1 /*- 2 * Copyright (c) 1988, 1989 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifndef lint 35 char copyright[] = 36 "@(#) Copyright (c) 1988, 1989 The Regents of the University of California.\n\ 37 All rights reserved.\n"; 38 #endif /* not lint */ 39 40 #ifndef lint 41 /*static char sccsid[] = "from: @(#)rshd.c 5.38 (Berkeley) 3/2/91";*/ 42 static char rcsid[] = "$Id: rshd.c,v 1.2 1993/08/01 18:29:42 mycroft Exp $"; 43 #endif /* not lint */ 44 45 /* 46 * From: 47 * $Source: /cvsroot/src/libexec/rshd/rshd.c,v $ 48 * $Header: /mit/kerberos/ucb/mit/rshd/RCS/rshd.c,v 49 * 5.2 89/07/31 19:30:04 kfall Exp $ 50 */ 51 52 /* 53 * remote shell server: 54 * [port]\0 55 * remuser\0 56 * locuser\0 57 * command\0 58 * data 59 */ 60 #include <sys/param.h> 61 #include <sys/ioctl.h> 62 #include <sys/time.h> 63 #include <fcntl.h> 64 #include <signal.h> 65 66 #include <sys/socket.h> 67 #include <netinet/in.h> 68 #include <arpa/inet.h> 69 #include <netdb.h> 70 71 #include <pwd.h> 72 #include <syslog.h> 73 #include <arpa/nameser.h> 74 #include <resolv.h> 75 #include <unistd.h> 76 #include <errno.h> 77 #include <stdio.h> 78 #include <stdlib.h> 79 #include <string.h> 80 #include <paths.h> 81 82 int keepalive = 1; 83 int check_all = 0; 84 char *index(), *rindex(), *strncat(); 85 /*VARARGS1*/ 86 int error(); 87 int sent_null; 88 89 #ifdef KERBEROS 90 #include <kerberosIV/des.h> 91 #include <kerberosIV/krb.h> 92 #define VERSION_SIZE 9 93 #define SECURE_MESSAGE "This rsh session is using DES encryption for all transmissions.\r\n" 94 #define OPTIONS "alknvx" 95 char authbuf[sizeof(AUTH_DAT)]; 96 char tickbuf[sizeof(KTEXT_ST)]; 97 int doencrypt, use_kerberos, vacuous; 98 Key_schedule schedule; 99 #else 100 #define OPTIONS "aln" 101 #endif 102 103 /*ARGSUSED*/ 104 main(argc, argv) 105 int argc; 106 char **argv; 107 { 108 extern int opterr, optind; 109 extern int _check_rhosts_file; 110 struct linger linger; 111 int ch, on = 1, fromlen; 112 struct sockaddr_in from; 113 114 openlog("rshd", LOG_PID | LOG_ODELAY, LOG_DAEMON); 115 116 opterr = 0; 117 while ((ch = getopt(argc, argv, OPTIONS)) != EOF) 118 switch (ch) { 119 case 'a': 120 check_all = 1; 121 break; 122 case 'l': 123 _check_rhosts_file = 0; 124 break; 125 case 'n': 126 keepalive = 0; 127 break; 128 #ifdef KERBEROS 129 case 'k': 130 use_kerberos = 1; 131 break; 132 133 case 'v': 134 vacuous = 1; 135 break; 136 137 #ifdef CRYPT 138 case 'x': 139 doencrypt = 1; 140 break; 141 #endif 142 #endif 143 case '?': 144 default: 145 usage(); 146 exit(2); 147 } 148 149 argc -= optind; 150 argv += optind; 151 152 #ifdef KERBEROS 153 if (use_kerberos && vacuous) { 154 syslog(LOG_ERR, "only one of -k and -v allowed"); 155 exit(2); 156 } 157 #ifdef CRYPT 158 if (doencrypt && !use_kerberos) { 159 