I can't rcp, or rsh, from one (Solaris 9) server to another as root, but can 
as another user.  No doubt the reason is trivial, but it's eluding me!
Any suggestions gratefully received.

thanks
Neil

# whoami
# uname -a
SunOS server1 5.9 Generic_117171-09 sun4u sparc SUNW,Sun-Fire-V440

# rcp V7INST1 server2:/tmp
permission denied
# rsh server2 ls -l /tmp
permission denied

# su - informix
Sun Microsystems Inc.   SunOS 5.9       Generic May 2002

$ cd /opt/informix
# rcp V7INST1 server2:/tmp
$ $ rsh server2 ls -l /tmp
total 16
-rw-r--r--   1 informix informix     301 Oct  1 11:48 V7INST1
$ 

2004-10-1, 12:00(+01), Neil Truby:
> I can't rcp, or rsh, from one (Solaris 9) server to another as root, but can 
> as another user.  No doubt the reason is trivial, but it's eluding me!
> Any suggestions gratefully received.
[...]

From hosts.equiv man page:

M| Search Sequence
M|    To help maintain system security, the /etc/hosts.equiv  file
M|    is  not  checked  when  access is being attempted for super-
M|    user.

For root, you need to update /.rhosts

-- 
Stephane

"Stephane CHAZELAS" <this.address@is.invalid> wrote in message 
news:slrnclqfcq.15g.stephane.chazelas@spam.is.invalid...
> 2004-10-1, 12:00(+01), Neil Truby:
>> I can't rcp, or rsh, from one (Solaris 9) server to another as root, but 
>> can
>> as another user.  No doubt the reason is trivial, but it's eluding me!
>> Any suggestions gratefully received.
> [...]
>
> From hosts.equiv man page:
>
> M| Search Sequence
> M|    To help maintain system security, the /etc/hosts.equiv  file
> M|    is  not  checked  when  access is being attempted for super-
> M|    user.
>
> For root, you need to update /.rhosts
>
> -- 
> Stephane

Spot on, thank you. 

Neil Truby wrote:

> "Stephane CHAZELAS" <this.address@is.invalid> wrote in message
> news:slrnclqfcq.15g.stephane.chazelas@spam.is.invalid...
>> 2004-10-1, 12:00(+01), Neil Truby:
>>> I can't rcp, or rsh, from one (Solaris 9) server to another as root, but
>>> can
>>> as another user.  No doubt the reason is trivial, but it's eluding me!
>>> Any suggestions gratefully received.
>> [...]
>>
>> From hosts.equiv man page:
>>
>> M| Search Sequence
>> M|    To help maintain system security, the /etc/hosts.equiv  file
>> M|    is  not  checked  when  access is being attempted for super-
>> M|    user.
>>
>> For root, you need to update /.rhosts
>>
>> --
>> Stephane
> 
> Spot on, thank you.

And another satisfied user is shown how to bypass the safeguards
so he can shoot himself in the foot...
-- 
             Christopher Mattern

"Which one you figure tracked us?"
"The ugly one, sir."
"...Could you be more specific?"

"Chris Mattern" <matternc@comcast.net> wrote in message 
news:JKidncuku_5A9cDcRVn-hw@comcast.com...
> Neil Truby wrote:
>
>> "Stephane CHAZELAS" <this.address@is.invalid> wrote in message
>> news:slrnclqfcq.15g.stephane.chazelas@spam.is.invalid...
>>> 2004-10-1, 12:00(+01), Neil Truby:
>>>> I can't rcp, or rsh, from one (Solaris 9) server to another as root, 
>>>> but
>>>> can
>>>> as another user.  No doubt the reason is trivial, but it's eluding me!
>>>> Any suggestions gratefully received.
>>> [...]
>>>
>>> From hosts.equiv man page:
>>>
>>> M| Search Sequence
>>> M|    To help maintain system security, the /etc/hosts.equiv  file
>>> M|    is  not  checked  when  access is being attempted for super-
>>> M|    user.
>>>
>>> For root, you need to update /.rhosts
>>>
>>> --
>>> Stephane
>>
>> Spot on, thank you.
>
> And another satisfied user is shown how to bypass the safeguards
> so he can shoot himself in the foot...

