/etc/hosts.equiv is the system-wide trust file used by rsh and rlogin. The effect depends on both fields. A host-only entry permits remote users to access like-named local accounts without a password. Adding a username permits that remote user to access non-root local accounts, while wildcard forms such as a bare + or host + broaden trust further. Abuse therefore depends on the exact rule: an attacker may control or spoof a listed host, match a trusted username, exploit a wildcard, or gain enough local privilege to modify the file. Root is excluded from hosts.equiv processing and instead relies on root's own .rhosts policy.
# read it to see which hosts are trusted and how broadly
cat /etc/hosts.equiv 2>/dev/null
# a host-only rule normally requires the remote and local usernames to match
rlogin -l <matching-user> <target>
rsh -l <matching-user> <target> id
# if writable after local elevation, this is a deliberately maximal rule
echo '+' >> /etc/hosts.equiv # any host; behavior may also depend on PAM policy
Exploitation notes#
- Do not treat every entry as equivalent:
hostrequires like-named accounts, whereashost user,host +, and a bare+have progressively broader consequences. - Root is not covered by
hosts.equiv; passwordless root requires/.rhosts, so note the distinction when targeting the root account. - The file is root-owned, so writing it is a post-elevation/persistence step; the initial vector is usually an already-permissive file plus a trusted or spoofable source host.
- The file governs
rshandrlogin; it is not an authentication source for password-basedrexec.