Very Computer

I was hoping someone could shed some light on a unix question for me..
I was recently reading a paper I ftp'd from info.cert.org /pub/papers
about Improving Your Unix Security, and it spoke of the hosts.equiv
file.  In the paper, it said that a host listed in the hosts.equiv file
is a trusted host, and users with the samer login name on both hosts
can rlogin without a password, as well as rsh.
Is this true?  I know of a prticular situation of a school listing a
students linux machine in it's hosts.equiv file.  Can the student as
root rlogin to the other host?
Sorry If this is a newbie question, but I am new to Unix security,
although I find it very interesting..
What exactly does the hosts.equiv file allow, and what is not secure?
Thanks..
-Joshua Wright
student

: I was hoping someone could shed some light on a unix question for me..
: I was recently reading a paper I ftp'd from info.cert.org /pub/papers
: about Improving Your Unix Security, and it spoke of the hosts.equiv
: file.  In the paper, it said that a host listed in the hosts.equiv file
: is a trusted host, and users with the samer login name on both hosts
: can rlogin without a password, as well as rsh.
: Is this true?  I know of a prticular situation of a school listing a
: students linux machine in it's hosts.equiv file.  Can the student as
: root rlogin to the other host?

No, root is an exception.  But he could be any other user.

: Sorry If this is a newbie question, but I am new to Unix security,
: although I find it very interesting..
: What exactly does the hosts.equiv file allow, and what is not secure?

See above.

: Thanks..
: -Joshua Wright
: student

Quote:> I was hoping someone could shed some light on a unix question for me..
> I was recently reading a paper I ftp'd from info.cert.org /pub/papers
> about Improving Your Unix Security, and it spoke of the hosts.equiv
> file.  In the paper, it said that a host listed in the hosts.equiv file
> is a trusted host, and users with the samer login name on both hosts
> can rlogin without a password, as well as rsh.
> Is this true?  I know of a prticular situation of a school listing a
> students linux machine in it's hosts.equiv file.  Can the student as
> root rlogin to the other host?

It is true for all the same login names on both hosts but root.
For root access the invading host must be invited by /etc/hosts.equiv
AND a .rhosts in root's homedirectory on the target host, usually /.rhosts.

The .rhosts invitation is also relevant for normal users.
Normal users can be invited by a .rhosts file in the target host homedirectory,
OR by /etc/hosts.equiv.

--

                ///                \\\
               ( ..)              (.. )
------------o00-(_)-00o--------o00-(_)-00o-------------------------------
Michael Tosch                           Ericsson Eurolab Deutschland GmbH
Methods & Tools                             52134 Herzogenrath Kohlscheid
Local System Administrator              Germany

: I was hoping someone could shed some light on a unix question for me..
: I was recently reading a paper I ftp'd from info.cert.org /pub/papers
: about Improving Your Unix Security, and it spoke of the hosts.equiv
: file.  In the paper, it said that a host listed in the hosts.equiv file
: is a trusted host, and users with the samer login name on both hosts
: can rlogin without a password, as well as rsh.
: Is this true?  I know of a prticular situation of a school listing a
: students linux machine in it's hosts.equiv file.  Can the student as
: root rlogin to the other host?
: Sorry If this is a newbie question, but I am new to Unix security,
: although I find it very interesting..
: What exactly does the hosts.equiv file allow, and what is not secure?
: Thanks..
: -Joshua Wright
: student

+----------------------------------------------------------+
Hy Joshua !

If you login from a remote-system to your local-system with the
login-name "test", your local-system looks at the HOME-dir from
local-user "test" for the file ".rhosts". If the remote machine
appears  in  this file you can  login as "test" on local-system
after typing password.

If  the  remote  machine  appers in "/etc/hosts.equiv" too, you
don't need to type the login and  password for user test on the
local system.

If the user "test" is not available  on local-system, the local
system will ask you for the login and the password.

--
Bye
+----------------------------------------------------------+

|                                                          |
| Voice : +049 661 939226  Computer Software Studio GmbH   |
| Fax   : +049 661 939252  Justus-Liebig-Str. 2            |
| Data  : +049 661 939253  36093 Kuenzell / Germany        |
+----------------------------------------------------------+

: : I was hoping someone could shed some light on a unix question for me..
: : I was recently reading a paper I ftp'd from info.cert.org /pub/papers
: : about Improving Your Unix Security, and it spoke of the hosts.equiv
: : file.  In the paper, it said that a host listed in the hosts.equiv file
: : is a trusted host, and users with the samer login name on both hosts
: : can rlogin without a password, as well as rsh.
: : Is this true?  I know of a prticular situation of a school listing a
: : students linux machine in it's hosts.equiv file.  Can the student as
: : root rlogin to the other host?

: No, root is an exception.  But he could be any other user.

Including bin, sys, daemon, lp, uucp, etc..  Almost as good as root.

: : Sorry If this is a newbie question, but I am new to Unix security,
: : although I find it very interesting..
: : What exactly does the hosts.equiv file allow, and what is not secure?

: See above.

: : Thanks..
: : -Joshua Wright
: : student

--
Douglas O'Neal, Senior Systems Programmer, Johns Hopkins University

If the reset button is easily accessible then you'll have to use it often.

Ok, but he also asked about the superuser. Root does not use any hosts.equiv
file, root only looks at the /.rhosts. So you can grant easy access to
normal users between machines administrated by different persons, without
giving away your superuser rights to the other admin.

Tobias
--
-------------------------------------------------------------------------

: What exactly does the hosts.equiv file allow, and what is not secure?
: Thanks..
: -Joshua Wright
: student

Well, what the hosts.equiv file allows has been amply explained.  As
far as the security risk, it seems to me that the biggest problem is
that as a sysadmin, by using /etc/hosts.equiv, and allowing $/.rhosts
files, you are putting the security of your system in your users hands
and sometimes even in the hands of users on other systems.

Suppose for example, that host evil.gov has been compromised.  You are
the sysadmin for host victim.com.  Somebody broke into evil.com and is
now able to read the /etc/hosts.equiv file.  s/he sees that victim.com
is a trusted host there.  S/he then assumes that evil.gov is also a
trusted host on victim.com.  This theory can be tested by rlogin to
victim.com.  If there is a username which is the same on both hosts,
that person is now logged in to victim.com.  The same process can be
done with the .rhosts file.  If the intruder has root privilege on
evil.gov s/he can create any user s/he wants, and thus get into almost
any account on your system.

This process of assuming that the trusting between hosts is reciprocal
was used, among other things, by the internet worm.  It is a great
way to be able to get into more systems after just compromising one.
All the remote commands should work with a host which is trusted by
another.

There was a study done on $/.rhosts files, and on one occasssion,
a user had over 500 trusted hosts and accounts in his $/.rhosts
file.  Essentially, he, not the system administrator was making the
security policy for the system.

Jesper
--

 __________________________________________________________________________
 Jesper M. Johansson                    | "I want to know God's thoughts.  

 University of Maryland Business School |                   Albert Einstein