NAME
rlogin-gw - rlogin proxy server
SYNOPSIS
rlogin-gw [invoked from inetd]
DESCRIPTION
rlogin-gw provides pass-through rlogin proxy services with logging and access control. When rlogin-gw is invoked from inetd(8), it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it shuts down with a message and logs the connection. If the peer is permitted to use the proxy, rlogin-gw checks the username that is provided as part of the rlogin protocol, and if it is of the form of user@host an attempt will be made to reconnect to the host and log in as that user. If no host is specified, rlogin-gw enters a command loop in which it awaits for a user to specify a) the system to which they wish to connect, b) the X-gateway they wish to invoke (see man page x-gw for details).
OPTIONS
rlogin-gw reads its configuration rules and permissions information from the firewall configuration table netperm-table, retrieving all rules specified for "rlogin-gw". The following configuration rules are recognized:
- directory pathname
-
specifies a directory to which rlogin-gw will chroot(2) prior to providing service.
- prompt string
-
specifies a prompt for rlogin-gw to use while it is in command mode.
- timeout seconds
-
specifies the number of seconds of idleness after which the proxy should disconnect. Default is no timeout.
- denial-msg filename
-
specifies the name of a file to display to the remote user if they are denied permission to use the proxy. If this option is not set, a default message is generated.
- help-msg filename
-
specifies the name of a file to display if the "help" command is issued. If this option is not set, a listing of the internal commands is printed.
- denydest-msg filename
-
specifies the name of a file to display if a user attempts to connect to a remote server that they are not permitted to. If this option is not set, a default message is generated.
- authserver hostname [portnumber [cipherkey]]
-
specifies the name or address of a system to use for network authentication. If rlogin-gw is built with a compiled-in value for the server and port, they will be used as defaults but can be overridden if specified as above. If support for DES-encryption of traffic is present in the server, an optional cipherkey can be provided, to secure communications with the server.
- hosts host-pattern [host-pattern2...] [options]
-
rules specify host and access permissions. Typically, a hosts rule will be in the form of:
rlogin-gw: deny-hosts unknown rlogin-gw: hosts 192.33.112.* 192.94.214.*
There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Sub-options are:
-
-dest pattern
-dest { pattern1 pattern2 ... }
specifies a list of valid destinations. If no list is specified, all destinations are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:-dest !*.mit.edu -dest *
will permit hosts that are not in the domain "mit.edu" to be connected to.
-
-auth
specifies that the proxy should require a user to authenticate with a valid user-id prior to being permitted to use the gateway.
-
-passok
specifies that the proxy should permit users to change their passwords if they are connected from the designated host. Only hosts on a trusted network should be permitted to change passwords, unless token-type authenticators are distributed to all users.
INSTALLATION
To install rlogin-gw first place the executable in a system area, then modify inetd.conf(5) to reflect the appropriate executable path. The rlogin proxy must be installed on the rlogin port (port 513) in order to function without requiring modified clients. Verify installation by attempting a connection, and monitoring the system logs.
FILES
- /etc/inetd.conf
-
netperm-table