SEO

#1 (**permalink**) 01-04-2008, 08:30 PM

Is any way to check if r-commands are used in the AIX? We are trying to
create a rule to stop using r-commands for security reasons. Will this be
worthwhile?

#2 (**permalink**) 01-04-2008, 08:30 PM

Sherman H. <shung1099@earthlink.net> wrote:
SH> Is any way to check if r-commands are used in the AIX? We are trying to
SH> create a rule to stop using r-commands for security reasons. Will this be
SH> worthwhile?

Your question is about general UNIX security, not AIX itself. You
should post to comp.unix.security. There you will hear about using
a port scanning system to audit the machines on your network.

Regards,

Nicholas

--
"Why shouldn't I top-post?" http://www.aglami.com/tpfaq.html
"Meanings are another story." http://www.ifas.org/wa/glossolalia.html

#3 (**permalink**) 01-04-2008, 08:30 PM

Sherman H. wrote:

> Is any way to check if r-commands are used in the AIX? We are trying to
> create a rule to stop using r-commands for security reasons. Will this be
> worthwhile?
>
>
there are a few ways.

- remove all the rexec ... entrys from /etc/inetd.conf (incomming requests)

- put an empty .rhosts (only root-changabe) into every users
homedirectory (I wouldn't do that)

- remove the x-bits from /usr/bin/rexec, rsh, rcp, ... (outgoing use).

you might want to have a look at

http://ist.uwaterloo.ca/security/howto/2001-01-15/

and

http://www.rootvg.net/count.php?url=...et/ssec.tar.gz

hth

kannix

--
----------------------------------------------------------------------------------------------------------------------
to reach me by mail, pls. remove "_usenet" from my adress. - kannix

#4 (**permalink**) 01-04-2008, 08:31 PM

"Sherman H." <shung1099@earthlink.net> wrote in message news:<ckJjb.47$aL5.46@newsread3.news.pas.earthlink .net>...
> Is any way to check if r-commands are used in the AIX? We are trying to
> create a rule to stop using r-commands for security reasons. Will this be
> worthwhile?

Always worthwhile to stop people using r-commands. No need to create
rules though.

If you are on the server (i.e. the system that people connect to with
r-commands) just comment the lines out of /etc/inetd.conf. If you are
on the client and want to prevent people using outbound r-commands,
just do a chmod 000 on the commands.

Iain.

#5 (**permalink**) 01-04-2008, 08:35 PM

Iain wrote:
>
> "Sherman H." <shung1099@earthlink.net> wrote in message news:<ckJjb.47$aL5.46@newsread3.news.pas.earthlink .net>...
> > Is any way to check if r-commands are used in the AIX? We are trying to
> > create a rule to stop using r-commands for security reasons. Will this be
> > worthwhile?
>
> Always worthwhile to stop people using r-commands. No need to create
> rules though.
>
> If you are on the server (i.e. the system that people connect to with
> r-commands) just comment the lines out of /etc/inetd.conf. If you are
> on the client and want to prevent people using outbound r-commands,
> just do a chmod 000 on the commands.
>
> Iain.

man securetcpip

#6 (**permalink**) 01-04-2008, 08:35 PM

kannix <werner.nixdorf_usenet@datev.de> wrote in message news:<3f8faccb$1@news.datev.de>...
> Sherman H. wrote:
>
> > Is any way to check if r-commands are used in the AIX? We are trying to
> > create a rule to stop using r-commands for security reasons. Will this be
> > worthwhile?
> >
> >
> there are a few ways.
>
> - remove all the rexec ... entrys from /etc/inetd.conf (incomming requests)
>
> - put an empty .rhosts (only root-changabe) into every users
> homedirectory (I wouldn't do that)
>
Wrong. Since home directory is writable for user, I'll just remove
your .rhosts and create my own. :P
Of cource you can use ACL, but it's a bit difficult and tricky.
First way is much better.
Best regards.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode