Am I misunderstanding the security implications of rlogin?

My understanding was :

two boxes (ALPHA + BETA), say UNIX type OSes with the same account FRED on both. Different passwords, no connections restrictions, rlogin daemon is running.

ALPHA : rlogin BETA
Welcome to BETA

No password required to rlogin to the BETA box.

Well I tried this from Solaris 2.6 to HP-UX 10.11 (I think) and the box I was going to asked for a password. We even set the accounts to have the same password on both boxes and it still asked for a password.

Have HP (or any others) cleaned up the 'r' commands in some way - I've been preaching that all 'r' commands are evil but if we are asked for a password from box to box what is the problem (besides clear text going over the network)???

Matt





_______________________________________________________________________
FSmail - Get your free web-based email from Freeserve: www.fsmail.net





-- 
Gllug mailing list  -  Gllug@linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug


