4.3BSD-UWisc/man/cat5/hosts.equiv.5

HOSTS.EQUIV(5)      UNIX Programmer's Manual       HOSTS.EQUIV(5)



NAME
     hosts.equiv - list of trusted hosts

DESCRIPTION
     _H_o_s_t_s._e_q_u_i_v resides in directory /_e_t_c and contains a list of
     trusted hosts.  When an _r_l_o_g_i_n(1) or _r_s_h(1) request from
     such a host is made, and the initiator of the request is in
     /_e_t_c/_p_a_s_s_w_d, then no further validity checking is done.
     That is, _r_l_o_g_i_n does not prompt for a password, and _r_s_h com-
     pletes successfully.  So a remote user is ``equivalenced''
     to a local user with the same user ID when the remote user
     is in _h_o_s_t_s._e_q_u_i_v.

     The format of _h_o_s_t_s._e_q_u_i_v is a list of names, as in this
     example:

           host1
           host2
           +@group1
           -@group2

     A line consisting of a simple host name means that anyone
     logging in from that host is trusted.  A line consisting of
     +@_g_r_o_u_p means that all hosts in that network group are
     trusted.  A line consisting of -@_g_r_o_u_p means that hosts in
     that group are not trusted.  Programs scan _h_o_s_t_s._e_q_u_i_v
     linearly, and stop at the first hit (either positive for
     hostname and +@ entries, or negative for -@ entries).  A
     line consisting of a single + means that everyone is
     trusted.

     The ._r_h_o_s_t_s file has the same format as _h_o_s_t_s._e_q_u_i_v.  When
     user _X_X_X executes _r_l_o_g_i_n or _r_s_h, the ._r_h_o_s_t_s file from _X_X_X's
     home directory is conceptually concatenated onto the end of
     _h_o_s_t_s._e_q_u_i_v for permission checking.  However, -@ entries
     are not sticky.  If a user is excluded by a minus entry from
     _h_o_s_t_s._e_q_u_i_v but included in ._r_h_o_s_t_s, then that user is con-
     sidered trusted.  In the special case when the user is root,
     then only the /._r_h_o_s_t_s file is checked.

     It is also possible to have two entries (separated by a sin-
     gle space) on a line of these files.  In this case, if the
     remote host is equivalenced by the first entry, then the
     user named by the second entry is allowed to log in as any-
     one, that is, specify any name to the -l flag (provided that
     name is in the /_e_t_c/_p_a_s_s_w_d file, of course).  Thus

           sundown john

     allows _j_o_h_n to log in from sundown as anyone.  The usual
     usage would be to put this entry in the ._r_h_o_s_t_s file in the
     home directory for _b_i_l_l . Then _j_o_h_n may log in as _b_i_l_l when



Printed 12/27/86         1 February 1985                        1






HOSTS.EQUIV(5)      UNIX Programmer's Manual       HOSTS.EQUIV(5)



     coming from sundown.  The second entry may be a netgroup,
     thus

           +@group1 +@group2

     allows any user in _g_r_o_u_p_2 coming from a host in _g_r_o_u_p_1 to
     log in as anyone.

FILES
     /etc/hosts.equiv
     /etc/yp/_d_o_m_a_i_n/netgroup
     /etc/yp/_d_o_m_a_i_n/netgroup.byuser
     /etc/yp/_d_o_m_a_i_n/netgroup.byhost

SEE ALSO
     rlogin(1), rsh(1), netgroup(5)







































Printed 12/27/86         1 February 1985                        2