r* Programs Being Removed from OpenBSD -current

moonboy writes: "This post over at OpenBSD Journal tells of the r* programs (rsh, rlogin, rcopy, etc) being removed from the -current tree. Can Telnet and FTP be far behind? I say good riddance."

Comments

BSD is not dying, it's busy cleaning

[ObviousGuy]

Removing redundant, unnecessary, and potentially dangerous programs from the distro is a really good idea.

Creating the symlinks just adds complexity to a system that doesn't need it.

Re:BSD is not dying, it's busy cleaning

[WasterDave]

Absolutely, I'm surprised they're still there. And, as another poster pointed out, telnet and (to a lesser extent) ftp have to be next on the chopping block. Makes more sense than Perl being ripped from FreeBSD anyway.

Dave

Re:BSD is not dying, it's busy cleaning

[ObviousGuy]

I don't know. I've always had misgivings about having non-compiled (yes, I know Perl is a compiled language) scripts as system tools. Removing Perl-based scripts is really a good step because it reduces the number of volatile dependencies by one.

Now removing Perl altogether? I don't think that's a great idea at all. But I haven't read the other article yet, so I can't comment.

Re:BSD is not dying, it's busy cleaning

[sigwinch]

And, as another poster pointed out, telnet and (to a lesser extent) ftp have to be next on the chopping block.

I disagree. FTP is a fine way to serve files to anonymous clients. A lot of data traffic simply doesn't benefit (much) from security. Unless you are going to replace it with HTTP over SSL and institute a person-to-person key fingerprint distribution process, you might as well keep using FTP.

As for telnet, using it to run login shells is idiocy, but it's the only standardized way to run interactive services. It comes disabled by default, so including it is not a security risk. And when you someday need a little interactive network program *right now*, it's damn convenient. E.g., if you needed to stick a load monitor on your database server, just write a little program that talks on standard input and output, and tell telnet to use it instead of a shell. Instant results, little risk of breaking anything, and any client can access it.

Re:BSD is not dying, it's busy cleaning

[realdpk]

netcat should be made standard as a replacement. :)

Re:BSD is not dying, it's busy cleaning

[Arandir]

Perl hasn't been removed. Please read the other article. Perl is being removed from the *base* system. It is still available in the ports. It sounds like it will also be installed by default anyway, just like X11R6 (which isn't in the base system, but still installed by default).

The reasons they are getting rid of it in the base system are numerous. The top reason in my mind is that Perl is growing enormous. It's a damn useful tool, but it isn't necessary for the base system, especially with the size it's getting. If you need it, install it. Simple.

Re:BSD is not dying, it's busy cleaning

[quinto2000]

Sftp, Kerberized FTP, etc. They'll work with the non-secure servers when that's all that's available, but will use security by default. I like Kerberos. SCP is the best option, but a pain for its lack of interactive use.

Anyway, I think the point is to remove these services, not to remove the clients. It is a security risk when it's so tempting to use it, but it's so vulnerable to exploits.

Re:BSD is not dying, it's busy cleaning

[cperciva]

FTP is a fine way to serve files to anonymous clients.

No it isn't. FTP, with its separate control and data connections, made sense fifteen years ago; but now it causes terrible headaches for network and firewall administrators. In addition, FTP doesn't have any standardized mechanism for name-based hosting.

As far as I can see, there is no excuse for using FTP any longer, for any purpose.

Re:BSD is not dying, it's busy cleaning

[sigwinch]

Funny, I almost mentioned netcat. But AFAIK Windows doesn't have a plain socket client, just a telnet client. I've had some very bad results when plain socket servers try to interpret a telnet client's handshaking data.

Re:BSD is not dying, it's busy cleaning

[sigwinch]

It is a security risk when it's so tempting to use it, but it's so vulnerable to exploits.

Good point. telnetd ought to be fixed so it only runs the program specified on the command line, the stock inetd config should specify /bin/false as the program to run, and the documentation should discourage use with insecure programs.

Besides, the current state of affairs is not the Unix Way: telnetd should be an autonegotiating filter for interactive terminals, and nothing more. It should never have known anything about logins or shells in the first place.

Re:BSD is not dying, it's busy cleaning

[cperciva]

Wouldn't the Unix Way be to have inetd spawn login directly, and have terminal negotiation handled by a program run from .shrc ?

Re:BSD is not dying, it's busy cleaning

[Amarok.Org]

I think God got the last word on that debate.

Darwin?