syslog(LOG_ERR, "-k is required for -x"); 160 exit(2); 161 } 162 #endif 163 #endif 164 165 fromlen = sizeof (from); 166 if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) { 167 syslog(LOG_ERR, "getpeername: %m"); 168 _exit(1); 169 } 170 if (keepalive && 171 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, (char *)&on, 172 sizeof(on)) < 0) 173 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m"); 174 linger.l_onoff = 1; 175 linger.l_linger = 60; /* XXX */ 176 if (setsockopt(0, SOL_SOCKET, SO_LINGER, (char *)&linger, 177 sizeof (linger)) < 0) 178 syslog(LOG_WARNING, "setsockopt (SO_LINGER): %m"); 179 doit(&from); 180 } 181 182 char username[20] = "USER="; 183 char homedir[64] = "HOME="; 184 char shell[64] = "SHELL="; 185 char path[100] = "PATH="; 186 char *envinit[] = 187 {homedir, shell, path, username, 0}; 188 char **environ; 189 190 doit(fromp) 191 struct sockaddr_in *fromp; 192 { 193 char cmdbuf[NCARGS+1], *cp; 194 char locuser[16], remuser[16]; 195 struct passwd *pwd; 196 int s; 197 struct hostent *hp; 198 char *hostname, *errorstr = NULL, *errorhost; 199 u_short port; 200 int pv[2], pid, cc; 201 int nfd; 202 fd_set ready, readfrom; 203 char buf[BUFSIZ], sig; 204 int one = 1; 205 char remotehost[2 * MAXHOSTNAMELEN + 1]; 206 207 #ifdef KERBEROS 208 AUTH_DAT *kdata = (AUTH_DAT *) NULL; 209 KTEXT ticket = (KTEXT) NULL; 210 char instance[INST_SZ], version[VERSION_SIZE]; 211 struct sockaddr_in fromaddr; 212 int rc; 213 long authopts; 214 int pv1[2], pv2[2]; 215 fd_set wready, writeto; 216 217 fromaddr = *fromp; 218 #endif 219 220 (void) signal(SIGINT, SIG_DFL); 221 (void) signal(SIGQUIT, SIG_DFL); 222 (void) signal(SIGTERM, SIG_DFL); 223 #ifdef DEBUG 224 { int t = open(_PATH_TTY, 2); 225 if (t >= 0) { 226 ioctl(t, TIOCNOTTY, (char *)0); 227 (void) close(t); 228 } 229 } 230 #endif 231 fromp->sin_port = ntohs((u_short)fromp->sin_port); 232 if (fromp->sin_family != AF_INET) { 233 syslog(LOG_ERR, "malformed \"from\" address (af %d)\n", 234 fromp->sin_family); 235 exit(1); 236 } 237 #ifdef IP_OPTIONS 238 { 239 u_char optbuf[BUFSIZ/3], *cp; 240 char lbuf[BUFSIZ], *lp; 241 int optsize = sizeof(optbuf), ipproto; 242 struct protoent *ip; 243 244 if ((ip = getprotobyname("ip")) != NULL) 245 ipproto = ip->p_proto; 246 else 247 ipproto = IPPROTO_IP; 248 if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) && 249 optsize != 0) { 250 lp = lbuf; 251 for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3) 252 sprintf(lp, " %2.2x", *cp); 253 syslog(LOG_NOTICE, 254 "Connection received from %s using IP options (ignored):%s", 255 inet_ntoa(fromp->sin_addr), lbuf); 256 if (setsockopt(0, ipproto, IP_OPTIONS, 257 (char *)NULL, optsize) != 0) { 258 syslog(LOG_ERR, "setsockopt IP_OPTIONS NULL: %m"); 259 exit(1); 260 } 261 } 262 } 263 #endif 264 265 #ifdef KERBEROS 266 if (!use_kerberos) 267 #endif 268 if (fromp->sin_port >= IPPORT_RESERVED || 269 fromp->sin_port < IPPORT_RESERVED/2) { 270 syslog(LOG_NOTICE|LOG_AUTH, 271 "Connection from %s on illegal port", 272 inet_ntoa(fromp->sin_addr)); 273 exit(1); 274 } 275 276 (void) alarm(60); 277 port = 0; 278 for (;;) { 279 char c; 280 if ((cc = read(0, &c, 1)) != 1) { 281 if (cc < 0) 282 syslog(LOG_NOTICE, "read: %m"); 283 shutdown(0, 1+1); 284 exit(1); 285 } 286 if (c== 0) 287 break; 288 port = port * 10 + c - '0'; 289 } 290 291 (void) alarm(0); 292 if (port != 0) { 293 int lport = IPPORT_RESERVED - 1; 294 s = rresvport(&lport); 295 if (s < 0) { 296 syslog(LOG_ERR, "can't get stderr port: %m"); 297 exit(1); 298 } 299 #ifdef KERBEROS 300 if (!use_kerberos) 301 #endif 302 if (port >= IPPORT_RESERVED) { 303 syslog(LOG_ERR, "2nd port not reserved\n"); 304 exit(1); 305 } 306 fromp->sin_port = htons(port); 307 if (connect(s, (struct sockaddr *)fromp, sizeof (*fromp)) < 0) { 308 syslog(LOG_INFO, "connect second port: %m"); 309 exit(1); 310 } 311 } 312 313 #ifdef KERBEROS 314 if (vacuous) { 315 error("rshd: remote host requires Kerberos authentication\n"); 316 exit(1); 317 } 318 #endif 319 320 #ifdef notdef 321 /* from inetd, socket is already on 0, 1, 2 */ 322 dup2(f, 0); 323 dup2(f, 1); 324 dup2(f, 2); 325 #endif 326 hp = gethostbyaddr((char *)&fromp->sin_addr, sizeof (struct in_addr), 327 fromp->sin_family); 328 if (hp) { 329 /* 330 * If name returned by gethostbyaddr is in our domain, 331 * attempt to verify that we haven't been fooled by someone 332 * in a remote net; look up the name and check that this 333 * address corresponds to the name. 334 */ 335 hostname = hp->h_name; 336 #ifdef KERBEROS 337 if (!use_kerberos) 338 #endif 339 if (check_all || local_domain(hp->h_name)) { 340 strncpy(remotehost, hp->h_name, sizeof(remotehost) - 1); 341 remotehost[sizeof(remotehost) - 1] = 0; 342 errorhost = remotehost; 343 #ifdef RES_DNSRCH 344 _res.options &= ~RES_DNSRCH; 345 #endif 346 hp = gethostbyname(remotehost); 347 if (hp == NULL) { 348 syslog(LOG_INFO, 349 "Couldn't look up address for %s", 350 remotehost); 351 errorstr = 352 "Couldn't look up address for your host (%s)\n"; 353 hostname = inet_ntoa(fromp->sin_addr); 354 } else for (; ; hp->h_addr_list++) { 355 if (hp->h_addr_list[0] == NULL) { 356 syslog(LOG_NOTICE, 357 "Host addr %s not listed for host %s", 358 inet_ntoa(fromp->sin_addr), 359 hp->h_name); 360 errorstr = 361 "Host address mismatch for %s\n"; 362 hostname = inet_ntoa(fromp->sin_addr); 363 break; 364 } 365 if (!bcmp(hp->h_addr_list[0], 366 (caddr_t)&fromp->sin_addr, 367 sizeof(fromp->sin_addr))) { 368 hostname = hp->h_name; 369 break; 370 } 371 } 372 } 373 } else 374 errorhost = hostname = inet_ntoa(fromp->sin_addr); 375 376 #ifdef KERBEROS 377 if (use_kerberos) { 378 kdata = (AUTH_DAT *) authbuf; 379 ticket = (KTEXT) tickbuf; 380 authopts = 0L; 381 strcpy(instance, "*"); 382 version[VERSION_SIZE - 1] = '\0'; 383 #ifdef CRYPT 384 if (doencrypt) { 385 struct sockaddr_in local_addr; 386 rc = sizeof(local_addr); 387 if (getsockname(0, (struct sockaddr *)&local_addr, 388 &rc) < 0) { 389 syslog(LOG_ERR, "getsockname: %m"); 390 error("rlogind: getsockname: %m"); 391 exit(1); 392 } 393 authopts = KOPT_DO_MUTUAL; 394 rc = krb_recvauth(authopts, 0, ticket, 395 "rcmd", instance, &fromaddr, 396 &local_addr, kdata, "", schedule, 397 version); 398 des_set_key(kdata->session, schedule); 399 } else 400 #endif 401 rc = krb_recvauth(authopts, 0, ticket, "rcmd", 402 instance, &fromaddr, 403 (struct sockaddr_in *) 0, 404 kdata, "", (bit_64 *) 0, version); 405 if (rc != KSUCCESS) { 406 error("Kerberos authentication failure: %s\n", 407 krb_err_txt[rc]); 408 exit(1); 409 } 410 } else 411 #endif 412 getstr(remuser, sizeof(remuser), "remuser"); 413 414 getstr(locuser, sizeof(locuser), "locuser"); 415 getstr(cmdbuf, sizeof(cmdbuf), "command"); 416 setpwent(); 417 pwd = getpwnam(locuser); 418 if (pwd == NULL) { 419 if (errorstr == NULL) 420 errorstr = "Login incorrect.\n"; 421 goto fail; 422 } 423 if (chdir(pwd->pw_dir) < 0) { 424 (void) chdir("/"); 425 #ifdef notdef 426 error("No remote directory.\n"); 427 exit(1); 428 #endif 429 } 430 431 #ifdef KERBEROS 432 if (use_kerberos) { 433 if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0') { 434 if (kuserok(kdata, locuser) != 0) { 435 syslog(LOG_NOTICE|LOG_AUTH, 436 "Kerberos rsh denied to %s.%s@%s", 437 kdata->pname, kdata->pinst, kdata->prealm); 438 error("Permission denied.\n"); 439 exit(1); 440 } 441 } 442 } else 443 #endif 444 445 if (errorstr || 446 pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' && 447 ruserok(hostname, pwd->pw_uid == 0, remuser, locuser) < 0) { 448 fail: 449 if (errorstr == NULL) 450 errorstr = "Permission denied.\n"; 451 error(errorstr, errorhost); 452 exit(1); 453 } 454 455 if (pwd->pw_uid && !access(_PATH_NOLOGIN, F_OK)) { 456 error("Logins currently disabled.\n"); 457 exit(1); 458 } 459 460 (void) write(2, "\0", 1); 461 sent_null = 1; 462 463 if (port) { 464 if (pipe(pv) < 0) { 465 error("Can't make pipe.\n"); 466 exit(1); 467 } 468 #ifdef CRYPT 469 #ifdef KERBEROS 470 if (doencrypt) { 471 if (pipe(pv1) < 0) { 472 error("Can't make 2nd pipe.\n"); 473 exit(1); 474 } 475 if (pipe(pv2) < 0) { 476 error("Can't make 3rd pipe.\n"); 477 exit(1); 478 } 479 } 480 #endif 481 #endif 482 pid = fork(); 483 if (pid == -1) { 484 error("Can't fork; try again.