---
name: "rlogin-gw"
section: "8"
platform: "linux"
package: "fwtk"
version: "1.3-1"
release: "Debian 1.3 (Bo)"
platforms: ["linux"]
url: "https://new.carta.tech/rlogin-gw"
---

# rlogin-gw(8)

rlogin proxy server

## NAME

rlogin-gw - rlogin proxy server

## SYNOPSIS

**rlogin-gw** \[invoked from inetd\]

## DESCRIPTION

**rlogin-gw** provides pass-through rlogin proxy services with logging and access control. When **rlogin-gw** is invoked from **[inetd(8)](/inetd/8.md),** it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it shuts down with a message and logs the connection. If the peer is permitted to use the proxy, **rlogin-gw** checks the username that is provided as part of the *rlogin* protocol, and if it is of the form of *user@host* an attempt will be made to reconnect to the host and log in as that user. If no host is specified, **rlogin-gw** enters a command loop in which it awaits for a user to specify  a) the system to which they wish to connect, b) the X-gateway they wish to invoke (see man page **x-gw** for details).

## OPTIONS

**rlogin-gw** reads its configuration rules and permissions information from the firewall configuration table **netperm-table,** retrieving all rules specified for "rlogin-gw". The following configuration rules are recognized:

- **directory pathname**

  specifies a directory to which **rlogin-gw** will [chroot(2)](/chroot/2.md) prior to providing service.

- **prompt string**

  specifies a prompt for **rlogin-gw** to use while it is in command mode.

- **timeout seconds**

  specifies the number of seconds of idleness after which the proxy should disconnect. Default is no timeout.

- **denial-msg filename**

  specifies the name of a file to display to the remote user if they are denied permission to use the proxy. If this option is not set, a default message is generated.

- **help-msg filename**

  specifies the name of a file to display if the "help" command is issued. If this option is not set, a listing of the internal commands is printed.

- **denydest-msg filename**

  specifies the name of a file to display if a user attempts to connect to a remote server that they are not permitted to. If this option is not set, a default message is generated.

- **authserver hostname \[portnumber \[cipherkey\]\]**

  specifies the name or address of a system to use for network authentication. If **rlogin-gw** is built with a compiled-in value for the server and port, they will be used as defaults but can be overridden if specified as above. If support for DES-encryption of traffic is present in the server, an optional cipherkey can be provided, to secure communications with the server.

- **hosts host-pattern \[host-pattern2...\] \[options\]**

  rules specify host and access permissions. Typically, a hosts rule will be in the form of:

  rlogin-gw:	deny-hosts unknown rlogin-gw:	hosts 192.33.112.\* 192.94.214.\*

  There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Sub-options are:

-

  **-dest pattern**\
   **-dest { pattern1 pattern2 ... }**\
   specifies a list of valid destinations. If no list is specified, all destinations are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

  ```
  -dest !*.mit.edu -dest *
  ```

  will permit hosts that are not in the domain "mit.edu" to be connected to.

-

  **-auth**\
   specifies that the proxy should require a user to authenticate with a valid user-id prior to being permitted to use the gateway.

-

  **-passok**\
   specifies that the proxy should permit users to change their passwords if they are connected from the designated host. Only hosts on a trusted network should be permitted to change passwords, unless token-type authenticators are distributed to all users.

-

  ## INSTALLATION

To install **rlogin-gw** first place the executable in a system area, then modify **[inetd.conf(5)](/inetd.conf/5.md)** to reflect the appropriate executable path. The rlogin proxy must be installed on the rlogin port (port 513) in order to function without requiring modified clients. Verify installation by attempting a connection, and monitoring the system logs.

## FILES

- **/etc/inetd.conf**

  **netperm-table**

## SEE ALSO

[**netperm-table**(5)](/netperm-table/5.md) [**inetd**(8)](/inetd/8.md) [**authsrv**(8)](/authsrv/8.md) [**x-gw**(8)](/x-gw/8.md)

## BUGS