If I run rsh, it works, but prints some strange “Connection refused” messages at the beginning:

$ rsh localhost pwd
connect to address port 544: Connection refused
Trying krb4 rsh...
connect to address port 544: Connection refused
trying normal rsh (/usr/bin/rsh)

But if I run rsh under strace, it doesn't connect to the server at all:

$ strace -c rsh localhost ulimit -n
connect to address port 544: Connection refused
Trying krb4 rsh...
connect to address port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
rcmd: socket: Permission denied
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 28.39    0.000113           2        58           read
 27.64    0.000110          16         7           write
 16.83    0.000067           1        47           open
 15.33    0.000061           2        27           munmap
 11.81    0.000047           1        80           mmap
  0.00    0.000000           0        58           close
  0.00    0.000000           0         1           stat
  0.00    0.000000           0        45           fstat

Here is an extract from strace rsh localhost ulimit -n:

connect(3, {sa_family=AF_INET, sin_port=htons(544), sin_addr=inet_addr("")}, 16) = -1 ECONNREFUSED (Connection refused)
write(2, "Connection refused\n", 19)    = 19
connect(3, {sa_family=AF_INET, sin_port=htons(544), sin_addr=inet_addr("")}, 16) = -1 ECONNREFUSED (Connection refused)
write(2, "Connection refused\n", 19)    = 19


  1. What is causing port 544: Connection refused?
  2. Why does it show the error rcmd: socket: Permission denied? It should show some integer value (the output of ulimit -n on the remote machine).
  • I am aware that this won't answer your question, but please refrain from using rsh. It's insecure.
    – schaiba
    Mar 13, 2013 at 10:04
  • You really enjoy posting your profiling data
    – daisy
    Mar 13, 2013 at 10:06
  • @warl0ck Actually I am in problem, now I am tracing how many system calls are called in whole command. This question is also related to the same. From last question that you closed, I learnt a lesson that do any work, but that would be step by step, now I think you will help me, and promote my efforts.
    – devsda
    Mar 13, 2013 at 10:23
  • @schaiba Thanks for your advice. I will follow this. But now my application totally uses rsh, so I have to debug in the same. But yes I will move to ssh very soon. But for current scenario I want to solve rsh problems, and yes, the above one also.
    – devsda
    Mar 13, 2013 at 10:30
  • @warl0ck Help me, I searched a lot , try to free up that port, using command, netstat -a | grep :544. But it didn't show any output. Check EDIT part of question also.
    – devsda
    Mar 13, 2013 at 11:07

1 Answer 1


The normal port for an rsh server is 514. Your rsh client supports Kerberos, and a Kerberos-enabled rsh server normally listens on port 544. Your rsh client first tries to log in with Kerberos authentication, probably first with Kerberos version 5 then with Kerberos version 4 (“krb4” for short). The error “connection refused” is due to the absence of a Kerberos rsh server (there could be other reasons such as a firewall blocking you, but that's highly unlikely to happen when the server is on localhost). Ignore this error unless you intended to use Kerberos.

Without kerberos, rsh allows two forms of authentication: either the user must type a password, or the user must be whitelisted in /etc/rhosts or ~/.rhosts. Whitelisting means that the file declares that user U on machine M is allowed to log in as user V on the server. The server only allows this if it can trust that the request is indeed coming from user U on machine M. The server trusts that a request comes from machine M if it comes from machine M's IP address (a valid assumption by the standards of the 1980s). It trusts that the request comes from user U because the client says so.

But because the client says so is not a reason to trust the client, not even by the standards of the 1980s. So there is an additional condition: rsh requests must have a source port below 1024. On Unix machines, only root can bind TCP or UDP ports below 1024. Therefore the rsh client runs as root. Since any user must be able to run it, the rsh binary is setuid root: it runs with root permissions no matter what user invoked it.

When you run a program under strace, it does not run with any elevated privilege, just the privileges of the invoking user. This is because the trace could reveal confidential data (and in fact the same mechanism allows you to completely hijack the process). So when you run strace rsh …, at the point where it tries to open a connection with a source port below 1024, it fails: rcmd: socket: Permission denied.

If you want to trace rsh, you'll have to run strace as root. Either let it run rsh as root, or pass the -u option so that the program runs with the privileges it normally has when started from your account:

strace -o rsh.strace -s9999 -u jhamb rsh localhost pwd
  • Excellent explanation. +1 for that. But it shows permission denied in root privilage also.
    – devsda
    Mar 15, 2013 at 5:49
  • The above Edit No. 1 is not expecting for me. Can you please elaborate me the above happening.
    – devsda
    Mar 15, 2013 at 10:48
  • @jhamb That's a different issue. Ask a new question. And do tell us what operating system you're running, and where you got rsh and rshd from (e.g. “Ubuntu 12.04 with the rsh-redone-client and rsh-server packages”). Mar 15, 2013 at 17:03
  • I am using CentOS OS.
    – devsda
    Mar 16, 2013 at 3:58
  • I didn't understand the last paragraph of your solution. How your solution helpful to trace rsh? How to add process Id in strace command, because before starting rsh , ps aux didn't show rsh, pgrep rsh didn't show anything.
    – devsda
    Mar 17, 2013 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.