Shadow Passwords; Using Rlogin, Rsh, And Rexec With Pam - Red Hat LINUX 7.2 Reference Manual

Section 7.4:Using rlogin, rsh, and rexec with PAM
Fifth, if pam_rhosts_auth.so has failed to authenticate the user, the pam_stack.so module
performs normal password authentication, and is passed the service=system-auth argument.
If you do not want to prompt for a password when the securetty check
fails and determines that the user is trying to login as root remotely, you can
change the pam_securetty.so module from required to requi-
site. Alternatively, if you want to allow root logins remotely (which is not
a good idea), you can comment out this line.

7.3 Shadow Passwords

If you are using shadow passwords, pam_unix.so will automatically detect that they are in use and
will use them to authenticate users.
Please refer to Official Red Hat Linux Customization Guide for more information on shadow pass-
words.

7.4 Using rlogin, rsh, and rexec with PAM

For security reasons, rexec, rsh, and rlogin are not enabled by default in Red Hat Linux 7.2.
You should use the OpenSSH suite of tools instead. Information concerning the OpenSSH tools can
be found in Chapter 10, SSH Protocol and the Official Red Hat Linux Customization Guide.
If you must use rexec, rsh, and rlogin, and if you need to use them as root, you will need to make
a few modifications to the /etc/securetty file. All three of these tools have PAM configuration
files that require the pam_securetty.so PAM module, so you must edit /etc/securetty to
allow root access.
Before you can log in as root using these tools, you first have to have them properly set up. First,
install the rsh-server RPM, which is included with Red Hat Linux 7.2. See the Official Red Hat
Linux Customization Guide if you need assistance using RPM.
Next, run serviceconf and enable rexec, rsh, and rlogin. See the serviceconf man page
if you need help using this tool.
Finally, restart xinetd with /sbin/service xinetd restart to activate the service-
conf changes. At this point, all users except root will be able to use rexec, rsh, and rlogin.
To allow root to use these tools, add the names of the tools you wish to allow to the /etc/se-
curetty. If you wanted to enable root login using rexec, rsh, and rlogin, add the following
lines to /etc/securetty:
Note
137