rexecd(1M)                     TCP/IP 5.4R3.00                    rexecd(1M)


NAME
       rexecd - remote execution server

SYNOPSIS
       /usr/bin/rexecd

DESCRIPTION
       The rexecd server is for the rexec(3X) routine.  The server provides
       remote execution facilities with authentication based on usernames
       and encrypted passwords.

       The rexecd server is invoked by the inetd server when an incoming
       connection is detected on the port specified in /etc/services.  See
       inetd(1M) and services(1M) for details.  When a service request is
       received, inetd invokes rexecd and the following protocol is
       initiated:

       1)     The server reads characters from the socket up to a null
              (`\0') byte.  The resultant string is interpreted as an ASCII
              number, base 10.

       2)     If the number received in step 1 is nonzero, it is interpreted
              as the port number of a secondary stream to be used for the
              stderr.  A second connection is then created to the specified
              port on the client's machine.

       3)     A null-terminated username of at most 16 characters is
              retrieved on the initial socket.

       4)     A null-terminated encrypted password of at most 16 characters
              is retrieved on the initial socket.

       5)     A null-terminated command to be passed to a shell is retrieved
              on the initial socket.  The length of the command is limited
              by the upper bound on the size of the system's argument list.

       6)     The rexecd server then validates the user as is done at login
              time and, if the authentication was successful, changes to the
              user's home directory and establishes the user and group
              protections of the user.  The default path is /usr/bin.  If
              any of these steps fails, the connection is aborted and a
              diagnostic message is returned.

       7)     A null byte is returned on the connection associated with the
              stderr, and the command line is passed to the normal login
              shell of the user.  The shell inherits the network connections
              established by rexecd.

DIAGNOSTICS
       All diagnostic messages are returned on the connection associated
       with the stderr, after which any network connections are closed.  An
       error is indicated by a leading byte with a value of 1 (0 is returned
       in step 7 above upon successful completion of all the steps prior to
       the command execution).



Licensed material--property of copyright holder(s)                         1

rexecd(1M)                     TCP/IP 5.4R3.00                    rexecd(1M)


       username too long        The name is longer than 16 characters.

       password too long        The password is longer than 16 characters.

       command too long         The command line passed exceeds the size of
                                the argument list (as configured into the
                                system).

       Login incorrect          No password file entry exists for the
                                username.

       Password incorrect       The wrong password was supplied.

       No remote directory      The chdir command to the home directory
                                failed.

       Try again                A fork by the server failed.

       /bin/sh: ...             The user's login shell could not be started.

SEE ALSO
       inetd(1M), rexec(3X), services(1M).

BUGS
       Indicating Login incorrect instead of Password incorrect is a
       security breach that allows people to probe a system for users with
       null passwords.






























Licensed material--property of copyright holder(s)                         2