[2571] in Kerberos
Re: Help with rcmd
daemon@ATHENA.MIT.EDU (srz@Athena.MIT.EDU)
Tue Feb 9 12:33:08 1993
From: srz@Athena.MIT.EDU
Date: Tue, 9 Feb 93 11:58:02 -0500
To: saujla@axion.bt.co.uk
Cc: kerberos@Athena.MIT.EDU
The principal name that is used for a service is simply a name; the
program author chooses it.
In this case, the rcmd name was chosen as a generic way of naming
the standard Berkeley login services (rlogin, rsh). There is no
direct link with the rcmd() subroutine call, except that rcmd() is
used in rlogin, rsh, etc.
Service principal names have a tendency to get used for other
services, since it is easier to reuse an existing principal than
to go to the local Kerberos maintainers for another one. Thus the "rcmd"
principal gets used for "rkinit", and NFS service at Athena uses the
"rvdsrv" principal. "rcmd" is the most common privileged principal name, and
gets used a lot (by privileged, I mean that if the principal becomes
compromised, root access on the given machine can be obtained).
-stan
