rsh (AFS version)          AFS Commands       rsh (AFS version)


NAME

   rsh (AFS version) -- open shell on remote machine.


   rsh host [-l <username>] [-n] <command>  host [-l
   <username>] [-n] <command>

DESCRIPTION

   Functions  like the standard UNIX rsh, except that it allows
   the issuer to execute commands on the remote machine  as  an
   authenticated  AFS  user.   The command passes a copy of the
   AFS token that the issuer has obtained on the local  machine
   to  the  remote  machine's  Cache Manager.  The remote Cache
   Manager can use the token to have the issuer  recognized  as
   an authenticated AFS user.

   Token  passing  is most effective if both the remote machine
   and local machine belong to the same cell, because  rsh  can
   pass  only  one token even if the user has severalMit passes
   the token that is marked [1] in the output from  the  tokens
   command.    If  the  remote and local machine are not in the
   same cell, the token should be for the  cell  to  which  the
   remote  machine  belongs,  so  that the remote cell's server
   processes will recognize the issuer as authenticated.

   In addition to running the AFS version of the rsh binary  on
   the   machine   where  the  rsh  command  is  issued,  other
   configuration changes are necessary  for  token  passing  to
   work  properly.    See the REQUIREMENTS/RESTRICTIONS section
   for a list.

   The AFS version of  rsh  is  compatible  with  the  standard
   inetd,  but  token passing only works if the AFS versions of
   both programs are being used.    If  only  one  of  them  is
   modified,  the  issuer  will  access  AFS  files through the
   remote machine as anonymous.

WARNINGS

   The protections required  on  the  .rhosts  file  for  token
   passing  to  work  correctly  with  this  command  (see  the
   REQUIREMENTS/RESTRICTIONS section) are the opposite of those
   necessary  for token creation to work correctly with the AFS
   version of rlogind.

   For security's sake, use the AFS  version  of  rsh  only  in
   conjunction  with  PAGs,  either by using the AFS version of
   login or always issuing pagsh before obtaining tokens.

REQUIREMENTS/RESTRICTIONS

   Several  configuration  requirements  and  restrictions  are
   necessary  for  token passing to work correctly with the AFS
   version of rsh.  Some of these are also necessary  with  the
   standard  UNIX  version,  but  are included here because the
   issuer used to AFS protections may not be inclined to  think
   of    them.        There    may    be    other    UNIX-based
   requirements/restrictions not mentioned  here;  consult  the
   UNIX  manual  page.    (One  important  one  is that no stty



   commands may appear in  the  issuer's  shell  initialization
   file, such as .cshrc.)

   The  requirements/restrictions for token passing include the
   following.

      - The local machine must be running the AFS  version
        of  rsh, with the binary file locally installed to
        grant setuid privilege to the owner, "root".

      - The remote machine must be running the AFS version
        of inetd.

      - The   following  two  lines  must  appear  in  the
        /etc/services file on the local machine  (as  well
        as  on the remote machine running modified inetd).
        On NeXT machines, this information must appear  in
        the NetInfo database rather than in /etc/services.

           auth 113/tcp authentication
           ta-rauth 601/tcp rauth

      - If rsh is to consult an .rhosts file on the remote
        machine, the file must have  UNIX  protections  no
        more  liberal than -rw-r--r--.  If .rhosts resides
        in  a  user  home  directory  in  AFS,  the   home
        directory  must  also  grant  the  LOOKUP and READ
        rights to system:anyuser.

ARGUMENTS

   Consult the UNIX manual page for rsh.

MORE INFORMATION

   inetd (AFS version)

   UNIX manual page for rsh

   rlogind (AFS version)

   tokens