[linuxbert]

hmm, im not very familier with bsd and darwin developments, but i wonder if apple will follow suit.
i just checked my 10.2.4 and it has rlogin, and perl. Perl is quite usefull, but i agree it shouldnt be part of a default install. the rtools are a big risk, and rightly should be gotten rid of. with ssh and secure versions of most of these r tools, there existance is moot.

Apple prides itself on the power of unix, simplicity of a mac, and i think it works great. (havent touched my pc in weeks) but i question if a desktop os really needs the rtools.

Something has been lost here...

[seraphim via]

I believe something has eluded the 'BSD is dying crowd' and the 'Perl is winbest' crowd.

For starters, BSD is not dying in my eyes. Linux is great, I love it, but it is seriously bloated. 'But seraphim,' you say, 'you are a fag man for thinking these thingz.' I have recently bought SuSE 8.0 Pro. It is terribly bloated. Its really good for a desktop machine, but for a down and dirty linux box, its just not there. I have also used Redhat 7.0-7.2. They are extremely bloated as well. Not quite to the M$ extreme, but still dangerous. Slackware is the only linux I have used that gets me feeling that I am involved in the console and that its working with me, rather than me forcing it to do things. BSD is a down and dirty OS. Its great for just digging your teeth in and tearing into. It is not your fancy pants linux distro or desktop GUI OS (i leave that up to my new iMac :D
And on the issue of Perl. Perl is not being taken out of FreeBSD. It has not been rebuked by the FreeBSD staff and shunned to the 9th circle of hell. It is, however, not included into the base install. Saving, around 40mb, i believe. Now you say 'You silly fagtrot, thats not that much.' Well, yes and no. Yes it isnt a lot when you are running BSD on a AMD 2100XP with a 80g hard drive. I , however, run my BSD on a 486 with a 800mb hard drive. Space is key to me. If i want to install perl, i simply say, 'Hey there BSD, install me some perl.' Otherwise i dont really need it.

Hopefully this will clear some things up.

Hmmm, mixed feelings on this......

[jsimon12]

At first when I read this I was a little against it, now that I thought about it I am all for it, too many people just leave services open and get hacked. So the less that is loaded the less that can be hacked.

If you want FTP, download the latest version of ProFTPd or Wu-FTPd and load those, same with Apache.

A very dumb idea

[boltar]

No one in their right mind would use one of the
r* tools or telnet to access a box across the
internet. However , for internal connections withing a large organisation they are *vital*.
Anyone who has worked in a large unix shop (I work in a multinational bank) knows that rlogin
and telnet are used all the time to access the various servers over the LAN and VPN , rsh is also
used to do a shell script type of RPC. Getting rid of these tools demonstrates what I've always
thought about OpenBSD , its just a toy to amuse
Theo thats not really aiming at the high end market but rather just as a web server or other
ISP type role. Fine , if thats what they want but
it'll hardly make much difference as their user base is so small it hardly registers anyway.
Bye bye OpenBSD.

Re:A very dumb idea

[Shanep]

No one in their right mind would use one of the r* tools or telnet to access a box across the internet. However , for internal connections withing a large organisation they are *vital*.

Vital, as if there is no better alternative?

With the trend of outsourcing IT HR, bringing IN lots of potentially untrustworthy staff and putting OUT very clued up staff who are now very disgruntled, I would guess that previously already endangered LANS are now becoming even more threatened.

Staff on the way out will be sniffing and key logging their peers, bosses and the new contractors and the new contractors don't have much to loose either, being just another contractor.

Anyone who has worked in a large unix shop (I work in a multinational bank)

I know a very large multinational bank which uses OpenBSD on it's firewalls.

knows that rlogin and telnet are used all the time to access the various servers over the LAN and VPN ,

So the fact that security is usually lacking somehow makes the use of plain text OK within a LAN environment?

Bye bye OpenBSD.

Bye bye DickHEAD.

Re:A very dumb idea

[duffbeer703]

That is nonsense.

My wife works for a large insurance company that handles medical claims. When she was home sick, she simply rsh'd into the companies terminal server from our earthlink account!

She was not 'rooted' or hacked. In fact, her connection was much faster than the useless VPN that I am forced to use.

Re:A very dumb idea

[Shanep]

I work for a major Stock Exchange. We have seperate physical networks for staff, production, development and security.

The production servers are usually accessed via their serial console ports via console servers which are only connected to the security network. Few people have physical or logical access to that network and those servers. Baring that, ssh and scp is the norm where at all possible.

Thanks for letting me know the function of firewalls (my bread and butter).

However, I am merely pointing out, that plain text within a LAN is still very dangerous, especially within an org that has a lot to protect. It removes accountability from the staff because their usernames and passwords cannot be considered completely safe from other staff who may have similar privs.

OpenBSD , its just a toy to amuse Theo thats not really aiming at the high end market but rather just as a web server or other ISP type role.

How does removing insecure tools from an OS that focuses on security make that OS a toy? You can always put it back for Christs sake.

The fact is, that insecure tools are insecure on the internet and within corporate LANS.

Re:A very dumb idea

[karlm]

Agreed. Wholeheartedly.

If you're going to use plaintext tools, you shouldn't even bother having seperate user accounts. Make one user account called "guest" with a null password. It's easier that way, ad it's effectively what you're doing when you use insecure protocols internaly.

Of course, if you're using 100% IPSec internally, then anythign that uses passwords for authentication should be fine. However, IIRC, rsh just checks the source port of the packet and then balieves that you are who you claimto be with absolutely no authentication. IPSec can't help you there.

Re:A very dumb idea

[Shanep]

Why would a disgruntled coder bother with packet sniffing?

Why? Why don't you think about it for a while.

Accountability. Disgruntled worker has God privs across a bunch of mission critical servers (critical to not only the business but to customers in a bank scenario). Servers are in a secure room with video surveilance and the syslog server and line printers are in another secure room which few people have access to or are even aware of all together.

Our poor disgruntled worker would be STUPID BEYOND BELIEF to fuck with any server or network gear in that environment with either his ugly head on video tape or his username plastered all over syslog printouts that he can't get to...

However, this lucky bastard has YOU as a boss and since you called the shots you said, "ah to hell with secure tools, we'll just keeping using the good old r* tools since we trust our staff and our network is behind a nice black firewall!".

So, our disgruntled worker is smarter than you, he sniffs some passwords of people he never liked and a few he now no longer likes...

Now those servers that have been dd if=/dev/zero of=/dev/sda have YOUR name printed on the syslog printouts instead of his.

Guess you've never worked in a big company have you?

So what position do you hold at this bank? Teller?

Re:A very dumb idea

[Shanep]

As for a 2nd seperate network, yeah right, dream on. Where do you work, the CIA?

Huh!? Are you serious? I really want to know your position in this bank, because I am disgusted.

As I have stated elsewhere in this thread, the stock exchange I work for has at least 4 seperate physical networks.

Production: mission critical, it's why we exist and having it compromised would hurt a lot of people and a lot a heads would roll.

Development: This is Production V2.0beta. This needs to be seperated from Production for obvious reasons. Mistakes cost little here and much more people (as required) can have the access they need here to build the new Production system. This network is important in it's own right, it hosts what will some day be on the Production network. If a disgruntled worker put something nasty into this system, it might (slight chance) make it into the Production network when it gets cut over some day, so it needs to be secured as much as possible from people who don't need access to it.

Security (often called Surveilance): Any questions why this needs to be physically seperate, with access provided to only an elite few who associate as little as possible with the rest of the company, including Production sys admins?

Staff (sometimes called Office): A network for ordinary people who use systems on this network and Production systems with very low privs. Often they have seperate machines for work on the seperate Staff and Production networks. They are the interface between the mission critical Production systems and customers, who are also critical to the business.

Each network is extremely important and seperation of each to the maximum that allows the business to work is very much the norm in a company like a stock exchange or a bank.

CIA? How many networks do you rekon they have! They probably have entire departments, as far as staff and systems go, duplicated who watch each other!

Hell, fraud or vandalism of bank or stock exchange systems is something that would rank extremely highly as something the CIA would investigate. Their first contacts would be the guys from security, some of which probably once worked for the CIA!

If I need to access the trading systems here I just telnet in from my sparcstation (assuming I had a login), there is no ssh here FYI.

Sounds like to me you are big noting yourself. Sparcstation sounds cool eh?

You seem to have no clue about a banks network, either that or you work for the First Bank Of Afganistan.

Re:Interesting discussion

[evilviper]

As a BSD'er with +49 Karma, I think I can field this question.

Why post comments on Slashdot's BSD section? Slashdot is a terrible news distribution system, and even worse is the BSD section which is almost completely ignored by the admins.

The point? There are plenty of other BSD sites to discuss these things on.
http://Deadly.org for OpenBSD specific stuff.
http://BSDToday.com for more general BSD stuff.
http://www.daemonnews.org/
http://www.maximumbsd.com/
http://www.freebsdfo rums.org/
http://bsdvault.net/
http://bsdatwork. com/
http://www.bsdfreaks.nl/

And even more, lesser known sites. So my question is, why worry about the slashdot / bsd site which only gets a new bit of info every couple of weeks? There are plenty of better options which have news, tutorials, tips, etc. for those interested in BSD.

