1. Home
  2. Networking
  3. Network security assessment

5.8 rwho

The Unix rwhod service listens on UDP port 513. If found to be accessible, you can query it using the Unix rwho client utility to list current users who are logged into the remote host, as shown:

# rwho 192.168.189.120

jarvis   ttyp0    Jul 17 10:05   (192.168.189.164)

dan      ttyp7    Jul 17 13:33   (194.133.50.25)

root     ttyp9    Jul 17 16:48   (192.168.189.1)


    		Network Security Assessment
    		Foreword
    		Preface
    		Chapter 1. Network Security Assessment
    		Chapter 2. The Tools Required
    		Chapter 3. Internet Host and Network Enumeration
    		Chapter 4. IP Network Scanning
    		Chapter 5. Assessing Remote Information Services
    		5.1 Remote Information Services
    		5.2 systat and netstat
    		5.3 DNS
    		5.4 finger
    		5.5 auth
    		5.6 SNMP
    		5.7 LDAP
    		5.8 rwho
    		5.9 RPC rusers
    		5.10 Remote Information Services Countermeasures
    		Chapter 6. Assessing Web Services
    		Chapter 7. Assessing Remote Maintenance Services
    		Chapter 8. Assessing FTP and Database Services
    		Chapter 9. Assessing Windows Networking Services
    		Chapter 10. Assessing Email Services
    		Chapter 11. Assessing IP VPN Services
    		Chapter 12. Assessing Unix RPC Services
    		Chapter 13. Application-Level Risks
    		Chapter 14. Example Assessment Methodology
    		Appendix A. TCP, UDP Ports, and ICMP Message Types
    		Appendix B. Sources of Vulnerability Information
    		Colophon