rsh runs perfectly in normal user but not in root, very strange, why?

Question

When I run command, rsh localhost pwd as a root

It shows below output.

connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
rcmd: socket: Permission denied

When I run the same command from normal user named service. Then it shows below output.

connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection refused
trying normal rsh (/usr/bin/rsh)
/home/service

Why this behavior happening?

Solution 1

The first example tries to login as root on the system and run pwd while the second example logins via service and runs pwd.

It is likely that your configuration does either not allow logins as root or from root at localhost.

To debug it further you can try to run rsh -l service localhost pwd and see if it works. Please also have a look at Why can't I use strace with rsh? which explains another possible issue.

Solution 2

Erradicate rsh immediately. It is a huge security risk. No, "this is just an internal network, there won't be any evil chinese hackers" is totally irrelevant, attacks are either automated (to recruit for botnets) or targeted, and the second ones are (depending on the statistics you want to believe) initiated by internal users in 80 to 95% of the cases.

Use ssh, it gives almost the same benefits but is much more secure. Yes, it is a bit harder to set up, but not that much.

Comments

[devsda]

When I run rsh -l service localhost pwd from root, it shows the same error. , .i.e., Permission Denied

[sunnysideup]

@jhamb then have a look at the rhosts//etc/hosts.equiv file of your service user and add an entry for the root user...

[devsda]

/etc/hosts.equiv only one line i.e., + service. Now I added one more line + root. Then I reboot, but when I run rsh localhost pwd from root , but I shows again Permission Denied. What can I do now ?

[sunnysideup]

@jhamb use rsh -l service localhost and read the documentation of rsh to understand the issues.

[Deer Hunter]

Would have upvoted a thousand times if I could.

[devsda]

In root, rsh -l service localhost pwd works, but rsh localhost pwd not works.

[devsda]

Can you give answer of above comment?