KLOGIND(8)

NAME
klogind - remote login server

SYNOPSIS
/usr/etc/klogind
/usr/etc/Klogind
/usr/etc/eklogind

DESCRIPTION
Klogind is the server for the Kerberos version of the rlogin(1) program. The server provides a remote login facility with authentication provided by Kerberos.

Klogind listens for service requests at the port indicated in the ``klogin'' or ``eklogin'' service specification; see services(5).

Invocation as Klogind is intended for secure hosts to which no password access will be granted; invocation as klogind is intended for normal hosts to which password access may be granted if Kerberos authorization fails; invocation as eklogind provides an encrypted communications channel. A host can run either Klogind or klogind but not both (they use the same port, ``klogin''). Eklogind may be run independently.

When a service request is received, the server checks the client's source address and requests the corresponding host name (see gethostbyaddr(3N), hosts(5) and named(8)). If the hostname cannot be determined, the dot-notation representation of the host address is used.

Once the source address has been checked, klogind allocates a pseudo terminal (see pty(4)), and manipulates file descriptors so that the slave half of the pseudo terminal becomes the stdin , stdout , and stderr for a login process. The login process is an instance of the login(1) program, invoked with the -k, -K, or -e option, depending on whether the klogind was started as klogind, Klogind or eklogind, respectively. The login process then proceeds with the authentication process as described in kshd(8), but if automatic authentication fails, it reprompts the user to login as one finds on a standard terminal line.

The parent of the login process manipulates the master side of the pseudo terminal, operating as an intermediary between the login process and the client instance of the rlogin program. If klogind is invoked as eklogind, all data passed over the network are encrypted. In normal operation, the packet protocol described in pty(4) is invoked to provide ^S/^Q type facilities and propagate interrupt signals to the remote programs. The login process propagates the client terminal's baud rate and terminal type, as found in the environment variable, ``TERM''; see environ(7). The screen or window size of the terminal is requested from the client, and window size changes from the client are propagated to the pseudo terminal.

DIAGNOSTICS
All diagnostic messages are returned on the connection associated with the stderr, after which any network connections are closed. An error is indicated by a leading byte with a value of 1.

``Try again.''
A fork by the server failed.

``/bin/sh: ...''
The user's login shell could not be started.

SEE ALSO
kerberos(3)

BUGS

A more extensible protocol should be used.