Tutorial - Remote Login on the Internet

##
Remote Login on the Internet

### Impact

If configured to trust all remote hosts, the remote login service could allow any remote user to gain shell access to a target system without ever being prompted for a password.

### Background

The `rlogin` service allows remote users, using an `rlogin` client, to log on to an `rlogin` server without the need for a password. The `rlogin` process is similar to `telnet`, in that it gives users shell access to a remote computer. But, unlike `telnet`, `rlogin` does not prompt the user for a username (although, in most cases, the user is prompted for a password). The `rlogin` process uses the .rhosts file to list trusted hosts (those machines allowed to use the service). If the .rhosts file is not configured properly, it is possible for a hacker to gain access to a target machine, via the `rlogin` process, without being prompted for a password.

### The Problem

This service, if misconfigured, allows unauthorized, untrusted users to gain shell access to a target machine without being prompted for a password. In other words, hackers exploiting this vulnerability can gain access to a target machine as a trusted user and then delete system files, change configuration files and generally wreak havoc on the target machine. Another problem with this service is that even when passwords are prompted for, they are transmitted plaintext and in the clear (in other words, they are sent to and from the machine unencrypted), so that any hacker using a password sniffer program can "grab" them and then access the target system as a trusted user.

### Resolution

One fix for this vulnerability is to disable `login` in `/etc/inetd.conf`. If that is not practical, be sure that `/etc/hosts.equiv` and users' `.rhosts` files contain only trusted hosts, and contain no "+" characters. The risks of password sniffing may be minimized by using an encrypted version, such as Kerberos. Or, you may use TCP wrappers to help secure your network.

### Where can I read more about this?

Search your system's man pages for information on the `rlogind` or `in.rlogind` service for more information.