loginuid.so session required pam_env.so session optional pam_lastlog.so silent session include system-auth session optional pam_motd.so motd=/etc/motd session optional pam_mail.so
Thanks for any hints!