--- cdrecord/README.rscsi.orig 2004-05-19 14:12:05 UTC +++ cdrecord/README.rscsi @@ -3,52 +3,49 @@ The Remote-SCSI protocol gives you SCSI- There are three possible ways to control access to the remote users: - Let the remote scsi lib log in as a standard user. - In this case rscsi will be called via sh -c /opt/schily/sbin/rscsi + In this case rscsi will be called via sh -c /usr/local/sbin/rscsi NOTE: In this case, rscsi must be installed suid root. --- This would need to allow any valid local user to access SCSI ---- It could be a security problem. - - Log in as root and call rscsi via sh -c /opt/schily/sbin/rscsi + - Log in as root and call rscsi via sh -c /usr/local/sbin/rscsi NOTE that this will fore you to allow remote logins as root which is considered to be a security hole. - - Create one or more special user(s) that have /opt/schily/sbin/rscsi + - Create one or more special user(s) that have /usr/local/sbin/rscsi as login shell with their own home directory. You then may create special .rhosts files for each user. NOTE: In this case, rscsi must be installed suid root. **** This is the preferred method **** -To enable remote SCSI via the login shell method you should do the following: - - - Add an entry to /etc/passwd in the form: - - rscsi:x:1999:1000:Tape:/export/home/rscsi:/opt/schily/sbin/rscsi + The FreeBSD port automatically installs the rscsi binary suid + root and creates the user "rscsi". - (modify this according to your OS). And don't forget to - modify /etc/shadow the way it needs to be on your OS. +To enable remote SCSI via the login shell method you should do the following: - - Create a home directory for this user and add a .rhosts file - to allow access to all users you like. + - Make sure that there is an entry for rshd(8) in /etc/inetd.conf + and inetd(8) is running. - - Install rscsi suid root into /opt/schily/sbin + - Edit /usr/local/rscsi/.rhosts to allow access to all users you + like. - - Install a file /etc/default/rscsi and define access rights. + - Edit /usr/local/etc/rscsi and define access rights. Without this file, rscsi will not work at all. - The template for this file is: rscsi/rscsi.dfl + The template for this file is: /usr/local/etc/rscsi.sample RSCSI Security: -- When rscsi starts, it checks if /etc/default/rscsi exists. +- When rscsi starts, it checks if /usr/local/etc/rscsi exists. If not, it dies. -- If rscsi is not called by a user listed in /etc/default/rscsi +- If rscsi is not called by a user listed in /usr/local/etc/rscsi it dies. - To access a SCSI target there must be an entry that lists the user rcsi hast been started from, the hostname and the SCSI target. - rscsi compares the hostname field in /etc/default/rscsi + rscsi compares the hostname field in /usr/local/etc/rscsi to the peername retrived from STDIN: - legal host name IP connection