Symbolic Importance

[4of12]

I doubt anyone smart enough to install and run OpenBSD is going to be stupid enough to run the r suite of utilities.

But I have to pause in remembrance, because, after all, they are the Berkeley r-suite.

I used them for many years, alongside telnet and ftp, back in the 1980's when 4.2BSD was distributed with my computer. Anyone remember doing tilde escapes to pop back to the local machine?

Even though their security model is insufficient in this present day and age, they really helped to pave the way in showing how remote computers could be accessed in a convenient and powerful way.

It's fitting that a BSD will be the first to retire this venerable set of programs.

R.I.P., r-suite.

Re:Symbolic Importance

[glitchvern]

You can still do tilde escapes in ssh or at least openssh.

fox:~ % ~?
Supported escape sequences:
~. - terminate connection
~R - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to terminate)
~? - this message
~~ - send the escape character by typing it twice
(Note that escapes are only recognized immediately after newline.)

Re:Symbolic Importance

[4of12]

You can still do tilde escapes in ssh or at least openssh.

Most of my usage has been on X displays running multiple virtual terminal sessions.

In the old days, on a single green screen CRT, I had a lot more need for quickly switching sessions in the same terminal window, using tilde escapes and sending jobs into background, etc. Not so much anymore, though.

Re:Symbolic Importance

[4of12]

there are some linux distros out there that don't have the r- suite

You're right.

If I'd thought a minute I probably would have figured out that such Linux distros exist; Tin Foil Hat comes to mind.

Re:Symbolic Importance

[Permission Denied]

You can still do tilde escapes in ssh or at least openssh.

Also works with ssh.com's ssh:

ssh: SSH Secure Shell 3.1.0 (non-commercial version) on sparc-sun-solaris2.8
Supported escape sequences:
~. - terminate connection
~^Z - suspend ssh
~# - list forwarded connections
~- - disable escape character uncancellably
~? - this message
~~ - send the escape character by typing it twice
~V - dump version information to stderr
~s - dump statistics and connection information to stderr
~r - initiate rekey immediately with old algorithms (ie. changes
encryption and integrity keys)
~l - go to line mode (keystrokes are gathered to an internal
buffer, and will be output all at once when you enter
a newline)
(Note that escapes are only recognized immediately after newline.)

I suspend sessions all the time. Lots of fun when you bounce around hosts, eg, ssh from A to B, from B to C, from C to D, etc. You have to remember to hit ~ the correct number of times to suspend to the right machine.

No big deal...

[j-turkey]

Its about time that these tools be phased out -- the services have been shut off (by default) in just about every *nix distribution on the market over the last decade. Someone needs to pioneer killing them -- and a strip-down default install like OpenBSD seems to be the appropriate place to do that.

There's a number of "what about me" folks out there -- who have some mitigating circumstance to need those tools (see here). It seems that these folks are just speaking out to hear themselves speak. Its not like these services are being excluded from the ports tree. Even if they were, you can still grab the source and build it yourself -- hell, there are still binary packages out there that you can just build.

Lastly, as stated in the thread here, its just the servers that are getting the axe, the clients stay...so all of the valuable tools (telnet, rlogin, etc) aren't going away.


-Turkey

Re:Interesting discussion

[mirabilos]

The problem with all these sites is,
that Slashdot is the only where Slashcode
performs quite usable (i.e. several functions
are missing in the versions used by other sites),
and that only here a broad number of readers
gets in touch with BSD.
OTOH, wrt not _commenting_ BSD stories here (and
not even reading the comments) is usually said ok,
because nearly only trolls post.
You are a noble exception.

Heck, if I could still moderate... (this being
The Dark Side of slashdot)

Re:Good bye

[mirabilos]

FTP: I really hate this protocol, but it's still
standard and will be in years.
RSH: Haven't ever used.
Telnet: Uhm... let me say a bit more:
you have to differentiate between the services
(daemons) and the clients. Running telnetd is
bad, and for the case spoken in some of the
first posts, you can write a daemon using
netcat in shell if you want, it takes ten lines or so.
But the client is good for, for example, participiating
in MUDs (I, however, use ssfe(1local) from the net/sirc
port in combination with netcat), or to quickly test
net services such as HTTP, SMTP, etc. or even chatting
in IRC (not that this couldn't be entirely taken over
by netcat, but no GNU OS I know of _has_ our (with IPv6)
netcat).

Thank Fordness...

[fooguy]

It's about time.

