---
name: "krsh"
section: "1"
platform: "linux"
package: "heimdal-clients"
version: "1.6~git20120403+dfsg1-2"
release: "Debian 7 (Wheezy)"
platforms: ["linux"]
url: "https://new.carta.tech/krsh"
---

# krsh(1)

remote shell

## NAME

**rsh** – remote shell

## SYNOPSIS

**rsh** \[**-45FGKdefnuxz**\] \[**-U** *string*\] \[**-p** *port*\] \[**-l** *username*\] \[**-P** *N\|O*\] *host* *\[command\]*

## DESCRIPTION

**rsh** authenticates to the [rshd(8)](/rshd/8.md) daemon on the remote *host*, and then executes the specified *command*.

**rsh** copies its standard input to the remote command, and the standard output and error of the remote command to its own.

Valid options are:

-

  **-4**, **-****-krb4** The **-4** option requests Kerberos 4 authentication. Normally all supported authentication mechanisms will be tried, but in some cases more explicit control is desired.

-

  **-5**, **-****-krb5** The **-5** option requests Kerberos 5 authentication. This is analogous to the **-4** option.

-

  **-K**, **-****-broken** The **-K** option turns off all Kerberos authentication. The security in this mode relies on reserved ports. The long name is an indication of how good this is.

-

  **-n**, **-****-no-input** The **-n** option directs the input from the */dev/null* device (see the BUGS section of this manual page).

- **-d**

  Enable [setsockopt(2)](/setsockopt/2.md) socket debugging.

-

  **-e**, **-****-no-stderr** Don't use a separate socket for the stderr stream. This can be necessary if rsh-ing through a NAT bridge.

-

  **-x**, **-****-encrypt** The **-x** option enables encryption for all data exchange. This is only valid for Kerberos authenticated connections (see the BUGS section for limitations).

-

  **-z** The opposite of **-x**. This is the default, and is mainly useful if encryption has been enabled by default, for instance in the appdefaults section of */etc/krb5.conf* when using Kerberos 5.

-

  **-f**, **-****-forward** Forward Kerberos 5 credentials to the remote host. Also settable via appdefaults (see krb5.conf).

-

  **-F**, **-****-forwardable** Make the forwarded credentials re-forwardable. Also settable via appdefaults (see krb5.conf).

-

  **-l** *string*, **-****-user=***string* By default the remote username is the same as the local. The **-l** option or the *username@host* format allow the remote name to be specified.

-

  **-n**, **-****-no-input** Direct input from */dev/null* (see the BUGS section).

-

  **-p** *number-or-service*, **-****-port=***number-or-service* Connect to this port instead of the default (which is 514 when using old port based authentication, 544 for Kerberos 5 and non-encrypted Kerberos 4, and 545 for encrytpted Kerberos 4; subject of course to the contents of */etc/services*).

-

  **-P** *N\|O\|1\|2*, **-****-protocol=***N\|O\|1\|2* Specifies the protocol version to use with Kerberos 5. *N* and *2* select protocol version 2, while *O* and *1* select version 1. Version 2 is believed to be more secure, and is the default. Unless asked for a specific version, **rsh** will try both.  This behaviour may change in the future.

-

  **-u**, **-****-unique** Make sure the remote credentials cache is unique, that is, don't reuse any existing cache. Mutually exclusive to **-U**.

-

  **-U** *string*, **-****-tkfile=***string* Name of the remote credentials cache. Mutually exclusive to **-u**.

-

  **-x**, **-****-encrypt** The **-x** option enables encryption for all data exchange. This is only valid for Kerberos authenticated connections (see the BUGS section for limitations).

- **-z**

  The opposite of **-x**. This is the default, but encryption can be enabled when using Kerberos 5, by setting the libdefaults/encrypt option in [krb5.conf(5)](/krb5.conf/5.md).

## EXAMPLES

Care should be taken when issuing commands containing shell meta characters. Without quoting, these will be expanded on the local machine.

The following command:

```
rsh otherhost cat remotefile localfile
```

will write the contents of the remote *remotefile* to the local *localfile*, but:

```
rsh otherhost 'cat remotefile remotefile2'
```

will write it to the remote *remotefile2*.

## FILES

- */etc/hosts*

  ## SEE ALSO

[ktelnet(1)](/ktelnet/1.md), [krb\_realmofhost(3)](/krb_realmofhost/3.md), [krb\_sendauth(3)](/krb_sendauth/3.md), [hosts.equiv(5)](/hosts.equiv/5.md), [krb5.conf(5)](/krb5.conf/5.md), [rhosts(5)](/rhosts/5.md), [kerberos(8)](/kerberos/8.md) [rshd(8)](/rshd/8.md)

## HISTORY

The **rsh** command appeared in 4.2BSD.

## AUTHORS

This implementation of **rsh** was written as part of the Heimdal Kerberos 5 implementation.

## BUGS

Some shells (notably [csh(1)](/csh/1.md)) will cause **rsh** to block if run in the background, unless the standard input is directed away from the terminal. This is what the **-n** option is for.

The **-x** options enables encryption for the session, but for both Kerberos 4 and 5 the actual command is sent unencrypted, so you should not send any secret information in the command line (which is probably a bad idea anyway, since the command line can usually be read with tools like [ps(1)](/ps/1.md)). Forthermore in Kerberos 4 the command is not even integrity protected, so anyone with the right tools can modify the command.