rsh frequence questions

Connection refused Tryinging krb4 rsh...

 

如果你用rsh時, 出現...

connect to address 192.168.1.1: Connection refused
Trying krb4 rsh...
connect to address 192.168.1.1: Connection refused
trying normal rsh (/usr/bin/rsh)

那是因為現在Server都裝了kerberos, 所以預設先去用/usr/kerberos/bin/rsh, 但是...
通常遠端設備沒那麼高檔, 就算是server可能也沒人設kerberos, 所以第一次try一定fail.

如果不想看到前面討人厭的錯誤訊息, 就請直接指定/usr/bin/rsh就ok了.

你看看

# which rsh

或

# echo $PATH
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin

你可以修改PATH. 改一下
/etc/profile.d/krb5.csh 或
/etc/profile.d/krb5.sh 中的PATH設定順序.

建立rsh互信登录

1.确认一下是不是安装了必须的rsh、rsh-server、xinetd

rpm -aq | grep 'rsh'

rpm -aq | grep 'rsh-server'

rpm -aq | grep 'xinetd'

如果没装的话，就需要安装，在安装光盘里都有他们的rpm包，rpm -ivh XXX.rpm 就可以安装了。

2.修改xinetd的配置文件

修改/etc/xinetd.d/rlogin /etc/xinetd.d/rexec /etc/xinetd.d/rsh三个文件，
把里面的
disable = yes
都改成
disable = no

3.编辑/etc/hosts.equiv

vi /etc/hosts.equiv

把服务器和节点机的机器名，或者ip地址写在里面，然后改变权限为600

chmod 600 /etc/hosts.equiv

4.重新启动xinetd

运行

/etc/init.d/xinetd restart

这时候rsh-server等进程就运行起来了。

上述设置服务器和节点机都要做

5.关闭防火墙

因为rsh走的是514端口，这个端口默认被防火墙封闭，所以要关闭防火墙这个设置在setup里面可以完成。

全部做完之后就可以rsh登录了。当然root不可以。
root需要在/root目录下生成一个.rhosts 文件，在里面写上所有的节点。然后再改成600权限。



rsh的配置如下：
文件/etc/hosts的内容：

# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
192.168.0.1 node1.oscarnode node1

文件/etc/hosts.equiv的内容：

127.0.0.1 root
192.168.0.1 node1
192.168.0.2 node2

文件/etc/hosts.allow的内容：

# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
ALL:ALLOW

文件/etc/hosts.deny的内容：

# hosts.deny This file describes the names of the hosts which are
# *not* allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow. In particular
# you should know that NFS uses portmap!

文件/etc/securetty的内容：

tty
rexec
rlogin
rsh
pts/0
pts/1

文件/root/.rhosts的内容：

127.0.0.1 localhost

/etc/inetd.d中所有文件的Disable = yes全改为Disable = no

/etc/pam.d中，文件rsh，rexec，rlogin的内容：

auth sufficient /lib/security/pam_nologin.so
#auth optional /lib/security/pam_securetty.so
auth sufficient /lib/security/pam_env.so
auth sufficient /lib/security/pam_rhosts_auth.so
account sufficient /lib/security/pam_stack.so service=system-auth
session sufficient /lib/security/pam_stack.so service=system-auth