# rlogin

- Opens ports between 512-514

<table border="1" id="bkmrk-service-port-protoco" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col></colgroup><thead><tr><td>Service</td><td>Port</td><td>Protocol</td></tr></thead><tbody><tr><td>rcp</td><td>514</td><td>TCP</td></tr><tr><td>rexec</td><td>512</td><td>TCP</td></tr><tr><td>rlogin</td><td>513</td><td>TCP</td></tr><tr><td>rsh</td><td>514</td><td>TCP</td></tr><tr><td>rstat</td><td>  
</td><td>UDP</td></tr><tr><td>ruptime</td><td>513</td><td>UDP</td></tr><tr><td>rwho</td><td>513</td><td> </td></tr></tbody></table>

Please note

- rlogin doesn't return any message when connection is successful
- rlogin and rsh use `/etc/hosts.equiv `and `$HOME/.rhosts`
- rlogin uses `rlogind`; rsh uses `rshd `as a daemon

## hosts.equiv and .rhosts format

```js
host1
host2 user_v
-host3
+@group1 -user_c
-@group2
```

<p class="callout warning">The traffic transmitted is unencrypted. The login process is without a password. This is blocked on modern systems</p>

<p class="callout warning">The traffic can be intercepted and spoofed.</p>