# Administration Reference

## rcp (AFS version)

Purpose

Copies a file on a remote machine

Synopsis

    rcp [-p]  <file1>  <file2>

    rcp [-r]  [-p]  <file>+  <directory>

Description

The AFS-modified rcp program functions like the standard UNIX rcp program, but also passes the issuer's AFS token to the remote machine's Cache Manager, to enable authenticated access to the AFS filespace via that machine.

Token passing is most effective if both the remote machine and local machine belong to the same cell, because the rcp command can pass only one token even if the user has several tokens--it passes the token listed first in the output from the tokens command. If the remote and local machine do not belong to the same cell, the possibilities are as follows:

- The passed token is for the remote machine's cell. The issuer accesses the remote cell's AFS file tree as an authenticated AFS user, but is considered anonymous in the local cell and so can exercise only the access rights granted to the system:anyuser group there. For example, to copy a file into a local AFS directory from the remote cell, the directory's ACL must grant the l (lookup) and i (insert) permissions to the system:anyuser group.

- The passed token is for the local machine's cell. The issuer accesses the remote cell's AFS file tree as anonymous, and so can only exercise the access rights granted to the system:anyuser group.

In addition to running the AFS version of the rcp binary on the machine where the rcp command is issued, other configuration changes are necessary for token passing to work properly. See the Cautions section for a list.

The AFS version of the rcp command is compatible with the standard inetd command, but token passing works only if both programs are modified to handle AFS tokens. If only one of them is modified, the issuer accesses the AFS filespace through the remote machine as the anonymous user.

Cautions

The AFS distribution does not include an AFS-modified version of this command for every system type, in some cases because the operating system vendor has already modified the standard version in the required way. For details, see the IBM AFS Release Notes.

The AFS rcp command does not allow third party copies, in which neither the source file nor the target file is stored on the machine where the command is issued. The standard UNIX rcp command claims to provide this functionality.

For security's sake, use the AFS version of the rcp command only in conjunction with PAGs, either by using an AFS-modified login utility, issuing the pagsh command before obtaining tokens, or including the -setpag flag to the klog command.

Several configuration requirements and restrictions are necessary for token passing to work correctly with an AFS-modified version of the rcp command. Some of these are also necessary with the standard UNIX version, but are included here because the issuer accustomed to AFS protections is possibly unlikely to consider them. There are possibly other UNIX-based requirements and restrictions not mentioned here; consult the UNIX manual page. (One important one is that no `stty` commands can appear in the issuer's shell initialization file, such as the .cshrc file.)

The requirements and restrictions for token passing include the following.

- The local machine must be running the AFS version of the rcp command, with the rcp binary file locally installed to grant setuid privilege to the owner, the local superuser root.

- The remote machine must be running the AFS version of the inetd program.

- If the rcp command is to consult a .rhosts file on the remote machine, the file must have UNIX protections no more liberal than -rw-r--r--. If the .rhosts file resides in a user home directory in AFS, the home directory must also grant the lookup (l) and read (r) permissions to the system:anyuser group.

Options

Consult the UNIX manual page for the rcp command.

Privilege Required

None

Related Information

inetd (AFS version)

tokens

UNIX manual page for rcp

IBM AFS Release Notes

© IBM Corporation 2000. All Rights Reserved