Xinetd Wrong rhost print in /var/log/secure for rexec daemon on failure calls

General support questions
Post Reply
psuresh
Posts: 6
Joined: 2017/07/03 13:47:48

Xinetd Wrong rhost print in /var/log/secure for rexec daemon on failure calls

Post by psuresh » 2020/01/03 17:36:29

My Client = 172.x.x.1
rexecd running server = 172.x.x.2

I'm running rexec server with Xinetd on my CentOS7.6 server. When i run rexec server without "server_args= -D" in /etc/xinet.d/rexec i'm getting proper client ip in /var/log/secure when authentication failure happen.

But when i run rexec server with "server_args= -D" in /etc/xinet.d/rexec i'm getting wrong/strange client IP address in /var/log/secure.

/var/log/secure:
Jan 3 22:29:12 172 in.rexecd[7618]: pam_unix(rexec:auth): authentication failure; logname= uid=0 euid=0 tty=rexec ruser=test rhost=2.0.227.234 user=test
Jan 3 22:37:54 172 in.rexecd[9565]: pam_unix(rexec:auth): authentication failure; logname= uid=0 euid=0 tty=rexec ruser=test rhost=2.0.228.16 user=test

/etc/xinet.d/rexec for your reference:
service exec
{
socket_type = stream
wait = no
user = root
log_on_success += USERID
log_on_failure += USERID
server = /usr/sbin/in.rexecd
disable = no
server_args = -D
}
I want to get actual client ip with "server_args= -D". Can someone help me on this!!

Post Reply