513 - Pentesting Rlogin

Basic Information

The BSD rlogin protocol provides a remote terminal over TCP port 513. Its trusted-host mechanism can bypass password authentication, and the protocol does not protect the session with modern transport encryption; use SSH instead for administration.^[1]

Default port: 513/TCP

PORT    STATE SERVICE
513/tcp open  login

Login

Install a client on Debian-based systems:

sudo apt-get install rsh-client

Then test an authorized account. If the server’s trust configuration permits passwordless access, no password prompt will appear:

rlogin <IP> -l <username>
# Explicitly test the privileged account only when it is in scope:
rlogin <IP> -l root

Pay particular attention to privileged accounts and trust entries in /etc/hosts.equiv and users’ .rhosts files. RFC 1282 warns that passwordless trusted-host authentication is dangerous because a compromised trusted host can expose accounts on every server that trusts it.^[1]

Brute force

Find trust files

find / -name .rhosts 2>/dev/null

References

• [1] RFC 1282 - BSD Rlogin