1.\" Copyright (c) 1983, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)rcmd.3 8.1 (Berkeley) 6/4/93 33.\" 34.Dd June 4, 1993 35.Dt RCMD 3 36.Os BSD 4.2 37.Sh NAME 38.Nm rcmd , 39.Nm rresvport , 40.Nm iruserok , 41.Nm ruserok 42.Nd routines for returning a stream to a remote command 43.Sh SYNOPSIS 44.Fd #include <unistd.h> 45.Ft int 46.Fn rcmd "char **ahost" "int inport" "const char *locuser" "const char *remuser" "const char *cmd" "int *fd2p" 47.Ft int 48.Fn rresvport "int *port" 49.Ft int 50.Fn iruserok "u_long raddr" "int superuser" "const char *ruser" "const char *luser" 51.Ft int 52.Fn ruserok "const char *rhost" "int superuser" "const char *ruser" "const char *luser" 53.Sh DESCRIPTION 54The 55.Fn rcmd 56function 57is used by the super-user to execute a command on 58a remote machine using an authentication scheme based 59on reserved port numbers. 60The 61.Fn rresvport 62function 63returns a descriptor to a socket 64with an address in the privileged port space. 65The 66.Fn ruserok 67function 68is used by servers 69to authenticate clients requesting service with 70.Fn rcmd . 71All three functions are present in the same file and are used 72by the 73.Xr rshd 8 74server (among others). 75.Pp 76The 77.Fn rcmd 78function 79looks up the host 80.Fa *ahost 81using 82.Xr gethostbyname 3 , 83returning \-1 if the host does not exist. 84Otherwise 85.Fa *ahost 86is set to the standard name of the host 87and a connection is established to a server 88residing at the well-known Internet port 89.Fa inport . 90.Pp 91If the connection succeeds, 92a socket in the Internet domain of type 93.Dv SOCK_STREAM 94is returned to the caller, and given to the remote 95command as 96.Em stdin 97and 98.Em stdout . 99If 100.Fa fd2p 101is non-zero, then an auxiliary channel to a control 102process will be set up, and a descriptor for it will be placed 103in 104.Fa *fd2p . 105The control process will return diagnostic 106output from the command (unit 2) on this channel, and will also 107accept bytes on this channel as being 108.Tn UNIX 109signal numbers, to be 110forwarded to the process group of the command. 111If 112.Fa fd2p 113is 0, then the 114.Em stderr 115(unit 2 of the remote 116command) will be made the same as the 117.Em stdout 118and no 119provision is made for sending arbitrary signals to the remote process, 120although you may be able to get its attention by using out-of-band data. 121.Pp 122The protocol is described in detail in 123.Xr rshd 8 . 124.Pp 125The 126.Fn rresvport 127function is used to obtain a socket with a privileged 128address bound to it. This socket is suitable for use 129by 130.Fn rcmd 131and several other functions. Privileged Internet ports are those 132in the range 0 to 1023. Only the super-user 133is allowed to bind an address of this sort to a socket. 134.Pp 135The 136.Fn iruserok 137and 138.Fn ruserok 139functions take a remote host's IP address or name, as returned by the 140.Xr gethostbyname 3 141routines, two user names and a flag indicating whether the local user's 142name is that of the super-user. 143Then, if the user is 144.Em NOT 145the super-user, it checks the 146.Pa /etc/hosts.equiv 147file. 148If that lookup is not done, or is unsuccessful, the 149.Pa .rhosts 150in the local user's home directory is checked to see if the request for 151service is allowed. 152.Pp 153If this file does not exist, is not a regular file, is owned by anyone 154other than the user or the super-user, or is writeable by anyone other 155than the owner, the check automatically fails. 156Zero is returned if the machine name is listed in the 157.Dq Pa hosts.equiv 158file, or the host and remote user name are found in the 159.Dq Pa .rhosts 160file; otherwise 161.Fn iruserok 162and 163.Fn ruserok 164return \-1. 165If the local domain (as obtained from 166.Xr gethostname 2 ) 167is the same as the remote domain, only the machine name need be specified. 168.Pp 169The 170.Fn iruserok 171function is strongly preferred for security reasons. 172It requires trusting the local DNS at most, while the 173.Fn ruserok 174function requires trusting the entire DNS, which can be spoofed. 175.Sh DIAGNOSTICS 176The 177.Fn rcmd 178function 179returns a valid socket descriptor on success. 180It returns \-1 on error and prints a diagnostic message on the standard error. 181.Pp 182The 183.Fn rresvport 184function 185returns a valid, bound socket descriptor on success. 186It returns \-1 on error with the global value 187.Va errno 188set according to the reason for failure. 189The error code 190.Dv EAGAIN 191is overloaded to mean ``All network ports in use.'' 192.Sh SEE ALSO 193.Xr rlogin 1 , 194.Xr rsh 1 , 195.Xr intro 2 , 196.Xr rexec 3 , 197.Xr rexecd 8 , 198.Xr rlogind 8 , 199.Xr rshd 8 200.Sh HISTORY 201These 202functions appeared in 203.Bx 4.2 . 204