In addition, the users on that host cannot alway be trusted. If a cracker manages to break into an account on a host, and that host is trusted by other systems, the user's accounts on all the other systems are compromised. Individual users may set up a similar private equivalence list with the file .rhosts in their home directories. Each line in this file contains a hostname and a username separated by a space. An entry in a user's remote .rhosts file permits the user who is logged into the system specified by hostname to login to the remote system without supplying a password.
Users are more likely to tailor their .rhosts files more for convenience than for security.
Trusted hosts involve a security risk for accounts which have an asterisk in the encrypted password field of the password file. Prompting for a password is a threat because the password is sent unencrypted in a single packet over the network. Trusted users on trusted hosts are allowed to execute rsh and rcp commands without requiring a password to be entered. The rsh program will not prompt for a password if access is denied on the remote system unless the command argument is omitted. If a command argument is not specified for rsh , rsh logs the user onto the remote system using rlogin .