From: eirik@elf.TN.Cornell.EDU (Eirik Fuller)
Newsgroups: alt.hackers
Subject: .rhosts/
Date: 9 Sep 1992 14:56:24 GMT
Organization: Cornell Theory Center
NNTP-Posting-Host: localhost

Years ago, before I took Internet access for granted, I had a rather
sluggish Internet connection.  It offered impedance in two flavors,
hardware limitations and administrative foolishness.  The former was
understandable, to a degree, particularly in view of the usual
budgetary concerns and such, but I can't truthfully claim I ever fully
understood the latter.  Still, it gave me an excuse to try out an idea
that had been brewing in my mind for months.

Most of my employer's networks back then were completely hidden behind
a firewall; for all I know, they still are, assuming that company
hasn't yet been dissolved by corporate raiders.  The subnet hosting my
machine was partially hidden; one of the things excluded by the
firewall was name service.  Only one subnet in the company had the
privilege of querying Internet DNS servers, and no machine on that
subnet passed any information obtained that way to the other subnets.

My first reaction to that barrier was to get a guest account on the
magic subnet, and rig a stupid little shell script to update my hosts
file, as necessary, based on information obtained from that guest
account.  Unfortunately, this script was stymied by the mysterious
cronic disappearance of the .rhosts file it needed on the guest
account.

That mystery was quickly solved with the help of a publicly readable
crontab.  The culprit itself was hidden away in a paranoid-protected
directory, but its name was plain enough.

The idea that had been brewing in my mind was making a directory named
.rhosts, which served the same purpose as the usual plain file by that
name.  The unreadability of the .rhosts-stomper increased my curiosity
beyond the threshold of indifference.

The guest account was on a machine that didn't know mine by name, but
its rshd happily accepted IP addresses.  One mkdir, followed by an
empty redirection with a couple of newlines wrapped in quotes,
surrounding an IP address, was enough to give me a working .rhosts
directory.  Just for fun, I chmoded it and its contents to zero, with
no apparent ill effect.

Because I wasn't able to read the .rhosts-stomper, I had no idea how
long my .rhosts directory might survive.  I guess it survived for
quite a while, because it continued to work with no further
intervention on my part, but as it happened it wasn't terribly useful,
since that host got increasingly sluggish as time went on.  At one
point, after some number of minutes of patiently waiting for a
response, I observed a load average in the 40s.  After a much larger
delay, ps output (via rsh) showed why; the process table was stuffed
to the gills with processes of the form

	find /home/mumble -name .rhosts -mumble,mumble

Did I mention the absence of numbers in the crontab entry for the
.rhosts-stomper?  Apparently its author was sufficiently confident of
its quickness to have no real qualms about unleashing it at every
opporcronity.  I suppose if it had succeeded in its presumed goal, it
should have died down on its own.

I guess what I found the most baffling was why anyone might think any
construct involving find could be preferable to, say

	rm -f /home/mumble/*/.rhosts

or, for someone sufficiently demented,

	rm -rf /home/mumble/*/.rhosts

I wonder if the author of that .rhosts-stomper uses a machine gun as a
flyswatter ...