1 '\" te
   2 .\" Copyright 1989 AT&T
   3 .\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
   4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
   5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
   6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
   7 .TH IN.RLOGIND 1M "February 5, 2022"
   8 .SH NAME
   9 in.rlogind, rlogind \- remote login server
  10 .SH SYNOPSIS
  11 .nf
  12 \fB/usr/sbin/in.rlogind\fR [\fB-k5eExXciPp\fR] [\fB-s\fR \fItos\fR] [\fB-S\fR \fIkeytab\fR]
  13      [\fB-M\fR \fIrealm\fR]
  14 .fi
  15 
  16 .SH DESCRIPTION
  17 \fBin.rlogind\fR is the server for the \fBrlogin\fR(1) program.  The server
  18 provides a remote login facility with authentication based on Kerberos V5 or
  19 privileged port numbers.
  20 .sp
  21 .LP
  22 \fBin.rlogind\fR is invoked by \fBinetd\fR(1M) when a remote login connection
  23 is established. When Kerberos V5 authentication is required (see option
  24 \fB-k\fR below), the authentication sequence is as follows:
  25 .RS +4
  26 .TP
  27 .ie t \(bu
  28 .el o
  29 Check Kerberos V5 authentication.
  30 .RE
  31 .RS +4
  32 .TP
  33 .ie t \(bu
  34 .el o
  35 Check authorization according to the rules in \fBkrb5_auth_rules\fR(5).
  36 .RE
  37 .RS +4
  38 .TP
  39 .ie t \(bu
  40 .el o
  41 Prompt for a password if any checks fail and \fB/etc/pam.conf\fR is configured
  42 to do so.
  43 .RE
  44 .sp
  45 .LP
  46 In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
  47 Kerberos principal must exist for each Fully Qualified Domain Name associated
  48 with the \fBin.rlogind\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR
  49 principals must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR
  50 file on the \fBin.rlogind\fR server. An example principal might be:
  51 .sp
  52 .LP
  53 \fBhost/bigmachine.eng.example.com\fR
  54 .sp
  55 .LP
  56 See \fBkadmin\fR(1M) for instructions on adding a principal to a
  57 \fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
  58 authentication.
  59 .sp
  60 .LP
  61 If Kerberos V5 authentication is not enabled, then the authentication procedure
  62 follows the standard \fBrlogin\fR protocol:
  63 .RS +4
  64 .TP
  65 .ie t \(bu
  66 .el o
  67 The server checks the client's source port. If the port is not in the range
  68 512-1023, the server aborts the connection.
  69 .RE
  70 .RS +4
  71 .TP
  72 .ie t \(bu
  73 .el o
  74 The server checks the client's source address. If an entry for the client
  75 exists in both \fB/etc/hosts\fR and \fB/etc/hosts.equiv\fR, a user logging in
  76 from the client is not prompted for a password. If the address is associated
  77 with a host for which no corresponding entry exists in \fB/etc/hosts\fR, the
  78 user is prompted for a password, regardless of  whether or not an entry for the
  79 client is present in  \fB/etc/hosts.equiv\fR. See \fBhosts\fR(4) and
  80 \fBhosts.equiv\fR(4).
  81 .RE
  82 .sp
  83 .LP
  84 Once the source port and address have been checked, \fBin.rlogind\fR allocates
  85 a pseudo-terminal and manipulates file descriptors so that the subsidiary half
  86 of the pseudo-terminal becomes the \fBstdin\fR, \fBstdout\fR, and \fBstderr\fR
  87 for a login process.  The login process is an instance of the \fBlogin\fR(1)
  88 program, invoked with the \fB-r\fR.
  89 .sp
  90 .LP
  91 The login process then proceeds with the \fBpam\fR(3PAM) authentication
  92 process. See \fBSECURITY\fR below.  If automatic authentication fails, it
  93 reprompts the user to login.
  94 .sp
  95 .LP
  96 The parent of the login process manipulates the manager side of the
  97 pseudo-terminal, operating as an intermediary between the login process and the
  98 client instance of the \fBrlogin\fR program.  In normal operation, a packet
  99 protocol is invoked to provide Ctrl-S and Ctrl-Q type facilities and propagate
 100 interrupt signals to the remote programs. The login process propagates the
 101 client terminal's baud rate and terminal type, as found in the environment
 102 variable, \fBTERM\fR.
 103 .SH OPTIONS
 104 The following options are supported:
 105 .sp
 106 .ne 2
 107 .na
 108 \fB\fB-5\fR\fR
 109 .ad
 110 .RS 13n
 111 Same as \fB-k\fR, for backwards compatibility.
 112 .RE
 113 
 114 .sp
 115 .ne 2
 116 .na
 117 \fB\fB-c\fR\fR
 118 .ad
 119 .RS 13n
 120 Requires Kerberos V5 clients to present a cryptographic checksum of initial
 121 connection information like the name of the user that the client is  trying  to
 122 access in the initial authenticator. This checksum provides additionl security
 123 by preventing an attacker from changing the initial connection information.
