rcp (AFS version)          AFS Commands       rcp (AFS version)


NAME

   rcp (AFS version) -- copy file on remote machine.


                                                 +
   rcp [-p] <file1> <file2>  rcp [-r] [-p] <file>  <directory>

DESCRIPTION

   Functions  like  the standard UNIX rcp, except it allows the
   issuer to use the remote machine's Cache Manager  to  access
   AFS  files as an authenticated AFS user.  The command passes
   a copy of the AFS token which the  issuer  obtained  on  the
   local  machine  to  the remote machine's Cache Manager.  The
   remote Cache Manager can use the token to gain authenticated
   access to AFS.

   Token  passing  is most effective if both the remote machine
   and local machine belong to the same cell, because  rcp  can
   pass  only  one token even if the user has several tokensMit
   passes the token that is marked [1] in the output  from  the
   tokens  command.  If the remote and local machine are not in
   the same cell, the possibilities are:

      - the token passed is for  the  cell  to  which  the
        remote  machine  belongs.  The issuer accesses the
        remote cell's AFS file tree  as  an  authenticated
        AFS user, but is considered anonymous in the local
        cell.    This  means  that  the  issuer  can  only
        exercise    the    access    rights   granted   to
        system:anyuser in the local AFS file  tree.    For
        instance,  a file being copied into the local cell
        can only be copied into a UNIX directory or an AFS
        directory  where  system:anyuser  has  the  INSERT
        right.

      - the token passed is for  the  cell  to  which  the
        local  machine  belongs.   The issuer accesses the
        remote cell's AFS file tree as anonymous,  and  so
        can  only  exercise  the  access rights granted to
        system:anyuser.

   In addition to running the AFS version of the rcp binary  on
   the   machine   where  the  rcp  command  is  issued,  other
   configuration changes are necessary  for  token  passing  to
   work  properly.    See the REQUIREMENTS/RESTRICTIONS section
   for a list.

   The AFS version of  rcp  is  compatible  with  the  standard
   inetd,  but  token passing works only if the AFS versions of
   both programs are being used.    If  only  one  of  them  is
   modified,  the  issuer  will  access  AFS  files through the
   remote machine as anonymous.

WARNINGS

   AFS rcp does  not  allow  "third  party  copies",  in  which
   neither  source  nor  target file is on the current machine.
   Standard UNIX rcp claims to provide this functionality.

   The protections required on the .rhosts file  in  order  for



   token   passing   to   work   with  this  command  (see  the
   REQUIREMENTS/RESTRICTIONS section) are the opposite of those
   necessary for token creation to work with the AFS version of
   rlogind.

   For security's sake, use the AFS  version  of  rcp  only  in
   conjunction  with  PAGs,  either by using the AFS version of
   login or always issuing pagsh before obtaining tokens.

REQUIREMENTS/RESTRICTIONS

   Several  configuration  requirements  and  restrictions  are
   necessary  for  token passing to work correctly with the AFS
   version of rcp.  Some of these are also necessary  with  the
   standard  UNIX  version,  but  are included here because the
   issuer accustomed to AFS protections may not consider  them.
   There  may be other UNIX-based requirements/restrictions not
   mentioned  here;  consult  the  UNIX  manual  page.     (One
   important  one  is  that  no stty commands may appear in the
   issuer's shell initialization file, such as .cshrc.)

   The requirements/restrictions for token passing include  the
   following.

      - The  local machine must be running the AFS version
        of rcp, with the rcp binary file locally installed
        to grant setuid privilege to the owner, "root".

      - The remote machine must be running the AFS version
        of inetd.

      - The  following  two  lines  must  appear  in   the
        /etc/services  file  on the local machine (as well
        as on the remote machine running modified  inetd).
        On  NeXT machines, this information must appear in
        the NetInfo database rather than in /etc/services.

           auth 113/tcp authentication
           ta-rauth 601/tcp rauth

      - If rcp is to consult an .rhosts file on the remote
        machine,  the  file  must have UNIX protections no
        more liberal than -rw-r--r--.  If .rhosts  resides
        in   a  user  home  directory  in  AFS,  the  home
        directory must also  grant  the  LOOKUP  and  READ
        rights to system:anyuser.

ARGUMENTS

   Consult the UNIX manual page for rcp.

PRIVILEGE REQUIRED

   None.

MORE INFORMATION

   inetd (AFS version)

   UNIX manual page for rcp

   rlogind (AFS version)



   tokens