\n"); 485 exit(1); 486 } 487 if (pid) { 488 #ifdef CRYPT 489 #ifdef KERBEROS 490 if (doencrypt) { 491 static char msg[] = SECURE_MESSAGE; 492 (void) close(pv1[1]); 493 (void) close(pv2[1]); 494 des_write(s, msg, sizeof(msg)); 495 496 } else 497 #endif 498 #endif 499 { 500 (void) close(0); (void) close(1); 501 } 502 (void) close(2); (void) close(pv[1]); 503 504 FD_ZERO(&readfrom); 505 FD_SET(s, &readfrom); 506 FD_SET(pv[0], &readfrom); 507 if (pv[0] > s) 508 nfd = pv[0]; 509 else 510 nfd = s; 511 #ifdef CRYPT 512 #ifdef KERBEROS 513 if (doencrypt) { 514 FD_ZERO(&writeto); 515 FD_SET(pv2[0], &writeto); 516 FD_SET(pv1[0], &readfrom); 517 518 nfd = MAX(nfd, pv2[0]); 519 nfd = MAX(nfd, pv1[0]); 520 } else 521 #endif 522 #endif 523 ioctl(pv[0], FIONBIO, (char *)&one); 524 525 /* should set s nbio! */ 526 nfd++; 527 do { 528 ready = readfrom; 529 #ifdef CRYPT 530 #ifdef KERBEROS 531 if (doencrypt) { 532 wready = writeto; 533 if (select(nfd, &ready, 534 &wready, (fd_set *) 0, 535 (struct timeval *) 0) < 0) 536 break; 537 } else 538 #endif 539 #endif 540 if (select(nfd, &ready, (fd_set *)0, 541 (fd_set *)0, (struct timeval *)0) < 0) 542 break; 543 if (FD_ISSET(s, &ready)) { 544 int ret; 545 #ifdef CRYPT 546 #ifdef KERBEROS 547 if (doencrypt) 548 ret = des_read(s, &sig, 1); 549 else 550 #endif 551 #endif 552 ret = read(s, &sig, 1); 553 if (ret <= 0) 554 FD_CLR(s, &readfrom); 555 else 556 killpg(pid, sig); 557 } 558 if (FD_ISSET(pv[0], &ready)) { 559 errno = 0; 560 cc = read(pv[0], buf, sizeof(buf)); 561 if (cc <= 0) { 562 shutdown(s, 1+1); 563 FD_CLR(pv[0], &readfrom); 564 } else { 565 #ifdef CRYPT 566 #ifdef KERBEROS 567 if (doencrypt) 568 (void) 569 des_write(s, buf, cc); 570 else 571 #endif 572 #endif 573 (void) 574 write(s, buf, cc); 575 } 576 } 577 #ifdef CRYPT 578 #ifdef KERBEROS 579 if (doencrypt && FD_ISSET(pv1[0], &ready)) { 580 errno = 0; 581 cc = read(pv1[0], buf, sizeof(buf)); 582 if (cc <= 0) { 583 shutdown(pv1[0], 1+1); 584 FD_CLR(pv1[0], &readfrom); 585 } else 586 (void) des_write(1, buf, cc); 587 } 588 589 if (doencrypt && FD_ISSET(pv2[0], &wready)) { 590 errno = 0; 591 cc = des_read(0, buf, sizeof(buf)); 592 if (cc <= 0) { 593 shutdown(pv2[0], 1+1); 594 FD_CLR(pv2[0], &writeto); 595 } else 596 (void) write(pv2[0], buf, cc); 597 } 598 #endif 599 #endif 600 601 } while (FD_ISSET(s, &readfrom) || 602 #ifdef CRYPT 603 #ifdef KERBEROS 604 (doencrypt && FD_ISSET(pv1[0], &readfrom)) || 605 #endif 606 #endif 607 FD_ISSET(pv[0], &readfrom)); 608 exit(0); 609 } 610 setpgrp(0, getpid()); 611 (void) close(s); (void) close(pv[0]); 612 #ifdef CRYPT 613 #ifdef KERBEROS 614 if (doencrypt) { 615 close(pv1[0]); close(pv2[0]); 616 dup2(pv1[1], 1); 617 dup2(pv2[1], 0); 618 close(pv1[1]); 619 close(pv2[1]); 620 } 621 #endif 622 #endif 623 dup2(pv[1], 2); 624 close(pv[1]); 625 } 626 if (*pwd->pw_shell == '\0') 627 pwd->pw_shell = _PATH_BSHELL; 628 #if BSD > 43 629 if (setlogin(pwd->pw_name) < 0) 630 syslog(LOG_ERR, "setlogin() failed: %m"); 631 #endif 632 (void) setgid((gid_t)pwd->pw_gid); 633 initgroups(pwd->pw_name, pwd->pw_gid); 634 (void) setuid((uid_t)pwd->pw_uid); 635 environ = envinit; 636 strncat(homedir, pwd->pw_dir, sizeof(homedir)-6); 637 strcat(path, _PATH_DEFPATH); 638 strncat(shell, pwd->pw_shell, sizeof(shell)-7); 639 strncat(username, pwd->pw_name, sizeof(username)-6); 640 cp = rindex(pwd->pw_shell, '/'); 641 if (cp) 642 cp++; 643 else 644 cp = pwd->pw_shell; 645 endpwent(); 646 if (pwd->pw_uid == 0) { 647 #ifdef KERBEROS 648 if (use_kerberos) 649 syslog(LOG_INFO|LOG_AUTH, 650 "ROOT Kerberos shell from %s.%s@%s on %s, comm: %s\n", 651 kdata->pname, kdata->pinst, kdata->prealm, 652 hostname, cmdbuf); 653 else 654 #endif 655 syslog(LOG_INFO|LOG_AUTH, 656 "ROOT shell from %s@%s, comm: %s\n", 657 remuser, hostname, cmdbuf); 658 } 659 execl(pwd->pw_shell, cp, "-c", cmdbuf, 0); 660 perror(pwd->pw_shell); 661 exit(1); 662 } 663 664 /* 665 * Report error to client. 666 * Note: can't be used until second socket has connected 667 * to client, or older clients will hang waiting 668 * for that connection first. 669 */ 670 /*VARARGS1*/ 671 error(fmt, a1, a2, a3) 672 char *fmt; 673 int a1, a2, a3; 674 { 675 char buf[BUFSIZ], *bp = buf; 676 677 if (sent_null == 0) 678 *bp++ = 1; 679 (void) sprintf(bp, fmt, a1, a2, a3); 680 (void) write(2, buf, strlen(buf)); 681 } 682 683 getstr(buf, cnt, err) 684 char *buf; 685 int cnt; 686 char *err; 687 { 688 char c; 689 690 do { 691 if (read(0, &c, 1) != 1) 692 exit(1); 693 *buf++ = c; 694 if (--cnt == 0) { 695 error("%s too long\n", err); 696 exit(1); 697 } 698 } while (c != 0); 699 } 700 701 /* 702 * Check whether host h is in our local domain, 703 * defined as sharing the last two components of the domain part, 704 * or the entire domain part if the local domain has only one component. 705 * If either name is unqualified (contains no '.'), 706 * assume that the host is local, as it will be 707 * interpreted as such. 708 */ 709 local_domain(h) 710 char *h; 711 { 712 char localhost[MAXHOSTNAMELEN]; 713 char *p1, *p2, *topdomain(); 714 715 localhost[0] = 0; 716 (void) gethostname(localhost, sizeof(localhost)); 717 p1 = topdomain(localhost); 718 p2 = topdomain(h); 719 if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2)) 720 return(1); 721 return(0); 722 } 723 724 char * 725 topdomain(h) 726 char *h; 727 { 728 register char *p; 729 char *maybe = NULL; 730 int dots = 0; 731 732 for (p = h + strlen(h); p >= h; p--) { 733 if (*p == '.') { 734 if (++dots == 2) 735 return (p); 736 maybe = p; 737 } 738 } 739 return (maybe); 740 } 741 742 usage() 743 { 744 syslog(LOG_ERR, "usage: rshd [-%s]", OPTIONS); 745 } 746