Legacy Remote Access

Many UNIX operations include

Conceptually, because these services that, when combined with services are built on mutual trust, Network File System (NFS) and they can be misused to obtain Network Information Service (NIS), access and to horizontally and provide users with seamless remote vertically escalate privileges in an access and work capabilities. attack.

However, they also form a risky combination if not configured and managed properly.

These services include the following:

• Telnet

Their authentication and transmission capabilities are unsecure by design; therefore, they must be retrofitted (as X11) or replaced altogether (Telnet and remote login by SSH).

• Remote login (rlogin)
• Window System (X11)
• Remote Copy (rcp)
• Remote Shell (rsh)
• Secure Shell (ssh)

Telnet is a command-line protocol designed to give command-line access to another host. Although implementations for Windows exist, Telnet's original domain was the UNIX server world. In fact, a Telnet server is standard equipment for any UNIX server. (Whether it should be enabled is another question entirely, but in small LAN environments, Telnet is still widely used.)

Unfortunately, the protocol has significant limitations:

• Individual characters are sent and echoed between the hosts. This allows attackers to monitor sessions with relatively simple methods.
• It is limited to username/password authentication.
• It does not offer encryption.

The rlogin, rsh, and rap protocols evolved out of early UNIX environments, and while they perform different functions, they exhibit many of the same vulnerabilities.

In its most generic form, rlogin is a protocol used for granting remote access to a machine, normally a UNIX server. Similarly, rsh grants direct remote command execution, while rcp copies data from or to a remote machine.

If an rlogin daemon (rlogind) is running on a machine, rlogin access can be granted in two ways:

• Using a central configuration file, or
• Through a user configuration.

Once an attacker has obtained even a lowlevel user's credentials, they have a trivial path toward privilege escalation because they can transfer data to and from a machine, as well as execute commands. As the Telnet server is running under system privileges, it is an attractive target of attack in itself; exploits in Telnet servers pave the way to system privileges for an attacker. Therefore, it is recommended that security professionals discontinue the use of Telnet over the internet and on internet-facing machines. In fact, the standard hardening procedure for any internet-facing server should include disabling its Telnet service that, under UNIX systems, would normally run under the name of "telnetd," and use

SSHv2 for remote administration and management where required.

However, the latter method presents an unintended weakness. A user may grant access through the user configuration file that was not permitted by the system administrator. The same mechanism applies to rsh and rcp, although they rely on a different daemon (rshd). Authentication can be considered host/IP address-based. Although rlogin grants access based on user ID, it is not verified (i.e., the ID a remote client claims to possess is taken for granted if the request comes from a trusted host). The rlogin protocol transmits data without encryption and, hence, is subject to eavesdropping and interception.

The rlogin protocol is of limited value-its main benefit can be considered its main drawback: remote access without supplying a password. It should only be used in trusted networks, if at all. A more secure replacement is available in the form of SSHv2 for rlogin, rsh, and rop.