source: heimdal/trunk/appl/rsh/rsh.cat1@ 4

Last change on this file since 4 was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 6.2 KB
Line 
1
2RSH(1) BSD General Commands Manual RSH(1)
3
4NNAAMMEE
5 rrsshh -- remote shell
6
7SSYYNNOOPPSSIISS
8 rrsshh [--4455FFGGKKddeeffnnuuxxzz] [--UU _s_t_r_i_n_g] [--pp _p_o_r_t] [--ll _u_s_e_r_n_a_m_e] [--PP _N_|_O] _h_o_s_t
9 _[_c_o_m_m_a_n_d_]
10
11DDEESSCCRRIIPPTTIIOONN
12 rrsshh authenticates to the rshd(8) daemon on the remote _h_o_s_t, and then exe-
13 cutes the specified _c_o_m_m_a_n_d.
14
15 rrsshh copies its standard input to the remote command, and the standard
16 output and error of the remote command to its own.
17
18 Valid options are:
19
20 --44, ----kkrrbb44
21 The --44 option requests Kerberos 4 authentication. Normally all
22 supported authentication mechanisms will be tried, but in some
23 cases more explicit control is desired.
24
25 --55, ----kkrrbb55
26 The --55 option requests Kerberos 5 authentication. This is analo-
27 gous to the --44 option.
28
29 --KK, ----bbrrookkeenn
30 The --KK option turns off all Kerberos authentication. The security
31 in this mode relies on reserved ports. The long name is an indi-
32 cation of how good this is.
33
34 --nn, ----nnoo--iinnppuutt
35 The --nn option directs the input from the _/_d_e_v_/_n_u_l_l device (see
36 the _B_U_G_S section of this manual page).
37
38 --dd Enable setsockopt(2) socket debugging.
39
40 --ee, ----nnoo--ssttddeerrrr
41 Don't use a separate socket for the stderr stream. This can be
42 necessary if rsh-ing through a NAT bridge.
43
44 --xx, ----eennccrryypptt
45 The --xx option enables encryption for all data exchange. This is
46 only valid for Kerberos authenticated connections (see the _B_U_G_S
47 section for limitations).
48
49 --zz The opposite of --xx. This is the default, and is mainly useful if
50 encryption has been enabled by default, for instance in the
51 appdefaults section of _/_e_t_c_/_k_r_b_5_._c_o_n_f when using Kerberos 5.
52
53 --ff, ----ffoorrwwaarrdd
54 Forward Kerberos 5 credentials to the remote host. Also settable
55 via appdefaults (see krb5.conf).
56
57 --FF, ----ffoorrwwaarrddaabbllee
58 Make the forwarded credentials re-forwardable. Also settable via
59 appdefaults (see krb5.conf).
60
61 --ll _s_t_r_i_n_g, ----uusseerr==_s_t_r_i_n_g
62 By default the remote username is the same as the local. The --ll
63 option or the _u_s_e_r_n_a_m_e_@_h_o_s_t format allow the remote name to be
64 specified.
65
66 --nn, ----nnoo--iinnppuutt
67 Direct input from _/_d_e_v_/_n_u_l_l (see the _B_U_G_S section).
68
69 --pp _n_u_m_b_e_r_-_o_r_-_s_e_r_v_i_c_e, ----ppoorrtt==_n_u_m_b_e_r_-_o_r_-_s_e_r_v_i_c_e
70 Connect to this port instead of the default (which is 514 when
71 using old port based authentication, 544 for Kerberos 5 and non-
72 encrypted Kerberos 4, and 545 for encrytpted Kerberos 4; subject
73 of course to the contents of _/_e_t_c_/_s_e_r_v_i_c_e_s).
74
75 --PP _N_|_O_|_1_|_2, ----pprroottooccooll==_N_|_O_|_1_|_2
76 Specifies the protocol version to use with Kerberos 5. _N and _2
77 select protocol version 2, while _O and _1 select version 1. Ver-
78 sion 2 is believed to be more secure, and is the default. Unless
79 asked for a specific version, rrsshh will try both. This behaviour
80 may change in the future.
81
82 --uu, ----uunniiqquuee
83 Make sure the remote credentials cache is unique, that is, don't
84 reuse any existing cache. Mutually exclusive to --UU.
85
86 --UU _s_t_r_i_n_g, ----ttkkffiillee==_s_t_r_i_n_g
87 Name of the remote credentials cache. Mutually exclusive to --uu.
88
89 --xx, ----eennccrryypptt
90 The --xx option enables encryption for all data exchange. This is
91 only valid for Kerberos authenticated connections (see the _B_U_G_S
92 section for limitations).
93
94 --zz The opposite of --xx. This is the default, but encryption can be
95 enabled when using Kerberos 5, by setting the libdefaults/encrypt
96 option in krb5.conf(5).
97
98EEXXAAMMPPLLEESS
99 Care should be taken when issuing commands containing shell meta charac-
100 ters. Without quoting, these will be expanded on the local machine.
101
102 The following command:
103
104 rsh otherhost cat remotefile > localfile
105
106 will write the contents of the remote _r_e_m_o_t_e_f_i_l_e to the local _l_o_c_a_l_f_i_l_e,
107 but:
108
109 rsh otherhost 'cat remotefile > remotefile2'
110
111 will write it to the remote _r_e_m_o_t_e_f_i_l_e_2.
112
113FFIILLEESS
114 /etc/hosts
115
116SSEEEE AALLSSOO
117 rlogin(1), krb_realmofhost(3), krb_sendauth(3), hosts.equiv(5),
118 krb5.conf(5), rhosts(5), kerberos(8) rshd(8)
119
120HHIISSTTOORRYY
121 The rrsshh command appeared in 4.2BSD.
122
123AAUUTTHHOORRSS
124 This implementation of rrsshh was written as part of the Heimdal Kerberos 5
125 implementation.
126
127BBUUGGSS
128 Some shells (notably csh(1)) will cause rrsshh to block if run in the back-
129 ground, unless the standard input is directed away from the terminal.
130 This is what the --nn option is for.
131
132 The --xx options enables encryption for the session, but for both Kerberos
133 4 and 5 the actual command is sent unencrypted, so you should not send
134 any secret information in the command line (which is probably a bad idea
135 anyway, since the command line can usually be read with tools like
136 ps(1)). Forthermore in Kerberos 4 the command is not even integrity pro-
137 tected, so anyone with the right tools can modify the command.
138
139HEIMDAL February 20, 2004 HEIMDAL
Note: See TracBrowser for help on using the repository browser.