I'm an OpenBSD user, and a Perl advocate. I love Perl, but not everyone does. Not everyone needs it, just like not everyone needs Python or tcl/tk.

OpenBSD is the closest thing I've seen to an operating system in a long time. When I install an OS, I want to chose what to turn on, not hope I turned off everything I didn't need. I want to know dozens of eyes have done their best to be sure the OS is secure.

The ports collection is far better than any package management tool I've used (Sun pkgadd, Linux RPM). Not only is it good, but OpenBSD's is the best of any BSD I've used (Free and Net) because it's clean. There is only a tiny chance a port you try and build won't work (::leering at FreeBSD::) and it's so easy that I don't mind doing a make;make install to get Perl.

All that said, Theo's recent rant about r* utils makes perfect sense. Get rid of it!

And while we're at it, toss telnet out with the bathwater. Anyone who isn't using ssh to connect to a remote machine is *begging* to get owned. The only way some people are going to use secure tools is if we force them to. I know at work until I turn telnet off people will use that over ssh because it's familiar, because they don't want to upgrade the 100 year old version of QVTTerm they have.

As for FTP - don't let the door hit you in the ass on the way out. I've been using scp for so long I get physically ill when I see this:

ftp>

Yeah it works, but it's a gaping hole. If people want it, fine, but build the daemon you want from the ports collection. The idea of inetd housing all these "critical" services is just an invite to get owned.

I'm not a huge security nut (my boss won't use a grocery store card because his "marketing data is worth more than what they give me"), but in the battle for securie systems, we are losing! Servers here at work are breeding like rabbits, and everyone is not as savy as you and I. We need to do whatever we can to nudge them in the right direction, not just for their own sake, but for everyones sake.

I got a good laugh out of your reply......

[jsimon12]

Not sure what universe you live in but you need to keep up on patches on any OS you use, whether it is OpenBSD/Solaris/Linux/Winblows etc etc etc. Granted most Unices don't need the level of patching that a Winblows box needs but it is a good admin who keeps his/her eyes open for issues that need to be resolved. But if that isn't your method for admining would you mind posting the IP's for boxes you manage, I need something to root ;)

Don't lose telnet.

[dsb3]

I use telnet more often than I use ssh.

Ssh - I use for connecting to other machines.
Telnet - I use for testing webservers, mail servers, news servers, testing whether ssh servers are alive and what version they're running, etc etc.

Just because the telnet DAEMON is undesirable doesn't mean the client is so too.

Re:Don't lose telnet.

[ZiZ]

I always use Netcat or one of its variants (such as OpenBSD's obnc or cryptcat, say) to do that sort of thing, and a number of other little wierdnesses besides. Certainly it isn't as smart as telnet, but it does the jobs I need it to and more besides.

Re:Don't lose telnet.

[dsb3]

That's a good point. I could (with effort, and perhaps some self-hypnotism) start to type n-e-t-c-a-t instead of t-e-l-n-e-t. After all, it's only taken me a year to start typing h-o-s-t instead of n-s-l-o-o-k-u-p :-)

Re:Don't lose telnet.

[Permission Denied]

I could (with effort, and perhaps some self-hypnotism) start to type n-e-t-c-a-t

The name of the command is actually "nc" - like any proper unix tool it has a terse, easy-to-chord-type name ("n" and "c" are on different fingers :)

they need to make sure...

[msouth]

...that they remove "rm" last.

I believe the exact words were

[Hektor_Troy]

Neitzsche? Nope - he doesn't exist in any of my history books.

Re:I believe the exact words were

[Amarok.Org]

T-shirt seen:

Front: "God is dead." - Neitzsche
Back : "Neitzsche is dead." - God

How to transfer files securely and quickly?

[treat]

The problem when rsh and ftp are removed, is that there is no way to transfer files at wire speed. ssh is too slow for 100Mbit networks, let alone gigabit. Is there any software that solves this problem, perhaps with secure authentication and protection against alteration of the data stream?

two comments

[thogard]

Pulling Perl from the base package will limit the flexibility for many of the set up scripts but I can see where the size of Perl has gotten way out of hand. Maybe they should look at mini-perl (the one perl uses to configure its self) might be worth considering.

The R commands need to go away but I'm wondering if the best option is to fix them properly. The idea here is to put together a library (maybe a fork of getops) so that you can take most standard programs that use stdio and make r versions of them by linking to the proper library. This way things like rmt (remote mag tape) and its friends restore and dump would all still work in a modern enviroment. There is no current version of dump or restore that works the way old rmt versions do and most of us still like to do backups from time to time.