Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am very confused, and I tried a lot but I didn't get any way to overcome from a bug. I am posting the same. I am hoping that someone helps me.

My problem is,

When I run ulimit -n it shows 12000.

When I run rsh localhost ulimit -n , it shows 12000.

Till now, all is going well. But the actual problem arise here, I made some changes in rsh, by adding one feature and some more, it builds a new rsh, named modified-rsh. Please don't ask for code because that is not public and don't say move to ssh , because rsh is insecure.

I know all these things.

When I run command, modified-rsh localhost ulimit -n , it shows 1024. Why ??

Can you tell me what is the reason behind all these happenings.

I feel helpless. Help me in this situation. Thanks in advance. Looking for your kind reply.

Edit no 3

I think this edit will be helpful. This edit shows where and when ulimit is accessed during the trace of modified-rsh

Command :- strace -o log.txt modified-rsh localhost ulimit -n

writev(3, [{"service\0", 8}, {"service\0", 8}, {"ulimit -n\0", 10}], 3) = 26
read(3, "\0", 1)                        = 1
rt_sigprocmask(SIG_SETMASK, [], [URG], 8) = 0
setuid(500)                             = 0
rt_sigprocmask(SIG_BLOCK, [INT QUIT TERM], [], 8) = 0
rt_sigaction(SIGINT, {0x1, [INT], SA_RESTORER|SA_RESTART, 0x3454030330}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGINT, {0x401650, [INT], SA_RESTORER|SA_RESTART, 0x3454030330}, {0x1, [INT], SA_RESTORER|SA_RESTART, 0x3454030330}, 8) = 0
rt_sigaction(SIGQUIT, {0x1, [QUIT], SA_RESTORER|SA_RESTART, 0x3454030330}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGQUIT, {0x401650, [QUIT], SA_RESTORER|SA_RESTART, 0x3454030330}, {0x1, [QUIT], SA_RESTORER|SA_RESTART, 0x3454030330}, 8) = 0
rt_sigaction(SIGTERM, {0x1, [TERM], SA_RESTORER|SA_RESTART, 0x3454030330}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTERM, {0x401650, [TERM], SA_RESTORER|SA_RESTART, 0x3454030330}, {0x1, [TERM], SA_RESTORER|SA_RESTART, 0x3454030330}, 8) = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x2b749c27cd80) = 4583
ioctl(5, FIONBIO, [1])                  = 0
ioctl(3, FIONBIO, [1])                  = 0
rt_sigprocmask(SIG_SETMASK, [], [INT QUIT TERM], 8) = 0
select(6, [3 5], NULL, NULL, NULL)      = 1 (in [3])
read(3, "1024\n", 8192)                 = 5
write(1, "1024\n", 5)                   = 5
select(6, [3 5], NULL, NULL, NULL)      = 1 (in [3])
read(3, "", 8192)                       = 0
select(6, [5], NULL, NULL, NULL)        = 1 (in [5])
read(5, "", 8192)                       = 0
kill(4583, SIGKILL)                     = 0
exit_group(0)                           = ?

See read system call reads 1024. But it should have to read 12000, where is the problem, can you identify now?

Edit No. 4

strace -e open modified-rsh localhost ulimit -n

open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libcrypt.so.1", O_RDONLY)  = 3
open("/lib64/libutil.so.1", O_RDONLY)   = 3
open("/lib64/libc.so.6", O_RDONLY)      = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libnss_files.so.2", O_RDONLY) = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/services", O_RDONLY)         = 3
open("/etc/resolv.conf", O_RDONLY)      = 3
open("/etc/host.conf", O_RDONLY)        = 3
open("/etc/hosts", O_RDONLY)            = 3
open("/etc/hosts", O_RDONLY)            = 3