Well, the actual requirement is to (temporarily) direct ufsbackups to a 
remote server.  The root access is just a means to achieving this.  What 
"safer" alternative would you suggest? 

2004-10-01, 10:25(-04), Chris Mattern:
[...]
>>> For root, you need to update /.rhosts
[...]
> And another satisfied user is shown how to bypass the safeguards
> so he can shoot himself in the foot...

Well, ssh being not installed by default on Solaris, it may
reveal to be the safest way to log as root remotly...

-- 
Stephane

In article <slrnclqqj6.1pg.stephane.chazelas@spam.is.invalid>,
 Stephane CHAZELAS <this.address@is.invalid> wrote:

> 2004-10-01, 10:25(-04), Chris Mattern:
> [...]
> >>> For root, you need to update /.rhosts
> [...]
> > And another satisfied user is shown how to bypass the safeguards
> > so he can shoot himself in the foot...
> 
> Well, ssh being not installed by default on Solaris, it may
> reveal to be the safest way to log as root remotly...

Depends on what you mean by "default", and what release you're talking 
about -- on both Solaris 9 and 10, it's in the "End User", "Developer", 
and "Entire Distribution" (also +OEM) installs,  which are the most 
common selections, I'd think.

Cheers,
- jonathan

2004-10-01, 08:57(-07), Jonathan Adams:
[...]
>> Well, ssh being not installed by default on Solaris, it may
>> reveal to be the safest way to log as root remotly...
>
> Depends on what you mean by "default", and what release you're talking 
> about -- on both Solaris 9 and 10, it's in the "End User", "Developer", 
> and "Entire Distribution" (also +OEM) installs,  which are the most 
> common selections, I'd think.
[...]

Yes, sorry, I checked on a Solaris 8 system, OP mentionned
Solaris 9.

-- 
Stephane

Neil Truby wrote:

> "Chris Mattern" <matternc@comcast.net> wrote in message
> news:JKidncuku_5A9cDcRVn-hw@comcast.com...
>> Neil Truby wrote:
>>
>>> "Stephane CHAZELAS" <this.address@is.invalid> wrote in message
>>> news:slrnclqfcq.15g.stephane.chazelas@spam.is.invalid...
>>>> 2004-10-1, 12:00(+01), Neil Truby:
>>>>> I can't rcp, or rsh, from one (Solaris 9) server to another as root,
>>>>> but
>>>>> can
>>>>> as another user.  No doubt the reason is trivial, but it's eluding me!
>>>>> Any suggestions gratefully received.
>>>> [...]
>>>>
>>>> From hosts.equiv man page:
>>>>
>>>> M| Search Sequence
>>>> M|    To help maintain system security, the /etc/hosts.equiv  file
>>>> M|    is  not  checked  when  access is being attempted for super-
>>>> M|    user.
>>>>
>>>> For root, you need to update /.rhosts
>>>>
>>>> --
>>>> Stephane
>>>
>>> Spot on, thank you.
>>
>> And another satisfied user is shown how to bypass the safeguards
>> so he can shoot himself in the foot...
> 
> Well, the actual requirement is to (temporarily) direct ufsbackups to a
> remote server.  The root access is just a means to achieving this.  What
> "safer" alternative would you suggest?

"ufsbackups"?  You mean ufsdump?  First off, use ssh/scp; it's in Solaris 9.
If it was me, I'd have ufsdump running as root write to named pipe readable
only by one non-root user, preferably one created for the purpose.  Then
on the remote server, I'd ssh in as that user to read the pipe and copy the
data onto the remote.  Use Blowfish cipher and compression to get good
performance.  No need for root direct log in, and *much* more secure than
any use of rsh.

-- 
             Christopher Mattern

"Which one you figure tracked us?"
"The ugly one, sir."
"...Could you be more specific?"