The defining weakness of rsh and rlogin is their host-based trust: ~/.rhosts (per user) and /etc/hosts.equiv (system-wide) can grant passwordless access based on the connecting host and remote username. This is authentication by spoofable network identity, and it is abused four ways: planting a .rhosts entry where a home is writable, exploiting a permissive or wildcard rule, leveraging a broad hosts.equiv rule, and spoofing a trusted source IP to satisfy the check without controlling the trusted host. A host-only hosts.equiv entry normally permits access only to a like-named local account; an explicit username or wildcard can broaden that access. rexec is separate: it sends a username and password and does not use these trust files.
# read existing trust where files are accessible (reveals who is trusted)
cat ~*/.rhosts /etc/hosts.equiv 2>/dev/null
# a matching rule can yield passwordless rsh/rlogin access
Subtopics#
- rhosts write: planting a trusting .rhosts entry.
- Wildcard trust: abusing
+ +and over-broad entries. - hosts.equiv trust: exploiting system-wide trust.
- IP spoofing: impersonating a trusted source address.