mark at exodus.net
Sun Oct 26 03:52:53 UTC 1997
That is not true. You don't need to have a local user configured on the
router in order to use rsh or rcp. It is only needed if you aren't doing
some type of remote authentication like tacacs. I would however suggest
that you avoid rsh family commands on your routers. If you do feel that it
is essential to use them make sure to use tacacs and aaa acounting to log
all command transactions. To not do so is to ask for trouble.
From: Jamie Rishaw <jamie at intuition.iagnet.net>
To: Todd R. Stroup <tstroup at fibernet.net>
Cc: cosmo at olywa.net; alex at nac.net; nanog at merit.edu
Date: Saturday, October 25, 1997 10:21 AM
Subject: Re: OK.
Todd R. Stroup wrote:
> Looking at the source for the looking-glass though it doesn't use the
> username option for rsh command. When useing the cisco command below
> don't you have to use the rsh username?
> ip rcmd remote-host www 22.214.171.124 nobody
> I changed the ip of the $ROUTER in lg.pl to
> "www\@ipaddress.of.router" instead of "ipaddress.of.router"
> which seems to work. I kept getting Permission Denied without it.
You need to make sure that in 'ip rcmd' that you have local-username
defined to something that there is a 'username xxx' entry on the cisco
In other words, if you have (sorry syntax is probably not correct):
ip rcmd remote-host joebob lookingglass.yourcompany.com daemon enable
you have to have a
'username joebob' entry on the cisco as well.
local-username means "apply the permissions of local-username when this
and remote-username is the userid of whatever your cgi-bin runs as.. if
web server is setuid "daemon" and cgi-bins are daemon, it will only work
if you have 'daemon' as a remote-username in the ip rcmd command.
jamie g.k. rishaw dal/efnet:gavroche __ IAGnet/CICNet/netILLINOIS
DID:216.902.5455 FAX:216.623.3566 \/ 800.637.4IAGx5455
"It's like im being tied to the hood of a yellow rental truck being packed
with fertilizer and fuel oil.. pushed over a cliff by a suicidal mickey
More information about the NANOG