As mentioned it was not the most secure decision. Perhaps I should metion that these were completely secured boxes and on an internal, network that was not accessable from outside. Also, even if someone had physically been able to gain access the contents of the machines were actually trivial enough not to worry us if someone did hack in.

I offer host.equiv only as a point of information, it is definitely too insecure to use on an exposed box. However, I want to clearify something: you only have the account equivalency that you transfer between machines, thus, <b>root</b> = <b>root</b>, but <b>ONLY root</b> = <b>root</b> so saying that you have root equivilancy is not exactly accurate. If you log in on a remote trusted machine as <b>user1</b> you can only be <b>user1</b> on the local machine so this method is not much more insure than using .rhost, except you don't have control of the exact accounts that are equivilent. In fact, it is very similar to trust between domains in a Windows network (host.equiv basically spells out a one-way trust in Windows terminology).

As for spoofing that is certainly a risk for any system and you should always have any server behind a properly setup firewall to avoid spoofing. If someone can hack through your firewall SSH can offer more protection. Again, the best solution is always the secure one such as SSH2.