These open system calls is called sequentially, that having 3 in command. Out of above , only four are readable, i.e., /etc/nsswitch.conf, /etc/passwd, /etc/services, /etc/resolv.conf

strace -e open rsh localhost ulimit -n

  1 open("/etc/ld.so.cache", O_RDONLY)      = 3
  2 open("/lib64/libcrypt.so.1", O_RDONLY)  = 3
  3 open("/lib64/libutil.so.1", O_RDONLY)   = 3
  4 open("/lib64/libc.so.6", O_RDONLY)      = 3
  5 open("/etc/nsswitch.conf", O_RDONLY)    = 3
  6 open("/etc/ld.so.cache", O_RDONLY)      = 3
  7 open("/lib64/libnss_files.so.2", O_RDONLY) = 3
  8 open("/etc/passwd", O_RDONLY)           = 3
  9 open("/etc/services", O_RDONLY)         = 3
 10 open("/etc/host.conf", O_RDONLY)        = 3
 11 open("/etc/resolv.conf", O_RDONLY)      = 3
 12 open("/etc/hosts", O_RDONLY)            = 3
 13 open("/etc/hosts", O_RDONLY)            = 3
 14 open("/etc/hosts", O_RDONLY)            = 3

cat /etc/services | grep rsh

kshell          544/tcp         krcmd           # Kerberized `rsh' (v5)
rsh-spx         222/tcp                         # Berkeley rshd with SPX auth
rsh-spx         222/udp                         # Berkeley rshd with SPX auth
carrius-rshell  1197/tcp                        # Carrius Remote Access
carrius-rshell  1197/udp                        # Carrius Remote Access
airshot         3975/tcp                        # Air Shot
airshot         3975/udp                        # Air Shot
watershed-lm    6143/tcp                        # Watershed License Manager
watershed-lm    6143/udp                        # Watershed License Manager
modified-rsh    2529/tcp

The below command I used is used by one question on this forum whose link is here

[root@jhamb ~]# sudo grep limits /etc/pam.d/*

/etc/pam.d/atd:# To enable PAM user limits for atd, please uncomment the
/etc/pam.d/atd:# following line and configure /etc/security/limits.conf:
/etc/pam.d/atd:# session    required   pam_limits.so
/etc/pam.d/runuser:session           required   pam_limits.so
/etc/pam.d/sudo:session    required  pam_limits.so
/etc/pam.d/sudo-i:session    required   pam_limits.so
/etc/pam.d/system-auth:session     required      pam_limits.so
/etc/pam.d/system-auth-ac:session     required      pam_limits.so
share|improve this question

closed as not a real question by MadHatter, mgorven, Scott Pack, mdpc, dunxd Mar 15 '13 at 12:25

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
The only thing people can say here is that you're doing something differently from the standard rsh. Since you don't want to show the changes you made, any answer you'd get would be a guess. –  Mat Mar 13 '13 at 13:48
    
I just want hint, what's the possibility. I think there is something wrong wrong with /etc/security/limits.conf –  devnull Mar 13 '13 at 13:54
    
Here is the question on this forum, similar to my question serverfault.com/questions/387884/… But I unable to co-relate these. –  devnull Mar 13 '13 at 13:55
1  
That's the problem - you're not giving any information about what you're doing differently from the original rsh. Asking for people to guess what you're doing wrong when you don't say what you're doing isn't productive. –  Mat Mar 13 '13 at 13:57
2  
That edit provides no information related to your problem at all. Just failed syscalls that look a bit strange - why is your rsh client trying to bind to a local port? –  Mat Mar 13 '13 at 14:34

1 Answer 1

You should connect to the rsh daemon with strace and look for setrlimit calls:

strace -p $PID -f -e trace=setrlimit

They should differ in both versions. This should lead you to the problem.

share|improve this answer
    
It does not show any thing, I run command strace -f -e setrlimit modified-rsh localhost ulimit -n, it shows 1024. :( –  devnull Mar 13 '13 at 18:28
1  
@jhamb Do what I told you. You have to trace the server not the client. We don't even know yet whether you have modified the client only. –  Hauke Laging Mar 13 '13 at 18:31
    
I have only one machine, this is the server and client also. First help me to this task on standard rsh, for some time leave modified-rsh concept. Tell me what is $PID in above query? –  devnull Mar 16 '13 at 9:45
    
@jhamb, I'm afraid you are confusing rsh and rshd. –  jlliagre Mar 16 '13 at 13:49
    
Now, I get proper feeling about these concepts. rsh passes query and rshd, i.e., rsh server, respond to the query. and yes my questions's solution is hidden in the rshd source code. Am I right ?? –  devnull Mar 16 '13 at 16:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.