Securig rtools, or should we enhance ssh performance?

Hi all,

I work in a multiplatform environment where  there are windows, and several Unix flavors, and they happen to use the rtools rlogin,rsh to authenticate themselves with out passwords running intensive jobs in application server cluster. 

we ran into a problem last week when one  developer by mistake using java commons lib from the apache project managed to impersonate another users, and access thier home dir which are nfs mounted remotely, most of the users are researchers so they ususllay have permisive permissions in their .rhosts.  

Any Window host on the network could allow a user to change his login identity and login as a different user to a UNIX machine using the rtools, due to the fact that /etc/hosts.equiv is not honored as the local user has changed, and .rhosts is allowing all machines defined in the nfsall netgroups. Windows machines through customized java software could change the remote user identity, enabling them to login to the other user without using passwords.

The reason that the users prefer rtools over ssh is that they do not want to learn a new  tool, and they have concerns regarding ssh/scp performance compared to the rtools, and at  last that they belive they do work in a closed trusted environment .

now my questions is two :

1- how can one move from the rtools to OpenSSH, and how could one enhance the performace of ssh? we are talking here around 500 users accessing a number of several servers scattered around in different clusters.

2- Now in the linux servers, i can add no_rhosts option to the /etc/pam.d/rlogin pam_rhosts module for example. and that will force the server to check the strict /etc/hosts.equiv, and ignore the .rhosts file, but how can i do this in other platforms like AIX 5.1/5.2, Solaris 8/9, and SGI.

The temporary Linux Solution was :
1- Enforce /etc/hosts.equiv by adding a line to the pam configuration file stating to ignore the .rhosts file using the option no_rhosts
2- Fill in the /etc/hosts.equiv with the following:
@windowshosts  -
+@UnixHosts

Or  Just

+@UnixHosts


Regards,

Alaa
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers