Berkeley r-commands

Berkeley r-commands

Developer(s)	Computer Systems Research Groupat theUniversity of California, Berkeley
Initial release	June 1981(1981-06)
Operating system	UnixandUnix-like
Type	Commandsuite
License	BSD

TheBerkeley r-commandsare asuiteofcomputer programsdesigned to enable users of oneUnixsystem tolog inor issuecommandsto anotherUnixcomputer viaTCP/IPcomputer network.The r-commands were developed in 1982 by theComputer Systems Research Groupat theUniversity of California, Berkeley,based on an early implementation ofTCP/IP(theprotocol stackof theInternet).

The CSRG incorporated the r-commands into theirUnixoperating system,theBerkeley Software Distribution(BSD). The r-commands premiered in BSD v4.1.Among the programs in the suite are:rcp(remotecopy),rexec(remoteexecution),rlogin(remotelogin),rsh(remoteshell),rstat,ruptime,andrwho(remotewho).

The r-commands were a significant innovation, and becamede factostandards for Unix operating systems.With wider public adoption of the Internet, their inherent security vulnerabilities became a problem,and beginning with the development ofSecure Shellprotocols and applications in 1995, its adoption entirely supplanted the deployment and use of r-commands (andTelnet) on networked systems.

Overview

Service		Port	Transport	Refs
Client	Daemon
rcp	rshd	514	TCP
rexec	rexecd	512	TCP
rlogin	rlogind	513	TCP
rsh	rshd	514	TCP
rstat	rstatd		UDP
ruptime	rwhod	513	UDP
rwho

Protocol

The original Berkeley package that providesrloginalso featuresrcp(remote-copy, allowing files to be copied over the network) andrsh(remote-shell, allowing commands to be run on a remote machine without the user logging into it).

As an example, the protocol is as follows:

Client:
<null>
usernameontheclient<null>
usernameontheserver<null>
terminaltype/terminalbaudrate<null>

Server:

The server would check that the user should have access. If so, it returns a message with nothing in it (not even anull character), meaning the connection is established. For example:

Client:
<null>
bostic<null>
kbostic<null>
vt100/9600<null>

Server:

Bothrloginandrshshare the/etc/hosts.equiv(applies to all users on the server) and$HOME/.rhosts(applies to only the user that puts the file in its home folder) access-control scheme, although they connect to different daemons.rloginconnects torlogind,whilershconnects torshd. hosts.equivand.rhostsuses the same format. The following shows some aspects of the format:

host1
host2user_a
-host3
+@group1-user_b
-@group2

This allows all users from host1 to login, user_a from host2 to login, no users from host3, all users on group1 except user_b, and no users on group2.

Commands

rlogin

See also:Telnet

rloginenables a user to log in on anotherserverviacomputer network,usingTCPnetwork port513.

rloginis also the name of theapplication layerprotocolused by the software, part of theTCP/IPprotocol suite. Authenticated users can act as if they were physically present at the computer. RFC 1282, in which it was defined, states: "Therloginfacility provides a remote-echoed, locally flow-controlled virtual terminal with proper flushing of output. "rlogincommunicates with adaemon,rlogind,on the remote host.rloginis similar to theTelnetcommand, but is not as customizable and is able to connect only to Unix-like hosts.

rsh

Further information:Remote Shell

rshopens ashellon a remote computer without aloginprocedure. Once connected, the user can execute commands on the remote computer through the shell'scommand-line interface.rshpasses input and output through thestandard streams,and it sendsstandard outputto the user'sconsole.Over the network,standard inputand standard out flow through TCP port 514, whileStandard Errorflows through a different TCP port, which thershdaemon(rshd) opens.

rexec

Likersh,rexecenables the user to run shell commands on a remote computer. However, unlike the rsh server, therexecserver (rexecd) requires login: it authenticates users by reading the username and password (unencrypted) from thenetwork socket.rexecuses TCP port 512.

rcp

rcpcan copy a file or directory from the local system to a remote system, from a remote system to the local system, or from one remote system to another.The command lineargumentsofcpandrcpare similar, but inrcpremote files are prefixed with the name of the remote system:

rcp file.txt subdomain.domain:~/home/foo/file.txt

As with the Unix copy commandcp,rcpoverwrites an existing file of the same name in the target; unlikecp,it provides no mechanism for warning the user before overwriting the target file.Likersh,rcpuses TCP port 514.

rwho

Just as thewhocommand lists the users who are logged in to the local Unix system,rwholists those users who are logged into allmulti-userUnix systems on the local network.rwho's daemon,rwhod,maintains a database of the status of Unix systems on the local network. The daemon and its database are also used by theruptimeprogram.

rstat

rstatreturns performance statistics from the kernel.

ruptime

Just as theuptimecommand shows how long a Unix system has been running since the last restart,ruptimerequests a status report from all computers on the local network. It then returns the uptime report. If a computer did not respond within the time limit, thenruptimereports that the system isdown.This information is tracked and stored by the daemonrwhod,which is also used by the rwho command.

Security

Those r-commands which involve user authentication (rcp,rexec,rlogin,andrsh) share several serious security vulnerabilities:

• All information, including passwords, is transmitted unencrypted (making it vulnerable to interception).
• The.rlogin(or.rhosts) file is easy to misuse. They are designed to allow logins without apassword,but their reliance on remote usernames, hostnames, and IP addresses is exploitable. For this reason many corporate system administrators prohibit.rhostsfiles, and actively scrutinize their networks for offenders.
• The protocol partly relies on the remote party'srloginclient to provide information honestly, including source port and source host name. A malicious client can forge this and gain access, as therloginprotocol has no means ofauthenticatingthe client is running on a trusted machine. It also cannot check if the requesting client on a trusted machine is the realrloginclient, meaning that malicious programs may pretend to be a standard-conformingrloginclient by using the same protocols.
• The common practice of mounting users' home directories viaNetwork File Systemexposes rlogin to attack by means of fake.rhostsfiles - this means that any of its security faults automatically plaguerlogin.

Due to these problems, the r-commands fell into relative disuse (with many Unix andLinuxdistributions no longer including them by default). Many networks that formerly relied onrloginandtelnethave replaced them withSSHand itsrlogin-equivalentslogin.

See also

• List of Unix commands

References

• Casad, Joe (2008)."Berkeley Remote Utilities".Sams Teach Yourself TCP/IP in 24 Hours.Pearson Education.ISBN978-0-13-271513-3– via Google Books.

Further reading

• Noordergraaf, Alex (2003) [2002]."Remote Access Services (rsh, rlogin, and rcp)".Enterprise Security: Solaris Operating Environment, Security Journal, Solaris OE v2.51, 2.6, 7, and 8.Prentice Hall.ISBN978-0-13-100092-6.
• Poniatowski, Marty (2000).UNIX User's Handbook(1st ed.). Prentice Hall. pp. 475–77.ISBN978-0-13-027019-1.OCLC43561861.
• Rogers, Lawrence R. (November 1998)."rlogin(1): The Untold Story"(PDF).Archived fromthe original(PDF)on 2001-12-17.
• "Unix User Enumeration".Penetration Testing Lab.10 April 2012.

External links

• RFC1282,BSD Rlogin (1991)
• rlogin(1)–LinuxUser CommandsManual
• rlogin(1):remote login –DarwinandmacOSGeneral CommandsManual
• rlogin(1):remote login –Solaris 11.4User Commands ReferenceManual