HP-UX Reference (11i v3 07/02) - 4 File Formats (vol 8)

h
hosts.equiv(4) hosts.equiv(4)
NAME
hosts.equiv, .rhosts - security files authorizing access by remote hosts and users on local host
DESCRIPTION
The /etc/hosts.equiv
file and files named .rhosts found in users’ home directories specify remote
hosts and users that are "equivalent" to the local host or user. Users from equivalent remote hosts are per-
mitted to access a local account using
rcp or remsh or to rlogin to the local account without supplying
a password (see rcp(1), remsh(1), and rlogin(1)). The security provided by
hosts.equiv is implemented
by the
ruserok() library routine, (see rcmd(3N)).
In this description, hostequiv means either the system
/etc/hosts.equiv
file or the user .rhosts
file. Note that .rhosts must be owned either by the root or by the user in whose home directory it is
found and it must not be a symbolic link. The
/etc/hosts.equiv
file defines system-wide equivalency,
whereas a user’s
.rhosts file defines equivalency between the local user and any remote users to whom
the local user chooses to allow or deny access.
An entry in the hostequiv file is a single line (no continuations) in the format:
[hostname [username]] [
#comment]
Thus, it can be:
• A blank line.
• A comment line, beginning with a
#.
• A host name, optionally followed by a comment.
• A host name and user name, optionally followed by a comment.
A host or user name is a string of printable characters, excluding whitespace, newlines, and #.
Names are separated by whitespace.
For a user to be granted access, both the remote host name and the user name must "match" an entry in
hostequiv. When a request is made for access, the
/etc/hosts.equiv
file is searched first. If a match
is found, access is permitted. If no match is found, the
.rhosts file is searched, if one exists in the local
user’s home directory. If the local user is a superuser, /etc/hosts.equiv
is ignored.
A host name or user name must match the corresponding field entry in hostequiv in one of the following
ways:
Literal match A host name in hostequiv can literally match the official host name (not an
alias) of the remote host.
A user name in hostequiv can literally match the remote user name. For a
user name to have literal match in the
/etc/hosts.equiv
file, the
remote user name must literally match the local user name.
Domain-extended match The remote host name to be compared with entries in hostequiv is typically
the official host name returned by
gethostbyaddr()
(see
gethostent(3N)). In a domain-naming environment, this is a domain-
qualified name. If a host name in hostequiv does not literally match the
remote host name, the host name in hostequiv with the local domain name
appended may match the remote host name.
-name If the host name in hostequiv is of this form, and if name literally matches
the remote host name or if name with the local domain name appended
matches the remote host name, access is denied regardless of the user
name.
If the user name in hostequiv is of this form, and name literally matches
the remote user name, access is denied.
Even if access is denied in this way by /etc/hosts.equiv, access can
still be allowed by .rhosts.
+ Any remote host name matches the host name + in hostequiv.
Any remote user matches the user name +.
+@netgroup_name netgroup_name is the name of a network group as defined in netgroup(4).
If the host name in hostequiv is of this form, the remote host name (only)
186 Hewlett-Packard Company − 1 − HP-UX 11i Version 3: February 2007