The .rhosts File

The .rhosts file is the user equivalent of the /etc/hosts.equiv file. It contains a list of host-user combinations, rather than hosts in general. If a host-user combination is listed in this file, the specified user is granted permission to log in remotely from the specified host without having to supply a password.

Note that a .rhosts file must reside at the top level of a user's home directory. .rhost files located in subdirectories are not consulted.

Users can create .rhosts files in their home directories. Using the .rhosts file is another way to allow trusted access between their own accounts on different systems without using the /etc/hosts.equiv file.

Security Risks When Using the .rhosts File

Unfortunately, the .rhosts file presents a major security problem. While the /etc/hosts.equiv file is under the system administrator's control and can be managed effectively, any user may create a .rhosts file granting access to whomever the user chooses without the system administrator's knowledge.

In a situation in which all of the users' home directories are on a single server and only certain people have superuser access on that server, a good way to prevent a user from using a .rhosts file is to create an empty file as superuser in their home directory. You would then change the permissions in this file to 000 so that it would be difficult to change it, even as superuser. This would effectively prevent a user from risking system security by using a .rhosts file irresponsibly. It would not, however, solve anything if the user is able to change the effective path to his or her home directory.

The only secure way to manage .rhosts files is to completely disallow them. See "How to Search for and Remove .rhosts Files" for detailed instructions. As system administrator, you can check the system often for violations of this policy. One possible exception to this policy is for the root account--you may need to have a .rhosts file to perform network backups and other remote services.