Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (HP-UX-11.11)
Apropos / Subsearch:
optional field

 remshd(1M)							  remshd(1M)

      remshd - remote shell server

      /usr/lbin/remshd [-lns]

      The remshd command is the server for the rcp, rdist and remsh
      commands, and the rcmd() function (see rcp(1), rdist(1), remsh(1), and
      rcmd(3N)).  The server provides remote execution facilities with
      authentication based on privileged port numbers.

      The inetd daemon calls remshd when a service request is received at
      the port indicated for the shell (or cmd) service specified in
      /etc/services (see inetd(1M) and services(4)).  When called, inetd
      creates a connection to the service on the client's host.	 To run
      remshd, the following line should be present in the /etc/inetd.conf

	   shell  stream  tcp  nowait  root  /usr/lbin/remshd  remshd

      See inetd.conf(4) for more information.

      remshd recognizes the following options.

	   -l	Disallow authentication based on the user's .rhosts file
		unless the user is a superuser.

	   -n	Disable transport-level keep-alive messages.  Otherwise, the
		messages are enabled.  The keep-alive messages allow
		sessions to be timed out if the client crashes or becomes

	   -s	This option is used in multi-homed NIS systems.	 It disables
		remshd from doing a reverse lookup, of the client's IP
		address; see gethostbyname(3N).	 It can be used to
		circumvent an NIS limitation with multihomed hosts.

      When remshd receives a service request, it responds with the following

	   1.	The server checks the client's source port.  If the port is
		not in the range 512 through 1023, the server aborts the

	   2.	The server reads characters from the connection up to a null
		(\0) byte.  It interprets the resulting string as an ASCII
		number, base 10.

 Hewlett-Packard Company	    - 1 -   HP-UX Release 11i: November 2000

 remshd(1M)							  remshd(1M)

	   3.	If the number is non-zero, it is interpreted as the port
		number of a secondary stream to be used for standard error.
		A second connection is then created to the specified port on
		the client's host.  (The source port of this second
		connection must be also in the range 512 through 1023.) If
		the first character sent is a null (\0), no secondary
		connection is made, and the standard error from the command
		is sent to the primary stream.	If the secondary connection
		has been made, remshd interprets bytes it receives on that
		socket as signal numbers and passes them to the command as
		signals.  See signal(2).

	   4.	The server checks the client's source address and requests
		the corresponding host name (see named(1M),
		gethostbyaddr(3N), and hosts(4)).  If it cannot determine
		the hostname, it uses the dot-notation representation of the
		host address.

	   5.	The server reads the client's host account name from the
		first connection.  This is a null-terminated sequence not
		exceeding 16 characters.

	   6.	The server reads the server's host account name from the
		first connection.  This is a null-terminated sequence not
		exceeding 16 characters.

	   7.	The server reads a command to be passed to the shell from
		the first connection.  The command length is limited by the
		maximum size of the system's argument list.

	   8.	remshd then validates the user as follows (all actions take
		place on the host remshd runs on):

		a.   It looks up the user account name (retrieved in step 6)
		     in the password file.  If it finds it, it performs a
		     chdir() to either the user's home directory, if there
		     is one, or to "/."

		b.   If either the lookup or chdir() fails, the connection
		     is terminated (see chdir(2)).

		c.   The connection is also terminated if

		     +	  the account accessed is administratively locked.
			  The account can be locked by entering a character
			  in the password field that is not part of the set
			  of digits (such as *).  The characters used to
			  represent "digits" are . for 0, / for 1, 0 through
			  9 for 2 through 11, A through Z for 12 through 37,
			  and a through z for 38 through 63. (See also

 Hewlett-Packard Company	    - 2 -   HP-UX Release 11i: November 2000

 remshd(1M)							  remshd(1M)

		     +	  the account accessed is protected by a password
			  and,	either the password expired or the account
			  on the client's host is not equivalent to the
			  account accessed;

		     +	  remshd runs on a secure system and the account
			  accessed is not protected by a password.

		     For more information on equivalent accounts, see

	   9.	A null byte is returned on the primary connection and the
		command line is passed to the normal login shell of the user
		with that shell's -c option.  The shell inherits the network
		connections established by remshd and assumes the normal
		user and group permissions of the user.

		remshd uses the following path when executing the specified


	   10.	If a secondary socket has been set up, remshd normally exits
		when command standard error and secondary socket standard
		error have both been closed.  If no secondary socket was set
		up, remshd has called an exec(2) function, launched the
		command process, and is no longer present.

      All diagnostic messages are returned on the connection associated with
      standard error after which any network connections are closed.  An
      error is indicated by a leading byte with a value of 1 (0 is returned
      in step 9 above upon successful completion of all the steps before the
      command execution).

      Malformed from address

	   The first socket connection does not use a reserved port or the
	   client's host address is not an Internet address.

      Can't get stderr port

	   Unable to complete the connection of the secondary socket used
	   for error communication.

      Second port not reserved

	   The secondary socket connection does not use a reserved port.

      Locuser too long

 Hewlett-Packard Company	    - 3 -   HP-UX Release 11i: November 2000

 remshd(1M)							  remshd(1M)

	   The name of the user account on the client's host is longer than
	   16 characters.

      Remuser too long

	   The name of the user on the server's host is longer than 16

      Command too long

	   The command line passed exceeds the size of the argument list (as
	   configured into the system).

      Login incorrect

	   No password file entry existed for the user name on the server's
	   host, or the authentication procedure described above in step 8

      No remote directory

	   The chdir command to the home directory or "/" on the server's
	   host failed.

      Can't make pipe

	   The pipe needed for the standard error output wasn't created.

      No more processes

	   The server was unable to fork a process to handle the incoming

	   Next step: Wait a period of time and try again.  If this message
	   persists, the server's host may have runaway processes that are
	   using all the entries in the process table.

      system call: message

	   Error in executing the named system call.  The message specifies
	   the cause of the failure.

      shellname: ...

	   The user's login shell could not be started.	 This message is
	   returned on the connection associated with the standard error,
	   and is not preceded by a leading byte with a value of 1.  Other
	   messages can be returned by the remote command when it executes.

      The "privileged port" authentication procedure used here assumes the

 Hewlett-Packard Company	    - 4 -   HP-UX Release 11i: November 2000

 remshd(1M)							  remshd(1M)

      integrity of each host and the connecting medium.	 This is insecure,
      but is useful in an "open" environment.

      remshd ignores SIGHUP, SIGINT, SIGQUIT, and SIGTERM, so these signal
      numbers can safely be sent to remote commands via the secondary socket
      provided by remshd.  Other signal numbers may cause remshd to kill

      remshd was developed by the University of California, Berkeley.

      $HOME/.rhosts		    User's private equivalence list
      /etc/hosts.equiv		    List of equivalent hosts

      remsh(1), inetd(1M), named(1M), rcmd(3N), hosts(4), hosts.equiv(4),
      inetd.conf(4), inetd.sec(4), services(4).

 Hewlett-Packard Company	    - 5 -   HP-UX Release 11i: November 2000