UNIX for Dummies Questions & Answers

I would like to remove rsh, rcp, rlogin from my production server.

How would i go about it?
Should i remove them from their original location using rm?
Will that impact on any other functionality?

---------- Post updated at 12:39 AM ---------- Previous update was at 12:16 AM ----------

Mine is rpm based distribution.

But i could not able to find rpm for rcp and rlogin.

Code:

# rpm -qa | grep -i rsh
rsh-0.17-38.el5
# rpm -qa | grep -i rcp
# rpm -qa | grep -i rlogin

Distribution Details.

Code:

# lsb_release -a
LSB Version:    :core-3.1-ia32:core-3.1-noarch:graphics-3.1-ia32:graphics-3.1-noarch
Distributor ID: OracleVMserver
Description:    Oracle VM server release 2.2.0
Release:        2.2.0
Codename:       n/a

Code:

# uname -a
Linux OFSMUW-VS-61 2.6.18-128.2.1.4.9.el5xen #1 SMP Fri Oct 9 14:57:31 EDT 2009 i686 i686 i386 GNU/Linux

Code:

rpm -qf `which rcp
rpm -qf `which rlogin`

(please note they are backquotes, not normal single quotes) should tell you which rpm they are in.

From above methods i have noted down some methods of removing the command but i m yet confused which method should i follow.

As i m using it for my blog i have written it considering my blog in mind please help me evaluating the best one considering it wont affect other functionality.

It is highly recommended to remove following command on production server .
There are several ways of not using the command choose one that is suitable for your need.

Method 1:

Just try to find the rpm for the above command.
This can be done using.

Code:

rpm -qa | grep -i rsh
rsh-0.17-38.el5
rpm -qa | grep -i rcp
rpm -qa | grep -i rlogin

As you can see only first command return any output.

We need to further see what command rsh-0.17-38.el5 contains.

This can be done using

Code:

# rpm -ql rsh-0.17-38.el5
/usr/bin/rcp
/usr/bin/rexec
/usr/bin/rlogin
/usr/bin/rsh
/usr/share/man/man1/rcp.1.gz
/usr/share/man/man1/rexec.1.gz
/usr/share/man/man1/rlogin.1.gz
/usr/share/man/man1/rsh.1.gz

From the output you can assume that by uninstalling the rpm you can achieve the removal of those command from production server.


Method 2:

Change the file permisisons:

(First check the location of command using which command name.Below examples are given considering the commands are located under /usr/bin/rcp This could be different for different Linux Distributions.)

Code:

chmod 000 /usr/bin/rcp

chmod 000 /usr/bin/rsh

chmod 000 /usr/bin/rlogin

Method 3:

just remove execute bit of the command using.


(First check the location of command using which command name.Below examples are given considering the commands are located under /usr/bin/rcp This could be different for different Linux Distributions.)

Code:

chmod -x /usr/bin/rcp

chmod -x /usr/bin/rsh

chmod -x /usr/bin/rlogin

Method 4:

Remove the command itself using.

Code:

rm -rf `which rcp`
rpm -rf `which rlogin`
rpm -rf `which rsh`

With the chmod you should remove execute permission for everyone:

Code:

chmod a-x /usr/bin/{rcp,rsh,rlogin}

I think all of your options are valid "fixes" to your problem (except method 4 that doesnt work - that simply tells you what packages the binaries are part of). I also think it always pays to think intuitively about what other admins may do. Personally, as the rpm only contains rsh, rcp & rlogin, I would chose to uninstall the package. Admins will often use rpm to validate the install of packages, so if you choose to chmod the binaries this would be flagged in the verification, and someone may unwittingly re-chmod them back to their original values.

Another very valid way of limiting the commands is to simply add them to the firewall definition, and in that way you will not affect the installation of the commands, but would stop them working.

Just my thoughts....

Edited the content .
What if some other rpm has dependencies on this rpm .
For example the rpm contains the command for rsh,rcp,rlogin and rexec .Here rexec is command which i dont want to remove but rest 3.
If someother rpm is using rexec for their functioning ,removing rpm will result in disaster for rpm which is dependent on them.

Just a thought correct me if i m wrong.

---------- Post updated at 04:39 AM ---------- Previous update was at 04:38 AM ----------

If other packages depend upon rsh/rcp/rlogin then RPM will tell you so when you try to uninstall it, so that is not really an issue.

In reality I don't think you should be trusting any software that depends upon rsh/rcp/rlogin as they are inherently insecure protocols, and packages should now be using protocols such as ssh/ssl to enable their communications functionality.

I hope this helps.

I do not know which operating system you are using and chances are that I'm not that well accustomed to whatever you use. But there are some general principles which pay off if adhered to:

1) Do not - never ever - remove binaries by deleting them, as was suggested by citaylor. If you have a package management (like the mentioned rpm) use ONLY that to get software packages you do not want to be used out of the system.

2) Every Unix has a standard set of commands and rsh (rlogin, rexec, ...) are such standard commands. You might not want them to be used without further ado, but deleting them is the wrong way to accomplish what you want. Remove ".rlogin"-files (and probably similar ones, like ".netrc") from user-homes (to make password-less access to systems impossible), deactivate the respective services in inetd.conf or employ similar methods.

3) Modifying the rights of executables is a possible way, but be aware, that you modify the system - like with removing the executables altogether. If you still want to go that way you might want to create an rpm-package which does the changes and only bring this to the system - the package should undo these changes upon deinstallation of course.

I hope this helps.

bakunin