Mark Tripod mark at exodus.net
Sun Oct 26 03:52:53 UTC 1997

That is not true. You don't need to have a local user configured on the
router in order to use rsh or rcp. It is only needed if you aren't doing
some type of remote authentication like tacacs. I would however suggest
that you avoid rsh family commands on your routers. If you do feel that it
is essential to use them make sure to use tacacs and aaa acounting to log
all command transactions. To not do so is to ask for trouble.

Mark Tripod
Exodus Communications
From: Jamie Rishaw <jamie at intuition.iagnet.net>
To: Todd R. Stroup <tstroup at fibernet.net>
Cc: cosmo at olywa.net; alex at nac.net; nanog at merit.edu
Date: Saturday, October 25, 1997 10:21 AM
Subject: Re: OK.

Todd R. Stroup wrote:
> Looking at the source for the looking-glass though it doesn't use the
> username option for rsh command.  When useing the cisco command below
> don't you have to use the rsh username?
>  ip rcmd remote-host www nobody
> I changed the ip of the $ROUTER in lg.pl to
> "www\@ipaddress.of.router"  instead of "ipaddress.of.router"
> which seems to work.  I kept getting Permission Denied without it.

You need to make sure that in 'ip rcmd' that you have local-username
defined to something that there is a 'username xxx' entry on the cisco

In other words, if you have (sorry syntax is probably not correct):

ip rcmd remote-host joebob lookingglass.yourcompany.com daemon enable

you have to have a

'username joebob' entry on the cisco as well.

local-username means "apply the permissions of local-username when this

and remote-username is the userid of whatever your cgi-bin runs as.. if
web server is setuid "daemon" and cgi-bins are daemon, it will only work
if you have 'daemon' as a remote-username in the ip rcmd command.


jamie g.k. rishaw  dal/efnet:gavroche  __    IAGnet/CICNet/netILLINOIS
DID:216.902.5455 FAX:216.623.3566      \/            800.637.4IAGx5455
"It's like im being tied to the hood of a yellow rental truck being packed
with fertilizer and fuel oil.. pushed over a cliff by a suicidal mickey

More information about the NANOG mailing list