1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
=for stopwords
remctl -dhv subcommand remctld GSS-API GSS-API's hostname AFS
canonicalizes DNS DNS-based canonicalization Heimdal MICs Ushakov Allbery
triple-DES MERCHANTABILITY IP IPv4 IPv6 source-ip IANA-registered
SPDX-License-Identifier FSFAP
=head1 NAME
remctl - Remote execution tool
=head1 SYNOPSIS
remctl [B<-dhv>] [B<-b> I<source-ip>] [B<-p> I<port>] [B<-s> I<service>]
I<host> I<command> [I<subcommand> [I<parameters> ...]]
=head1 DESCRIPTION
B<remctl> is a program that allows a user to execute commands remotely on
a server that is running the remctld daemon. B<remctl> does not interpret
the commands given to it. It passes them to the server and displays the
return message. The commands must be defined on the server-side before a
B<remctl> client can execute them, and the user running B<remctl> must be
authorized to execute the particular command on the server.
Access to remote commands is authenticated via Kerberos GSS-API, so a user
must have a ticket granting ticket to use B<remctl>. All transmissions to
and from the remctld server are encrypted using GSS-API's security layer.
I<host> is the hostname of the target server. I<command> and
I<subcommand> together specify the command to run and correspond to the
command names in the configuration file on the server. I<parameters> are
any additional command-line parameters to pass to the remote command.
=head1 OPTIONS
The start of each option description is annotated with the version of
B<remctl> in which that option was added with its current meaning.
=over 4
=item B<-b> I<source-ip>
[3.0] When connecting to the remote remctl server, use I<source-ip> as the
source IP address. This can be useful on multihomed systems where the
remctl connections need to be made over a particular network.
I<source-ip> must be an IP address, not a hostname, and can be either an
IPv4 or IPv6 address (assuming IPv6 is supported).
=item B<-d>
[1.10] Turn on extra debugging output of the client-server interaction.
=item B<-h>
[1.10] Show a brief usage message and then exit.
=item B<-p> I<port>
[1.0] Connect to the server on I<port>. If this option isn't given, the
client first tries the registered remctl port (4373) and then falls back
on the legacy port (4444) if that fails.
=item B<-s> I<service>
[1.0] Authenticate to the server with a service ticket for I<service>
rather than the default server identity of host/I<hostname>. This may be
necessary with, for instance, a server where B<remctld> is not running as
root.
=item B<-v>
[1.10] Print the version of B<remctl> and exit.
=back
=head1 EXIT STATUS
B<remctl> will exit with the exit status returned by the remote command.
If some network or authentication error occurred and B<remctl> was unable
to run the remote command or retrieve its exit status, or if B<remctl> was
called with invalid arguments, B<remctl> will exit with status 1.
=head1 EXAMPLES
Release an AFS volume called ls.tripwire:
remctl lsdb afs release ls.tripwire
=head1 COMPATIBILITY
The default port was changed to the IANA-registered port of 4373 in
version 2.11.
Support for IPv6 was added in version 2.4.
=head1 CAVEATS
If no principal is specified with B<-s>, B<remctl> canonicalizes the
server host name using DNS before connecting. This ensures that the
network connection and the GSS-API authentication use the same server name
even if some common DNS-based load-balancing schemes are in use. To
disable this canonicalization, specify the server principal using B<-s>.
The default behavior, when the port is not specified, of trying 4373 and
falling back to 4444 will be removed in a future version of B<remctl> in
favor of using the C<remctl> service in F</etc/services> if set and then
falling back on only 4373. 4444 was the poorly-chosen original remctl
port and should be phased out.
When using Heimdal with triple-DES keys and talking to old servers that
only speak version one of the remctl protocol, B<remctl> may have problems
with MIC verification. This doesn't affect new clients and servers since
the version two protocol doesn't use MICs. If you are using Heimdal and
run into MIC verification problems, see the COMPATIBILITY section of
gssapi(3).
=head1 NOTES
The remctl port number, 4373, was derived by tracing the diagonals of a
QWERTY keyboard up from the letters C<remc> to the number row.
=head1 AUTHOR
B<remctl> was originally written by Anton Ushakov. Updates and current
maintenance are done by Russ Allbery <eagle@eyrie.org>.
=head1 COPYRIGHT AND LICENSE
Copyright 2002-2011, 2014 The Board of Trustees of the Leland Stanford
Junior University
Copying and distribution of this file, with or without modification, are
permitted in any medium without royalty provided the copyright notice and
this notice are preserved. This file is offered as-is, without any
warranty.
SPDX-License-Identifier: FSFAP
=head1 SEE ALSO
kinit(1), remctld(8)
The current version of this program is available from its web page at
L<https://www.eyrie.org/~eagle/software/remctl/>.
=cut
|
