From: Angel Ortiz (
Date: Wed Apr 22 1998 - 12:42:00 CDT

Sun Managers;

My thanks to:
Pravin Chavan <>,
Casper Dik <casper@holland.Sun.COM>,
Jochen Bern <bern@TI.Uni-Trier.DE>,
Ronald Loftin <>,
Peter Polasek <>,
Jason Marshall <>, (MATTHEW POTTER),
and any other that may arrive after I send this summary.
Should I received any "other" information not covered here I'll repost and
update to this summary, however

1. RSH does NOT log remote activity

2. TCP wrappers would be the way to go. I am not good with tcp wrappers
so I may research it. I was more looking for a "Switch" that could be
toggle to log rsh activity.

3. One suggested that the who and last would give that information, I have
found out that is not so.

Below are the responses;

From: Pravin Chavan <>
Date: Wed, 22 Apr 1998 13:28:05 +0530
Subject: Re: RSH command

Hi Angel,

After rsh'ing to a remote machine, the command
"who" (run on the remote machine) will show your
id as well. In this case "last" will also show
the time your rsh'd (again run "last" on the
remote machine).

BTW, this info. is stored in /var/adm/utmp(x)
files. Check if these files are emptied on the
remote machine. If they are empty, then last
does not give any output.



From: Casper Dik <casper@holland.Sun.COM>
To: Angel Ortiz <>
Subject: Re: RSH command
Date: Wed, 22 Apr 1998 10:18:37 +0200

Only interactive logins are entered in utmp/utmpx

Command logging through 'acct' or using auditing are your next options.


From: Jochen Bern <bern@TI.Uni-Trier.DE>
Date: Wed, 22 Apr 1998 12:01:06 +0200 (MET DST)
Subject: Re: RSH command

Not by Default. If you put the Servers behind TCP Wrappers, however,
you can have Logs detailing the Connections made, logged with ori-
ginating Host and possibly the Result of an identd Request thereto;
No Way that I'm aware of to log the Username actually used on the
local Side, though.


From: Ronald Loftin <>
To: Angel Ortiz <>
Date: Wed, 22 Apr 1998 10:04:13 -0400 (EDT)
Subject: Re: RSH command

You would probably have to install TCP wrappers to log rsh activity.

From: Peter Polasek <>
To: Angel Ortiz <>
Date: Wed, 22 Apr 1998 10:37:55 -0400 (EDT)
Subject: Re: RSH command

Don't have an answer (sorry), please summarize the responses you receive
because I also have an interest in this.

Peter Polasek

From: Jason Marshall <>
To: Angel Ortiz <>
Date: Wed, 22 Apr 1998 09:08:47 -0600 (MDT)
Subject: Re: RSH command

I don't know about rsh, but ssh (secure shell) logs all this stuff any
time a connection is made from another host. Not in wtmpx, but via
syslog. rsh might be able to do the same thing, haven't checked.


Subject: Re: RSH command
To: Angel Ortiz <>
Date: Wed, 22 Apr 1998 09:43:46 -0400

     Get tcp wrappers and wrap rsh. or run inetd with a -ts flag.


This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:12:38 CDT