如何判断RSH从SUA发送的用户名?

时间:2022-10-07 10:07:01

I am on a Windows Vista 64-bit Enterprise machine with Subsystem for Unix Applications installed and the applications downloaded. I am attempting to use RSH to connect to a FreeBSD server. The command I would like to execute is:

我在安装了Subsystem for Unix Applications并下载应用程序的Windows Vista 64位企业计算机上。我试图使用RSH连接到FreeBSD服务器。我想要执行的命令是:

rsh host.suffix1.company.com command

The .rhosts file in my home directory on host.suffix1.company.com looks like this:

host.suffix1.company.com上我的主目录中的.rhosts文件如下所示:

+ myusername
+ mydomain\myusername
+ mydomain/myusername
+ myusername@mydomain
+ +
mycomputer.suffix2 myusername
mycomputer.suffix2 +
mycomputer.suffix2.company.com myusername
mycomputer.suffix2.company.com +

I know + + is bad, but let's ignore that for now. When I run this:

我知道+ +很糟糕,但现在让我们忽略它。当我运行这个:

rsh host.suffix1.company.com command

I get the following error:

我收到以下错误:

rshd: Login incorrect.

However, when I run

但是,当我跑

rsh -l myusername host.suffix1.company.com command

this works flawlessly. What I'd like to know is:

这完美无瑕。我想知道的是:

  1. What is SUA sending as the username when I don't specify it via -l?
  2. 当我没有通过-l指定时,SUA作为用户名发送什么?

  3. How can I change what SUA is sending?
  4. 如何更改SUA发送的内容?

I'm assuming that here SUA is sending some form of mydomain\myusername, but I'm wondering what other entries I might need to make to the rhosts file to allow this and why the + + isn't allowing this?

我假设这里SUA正在发送某种形式的mydomain \ myusername,但我想知道我可能需要对rhosts文件做什么其他条目以允许这个以及为什么+ +不允许这个?

1 个解决方案

#1


I would guess that examining syslog (or another appropriate log?) on the freebsd box could give you the login name from the failed login. On my linux machine I get the lines like the following from the frequent ssh attacks:

我猜想在freebsd框上检查syslog(或其他适当的日志?)可以从失败的登录名中找到登录名。在我的linux机器上,我从频繁的ssh攻击中获得如下行:

May 19 19:57:40 anton sshd[29795]: Failed password for invalid user mercedes from 124.217.246.181 port 49198 ssh2
May 19 19:57:40 anton sshd[29796]: Received disconnect from 124.217.246.181: 11: Bye Bye
May 19 19:57:45 anton unix_chkpwd[29802]: password check failed for user (games)
May 19 19:57:45 anton sshd[29799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns1.1oasis.net  user=games
May 19 19:57:48 anton sshd[29799]: Failed password for games from 124.217.246.181 port 49956 ssh2

This is from sshd, but I would be surprised if not rshd is not able to log something similar (although it might be off by default and needs to be enabled).

这是来自sshd,但如果不是rshd不能记录类似的东西我会感到惊讶(虽然它可能默认关闭并需要启用)。

For guesses on what the rsh client made by microsoft gets the name from I have few ideas. A traditional unix rsh would of course get the name from /etc/passwd, reading it indirectly with getpwent() (failing that it might fall back to environmental variables LOGNAME or USER?). Is "myusername" present in c:\windows\system\etc\passwd (or whatever SUA maps as /etc/passwd)?

为了猜测微软的rsh客户端取得了什么名称,我的想法很少。传统的unix rsh当然会从/ etc / passwd获取名称,使用getpwent()间接读取它(如果它可能会回退到环境变量LOGNAME或USER?)。 “myusername”是否出现在c:\ windows \ system \ etc \ passwd(或者任何SUA映射为/ etc / passwd)中?

#1


I would guess that examining syslog (or another appropriate log?) on the freebsd box could give you the login name from the failed login. On my linux machine I get the lines like the following from the frequent ssh attacks:

我猜想在freebsd框上检查syslog(或其他适当的日志?)可以从失败的登录名中找到登录名。在我的linux机器上,我从频繁的ssh攻击中获得如下行:

May 19 19:57:40 anton sshd[29795]: Failed password for invalid user mercedes from 124.217.246.181 port 49198 ssh2
May 19 19:57:40 anton sshd[29796]: Received disconnect from 124.217.246.181: 11: Bye Bye
May 19 19:57:45 anton unix_chkpwd[29802]: password check failed for user (games)
May 19 19:57:45 anton sshd[29799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns1.1oasis.net  user=games
May 19 19:57:48 anton sshd[29799]: Failed password for games from 124.217.246.181 port 49956 ssh2

This is from sshd, but I would be surprised if not rshd is not able to log something similar (although it might be off by default and needs to be enabled).

这是来自sshd,但如果不是rshd不能记录类似的东西我会感到惊讶(虽然它可能默认关闭并需要启用)。

For guesses on what the rsh client made by microsoft gets the name from I have few ideas. A traditional unix rsh would of course get the name from /etc/passwd, reading it indirectly with getpwent() (failing that it might fall back to environmental variables LOGNAME or USER?). Is "myusername" present in c:\windows\system\etc\passwd (or whatever SUA maps as /etc/passwd)?

为了猜测微软的rsh客户端取得了什么名称,我的想法很少。传统的unix rsh当然会从/ etc / passwd获取名称,使用getpwent()间接读取它(如果它可能会回退到环境变量LOGNAME或USER?)。 “myusername”是否出现在c:\ windows \ system \ etc \ passwd(或者任何SUA映射为/ etc / passwd)中?