There must be no .rhosts or hosts.equiv files on the system.

From Oracle Linux 6 Security Technical Implementation Guide

Associated with: CCI-001436

SV-64925r1_rule There must be no .rhosts or hosts.equiv files on the system.

Vulnerability discussion

Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.

Check content

The existence of the file "/etc/hosts.equiv" or a file named ".rhosts" inside a user home directory indicates the presence of an Rsh trust relationship. If these files exist, this is a finding.

Fix text

The files "/etc/hosts.equiv" and "~/.rhosts" (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location. # rm /etc/hosts.equiv $ rm ~/.rhosts

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.