 124 This option is mutually exclusive with the \fB-i\fR option.
 125 .RE
 126 
 127 .sp
 128 .ne 2
 129 .na
 130 \fB\fB-e\fR\fR
 131 .ad
 132 .RS 13n
 133 Creates an encrypted session.
 134 .RE
 135 
 136 .sp
 137 .ne 2
 138 .na
 139 \fB\fB-E\fR\fR
 140 .ad
 141 .RS 13n
 142 Same as \fB-e\fR, for backwards compatibility.
 143 .RE
 144 
 145 .sp
 146 .ne 2
 147 .na
 148 \fB\fB-i\fR\fR
 149 .ad
 150 .RS 13n
 151 Ignores authenticator checksums if provided. This option ignores authenticator
 152 checksums presented by current Kerberos clients to protect initial connection
 153 information. Option \fB-i\fR is the opposite of option \fB-c\fR.
 154 .RE
 155 
 156 .sp
 157 .ne 2
 158 .na
 159 \fB\fB-k\fR\fR
 160 .ad
 161 .RS 13n
 162 Allows Kerberos V5 authentication with the \fB\&.k5login\fR access control file
 163 to be trusted. If this authentication system is used by the client and the
 164 authorization check is passed, then the user is allowed to log in.
 165 .RE
 166 
 167 .sp
 168 .ne 2
 169 .na
 170 \fB\fB-M\fR \fIrealm\fR\fR
 171 .ad
 172 .RS 13n
 173 Uses the indicated Kerberos V5 realm. By default, the daemon will determine its
 174 realm from the settings in the \fBkrb5.conf\fR(4) file.
 175 .RE
 176 
 177 .sp
 178 .ne 2
 179 .na
 180 \fB\fB-p\fR\fR
 181 .ad
 182 .RS 13n
 183 Prompts for authentication only if other authentication checks fail.
 184 .RE
 185 
 186 .sp
 187 .ne 2
 188 .na
 189 \fB\fB-P\fR\fR
 190 .ad
 191 .RS 13n
 192 Prompts for a password in addition to other authentication methods.
 193 .RE
 194 
 195 .sp
 196 .ne 2
 197 .na
 198 \fB\fB-s\fR \fItos\fR\fR
 199 .ad
 200 .RS 13n
 201 Sets the \fBIP\fR \fBTOS\fR option.
 202 .RE
 203 
 204 .sp
 205 .ne 2
 206 .na
 207 \fB\fB-S\fR \fIkeytab\fR\fR
 208 .ad
 209 .RS 13n
 210 Sets the \fBKRB5\fR keytab file to use. The \fB/etc/krb5/krb5.keytab\fR file is
 211 used by default.
 212 .RE
 213 
 214 .sp
 215 .ne 2
 216 .na
 217 \fB\fB-x\fR\fR
 218 .ad
 219 .RS 13n
 220 Same as \fB-e\fR, for backwards compatibility.
 221 .RE
 222 
 223 .sp
 224 .ne 2
 225 .na
 226 \fB\fB-X\fR\fR
 227 .ad
 228 .RS 13n
 229 Same as \fB-e\fR, for backwards compatibility.
 230 .RE
 231 
 232 .SH USAGE
 233 \fBrlogind\fR and \fBin.rlogind\fR are IPv6-enabled. See \fBip6\fR(7P).
 234 \fBIPv6\fR is not currently supported with Kerberos V5 authentication.
 235 .sp
 236 .LP
 237 Typically, Kerberized \fBrlogin\fR service runs on port 543 (klogin) and
 238 Kerberized, encrypted \fBrlogin\fR service runs on port 2105 (eklogin). The
 239 corresponding FMRI entries are:
 240 .sp
 241 .in +2
 242 .nf
 243 svc:/network/login:klogin (rlogin with kerberos)
 244 svc:/network/login:eklogin (rlogin with kerberos and encryption)
 245 .fi
 246 .in -2
 247 .sp
 248 
 249 .SH SECURITY
 250 \fBin.rlogind\fR uses \fBpam\fR(3PAM) for authentication, account management,
 251 and session management. The \fBPAM\fR configuration policy, listed through
 252 \fB/etc/pam.conf\fR, specifies the modules to be used for \fBin.rlogind\fR.
 253 Here is a partial \fBpam.conf\fR file with entries for the \fBrlogin\fR command
 254 using the "rhosts" and UNIX authentication modules, and the UNIX account,
 255 session management, and password management modules.
 256 .sp
 257 
 258 .sp
 259 .TS
 260 l l l
 261 l l l .
 262 rlogin  auth sufficient pam_rhosts_auth.so.1
 263 rlogin  auth requisite  pam_authtok_get.so.1
 264 rlogin  auth required   pam_dhkeys.so.1
 265 rlogin  auth required   pam_unix_auth.so.1
 266 
 267 rlogin  account required        pam_unix_roles.so.1
 268 rlogin  account required        pam_unix_projects.so.1
 269 rlogin  account required        pam_unix_account.so.1
 270 
 271 rlogin  session required        pam_unix_session.so.1
 272 .TE
 273 
 274 .sp
 275 .LP
 276 With this configuration, the server checks the client's source address. If an
 277 entry for the client exists in both \fB/etc/hosts\fR and
 278 \fB/etc/hosts.equiv\fR, a user logging in from the client is not prompted for a
 279 password. If the address is associated with a host for which no corresponding
 280 entry exists in \fB/etc/hosts\fR, the user is prompted for a password,
 281 regardless of whether or not an entry for the client is present in
 282 \fB/etc/hosts.equiv\fR. See \fBhosts\fR(4) and \fBhosts.equiv\fR(4).
 283 .sp
 284 .LP
 285 When running a Kerberized rlogin service (with or without the encryption
 286 option), the pam service name that should be used is "\fBkrlogin\fR".
 287 .sp
 288 .LP
 289 If there are no entries for the \fBrlogin\fR service, then the entries for the
 290 "other" service will be used. If multiple authentication modules are listed,
 291 then the user may be prompted for multiple passwords. Removing the
 292 \fBpam_rhosts_auth.so.1\fR entry will disable the \fB/etc/hosts.equiv\fR and
 293 \fB~/.rhosts\fR authentication protocol and the user would always be forced to
 294 type the password. The \fIsufficient\fR flag indicates that authentication
 295 through the \fBpam_rhosts_auth.so.1\fR module is sufficient to authenticate the
 296 user. Only if this authentication fails is the next authentication module used.
 297 .SH SEE ALSO
 298 \fBlogin\fR(1), \fBsvcs\fR(1), \fBrlogin\fR(1),
 299 \fBin.rshd\fR(1M), \fBinetadm\fR(1M), \fBinetd\fR(1M), \fBkadmin\fR(1M),
 300 \fBsvcadm\fR(1M), \fBpam\fR(3PAM), \fBhosts\fR(4), \fBhosts.equiv\fR(4),
 301 \fBkrb5.conf\fR(4), \fBpam.conf\fR(4), \fBattributes\fR(5), \fBenviron\fR(5),
 302 \fBkrb5_auth_rules\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
 303 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
 304 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5),
 305 \fBsmf\fR(5)
 306 .sp
 307 .LP
 308 \fI\fR
 309 .SH DIAGNOSTICS
 310 All diagnostic messages are returned on the connection associated with the
 311 \fBstderr\fR, after which any network connections are closed. An error is
 312 indicated by a leading byte with a value of 1.
 313 .sp
 314 .ne 2
 315 .na
 316 \fB\fBHostname for your address unknown.\fR\fR
 317 .ad
 318 .sp .6
 319 .RS 4n
 320 No entry in the host name database existed for the client's machine.
 321 .RE
 322 
 323 .sp
 324 .ne 2
 325 .na
 326 \fB\fBTry again.\fR\fR
 327 .ad
 328 .sp .6
 329 .RS 4n
 330 A \fIfork\fR by the server failed.
 331 .RE
 332 
 333 .sp
 334 .ne 2
 335 .na
 336 \fB\fB/usr/bin/sh:\fR .\|.\|.\fR
 337 .ad
 338 .sp .6
 339 .RS 4n
 340 The user's login shell could not be started.
 341 .RE
 342 
 343 .SH NOTES
 344 The authentication procedure used here assumes the integrity of each client
 345 machine and the connecting medium.  This is insecure, but it is useful in an
 346 ``open'' environment.
 347 .sp
 348 .LP
 349 A facility to allow all data exchanges to be encrypted should be present.
 350 .sp
 351 .LP
 352 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
 353 provided by \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
 354 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
 355 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), and
 356 \fBpam_unix_session\fR(5).
 357 .sp
 358 .LP
 359 The \fBin.rlogind\fR service is managed by the service management facility,
 360 \fBsmf\fR(5), under the service identifier:
 361 .sp
 362 .in +2
 363 .nf
 364 svc:/network/login:rlogin (rlogin)
 365 svc:/network/login:klogin (rlogin with kerberos)
 366 svc:/network/login:eklogin (rlogin with kerberos and encryption)
 367 .fi
 368 .in -2
 369 .sp
 370 
 371 .sp
 372 .LP
 373 Administrative actions on this service, such as enabling, disabling, or
 374 requesting restart, can be performed using \fBsvcadm\fR(1M). Responsibility for
 375 initiating and restarting this service is delegated to \fBinetd\fR(1M). Use
 376 \fBinetadm\fR(1M) to make configuration changes and to view configuration
 377 information for this service. The service's status can be queried using the
 378 \fBsvcs\fR(1) command.