> Message: 1
> Date: Mon, 12 Aug 2002 17:40:05 +0800
> From: Jason Lim <[EMAIL PROTECTED]>
> Organization: CSA MSC SDN BHD
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]
> Subject: Rlogin problem
> Reply-To: [EMAIL PROTECTED]
>
> Hi All,
>
> What happen if i already enable my /etc/xinetd.d/rlogin (set disable=no)
> &
> i type chkconfig --list get my result as below:
>
> E.g.
>
> pulse 0:off 1:off 2:off 3:off 4:off 5:off 6:off
> piranha-gui 0:off 1:off 2:off 3:off 4:off 5:off 6:off
> httpd.myapache 0:off 1:off 2:off 3:off 4:off 5:off 6:off
> xinetd based services:
> rexec: off
> rlogin: on
> rsh: on
> chargen: off
> chargen-udp: off
> daytime: off
>
> but i still cannot rlogin to my machine? What should i still need to
> check?
"chkconfig xinetd on"?
Also have a look at /etc/sysconfig/ip{chains,tables}.
Please consider using ssh instead of rsh/rlogin. The "r" protocols are
highly insecure. I'll let Bastille Linux explain why:
The BSD r-tools rely on IP-based authentication, which means
that you can allow anyone with (for instance) root access on 192.168.1.1
to
have root access on 192.168.1.2. Administrators and other users have
traditionally found this useful, as it lets them connect from one host
to
another without having to retype a password.
The problem with IP-based authentication, however, is that an intruder
can
craft "spoofed" or faked packets which claim to be from a trusted
machine.
Since the r-tools rely entirely on IP addresses for authentication, a
spoofed
packet will be accepted as real, and any hacker who claims to be from a
trusted host will be trusted and given access to your machine.
These tools also transmit all of your data in cleartext, including
passwords.
Tools are now available which allow you to spoof (fake) IP addresses as
well
as to monitor and/or hijack protocols which use cleartext. All of the
same
functionality can be found with the more secure replacement tools ssh
and
scp. Because of these insecurities, ordinary users should not be
allowed
to use the r-tools, and admins should use them only in cases where there
are no other connection methods available.
>
> Please HELP!
>
> Thanks in advance.
>
_______________________________________________
Seawolf-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/seawolf-list
