[113115] in North American Network Operators' Group
RE: Nipper and Cisco configuration results
daemon@ATHENA.MIT.EDU (=?iso-8859-1?B?Sm+i?=)
Thu Apr 2 20:22:19 2009
From: =?iso-8859-1?B?Sm+i?= <jbfixurpc@gmail.com>
To: <castellan2004-nsm@yahoo.com>,
<nanog@nanog.org>
Date: Thu, 2 Apr 2009 20:18:43 -0400
In-Reply-To: <46371.48938.qm@web30807.mail.mud.yahoo.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
What IOS version are you using? I don't see that behavior (rlogin/rsh) =
by
default, but I'm a few revisions behind on the latest. @ 12.2
I do see from the router:=20
RCMD-4-RSHPORTATTEMPT Attempted to connect to RSHELL from 192.168.1.52
from nmaps, but theres no response to the SYN packet of the attempting =
IP. I
think this has been
the case since w-a-y earlier versions of IOS for logging levels but not =
sure
at which level.
Looks to only be logging an attempt, no session is made, sort of like a
firewall=20
just letting you know there was an attempt. The router gets the request =
but
it falls on deaf
ears, no one home. Unless perhaps theres some other sort of flag/bit =
that
can be presented to=20
open that connection(extremely doubtful) I don't believe theres any way =
to
connect.=20
Perhaps turning down your logging will prevent your testing program from
reporting a false positive?
I'd snoop/sniff the traffic and see if your router is SYN/ACK-ing the
request of rlogin/rsh to be sure.
<sarcasm>And make sure their not to close to one another, incase their =
using
undocumented=20
internal wireless units as a means to complete the connection, those =
Cisco
guys you know..</sarcasm>
Regards
Joe Blanchard
> -----Original Message-----
> From: Subba Rao [mailto:castellan2004-nsm@yahoo.com]=20
> Sent: Thursday, April 02, 2009 6:33 PM
> To: nanog@nanog.org
> Subject: Nipper and Cisco configuration results
>=20
> I am using Nipper for verifying my Cisco configuration.=A0=20
> Nipper is finding the "rlogin" service that is not in the=20
> configuration.=A0 I have searched the access lists and do not=20
> see it anywhere.=A0 The explanation by Nipper about this=20
> finding, "....Telnet protocol implemented by this=20
> service...." is confusing.=A0 Here is the Nipper's output:
>=20
> ______________________________
> Rlogin Service Settings
>=20
> The Rlogin service enables remote administrative access to a=20
> CLI on Cisco Router Devices.=A0 The Telnet protocol implemented=20
> by th service is simple and provides no encryption of the=20
> network communications between client and the server.=A0 This=20
> section details the Rlogin settings.
>=20
> Description=A0=A0 =A0=A0=A0 =A0=A0=A0 =A0=A0=A0 =A0Setting
> Rlogin Service=A0=A0 =A0=A0=A0 =A0=A0=A0 =A0Enabled
> Service TCP Port=A0=A0 =A0=A0=A0 =A0513
> ______________________________
>=20
> I have checked a few other routers where SSH was not enabled=20
> with the same results.
>=20
> Can someone explain why Nipper is saying "Rlogin is enabled"=20
> when I do not see it in the configuration file?=A0 Is there=20
> something else that I need to be looking at?
>=20
> Thank you in advance for any help.
>=20
> Subba Rao
