Subject: rexec_af

From: Mark Kettenis <[email-masked]>
Date: Sun, 23 Jan 2000 02:29:17 +0100 (CET)

Hi,

The current draft of the `Advanced Sockets API for IPv6'
(draft-ietf-ipngwg-2292bis-01.txt) includes a specification for
rexec_af().  The draft indicates that this specification is included
to ease the porting of legacy applications to IPv6.  However, IMHO
this is not a wise thing to do, since the rexec() interface is VERY
problematic:

The FreeBSD manual page says in the DESCRIPTION:

   This interface is obsoleted by rcmd(3).  It is available from the compat-
   ibility library, libcompat.

and further on in the BUGS section:

   The rexec() function sends the unencrypted password across the network.

   The underlying service is considered a big security hole and therefore
   not enabled on many sites, see rexecd(8) for explanations.

Another problem is the fact that there are some differences in
behaviour between the various rexec() implementations on different
platforms.  The draft says:

   This function behaves the same as the existing rexec() function, but

The FreeBSD man page says about the behaviour of rexec():

                               If a username and password are both speci-
   fied, then these are used to authenticate to the foreign host; otherwise
   the environment and then the user's .netrc file in his home directory are
   searched for appropriate information.  If all this fails, the user is
   prompted for the information. 

However, this is not implemented, and AFAICT none of the publically
available BSD's implement this (I also verified 4.4BSD-lite, NetBSD
and OpenBSD), and the rexec() implementation in the GNU C Library
(Linux, the Hurd) is based on the 4.4 BSD implementation and doesn't
implement it either.

Mark

PS I'm not on the list, so please CC me on reply.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------