remshd(1M)

Forbid authentication based on the user's .rhosts file unless the user is a superuser.

Disable transport-level keep-alive messages. Otherwise, the messages are enabled. The keep-alive messages allow sessions to be timed out if the client crashes or becomes unreachable.

With this option enabled, remshd returns immediately after its child process gets killed; it does not wait for all its sub child processes to die. This in turn makes remsh not wait even when the sub child processes are running remotely. As a result, remsh will not appear hung. It is recommended that users do not use the -m option if they want remshd to wait until the completion of all the sub child processes. Otherwise, the user may get an unexpected result.

This option is applicable only to remsh with a secondary socket connection.

Note that even with the -m option enabled, remshd will exit if command standard error is closed.

This option is used in multi-homed NIS systems. It disables remshd from doing a reverse lookup of the client's IP address; see gethostbyname(3N). It can be used to circumvent an NIS limitation with multi-homed hosts.

Ignore checksum verification. This option is used to achieve interoperability between clients and servers using different checksum calculation methods. For example, the checksum calculation in an application developed with Kerberos V5 Beta 4 API is different from the calculation in a Kerberos V5-1.0 application.

Authorization based on Kerberos V5 must succeed or access will be rejected (see sis(5) for details on authorization).

Authentication based on privileged port numbers and authorization of the remote user through equivalent accounts must succeed. For more information on equivalent accounts, see hosts.equiv(4).

Either one of the following must succeed. The order in which the authorization checks are done is as specified below.

Either one of the following must succeed. The order in which the authorization checks are done is as specified below.

Note: The -k option is ignored when used with -K, and the -r option is ignored when used with -R. The default option is -K.

The server checks the client's source port. If the port is not a privileged port, that is, in the range 512 through 1023, and remshd is operating in a non-secure environment, the connection is terminated. In a secure environment, the action taken depends on the command line options:

The server reads characters from the connection up to a null (\0) byte. It interprets the resulting string as an ASCII number, base 10.

If the number is non-zero, it is interpreted as the port number of a secondary stream to be used for standard error. A second connection is then created to the specified port on the client's host. (The source port of this second connection will also be checked as specified in item 1.) If the first character sent is a null (\0), no secondary connection is made, and the standard error from the command is sent to the primary stream. If the secondary connection has been made, remshd interprets bytes it receives on that socket as signal numbers and passes them to the command as signals. See signal(2).

The server checks the client's source address and requests the corresponding host name (see named(1M), gethostbyaddr(3N), and hosts(4)). If it cannot determine the hostname, it uses the dot-notation representation of the host address.

In a secure environment remshd performs authentication based on Kerberos V5. See sis(5) for details.

The server reads the client's host account name from the first connection. This is a null-terminated sequence not exceeding 256 characters.

The server reads the server's host account name from the first connection. This is a null-terminated sequence not exceeding 256 characters.

The server reads a command to be passed to the shell from the first connection. The command length is limited by the maximum size of the system's argument list.

remshd then validates the user as follows (all actions take place on the host remshd runs on):

A null byte is returned on the primary connection and the command line is passed to the normal login shell of the user with that shell's -c option. The shell inherits the network connections established by remshd and assumes the normal user and group permissions of the user.

remshd uses the following path when executing the specified command:

/usr/bin:/usr/ccs/bin:/usr/bin/X11:/usr/contrib/bin:/usr/local/bin

If a secondary socket has been set up, remshd normally exits when command standard error and secondary socket standard error have both been closed. If no secondary socket was set up, remshd has called an exec() function, launched the command process, and is no longer present.