| 12.1 |  | Advanced Protocols |
| 12.1.4 |  | Remote shell (rsh) fixup configuration |

| The next protocol this section will discuss is Remote Shell (rsh). Rsh is a protocol that, like Telnet, opens a shell on remotely accessed network devices. It does this by using two channels for communications. When a client first starts an rsh connection, it opens a standard TCP channel from one of its high-order ports to port 514 on the server. The server opens another channel for standard error output to the client.

For rsh traffic, the PIX Security Appliance operates in the following manner:

- Outbound connections: When standard error messages are sent from the server, the PIX Security Appliance opens a temporary inbound conduit for this channel. This conduit is torn down when it is no longer needed.
- With Inbound connections,

- If a conduit exists that allows inbound connections to an rsh server, and if all outbound TCP traffic is implicitly allowed, no special handling is required because the server initiates the standard error channel from the inside.
- If a conduit exists allowing inbound connections to an rsh server, and if all outbound TCP traffic is not implicitly allowed, the PIX Security Appliance opens a temporary conduit for the standard error channel from the server. This conduit is torn down after the messages are sent.

Figure illustrates an rsh connection being established. The rsh server initiates one of the channels, in this case the standard error output channel, to one of the high order ports on the router. This is where the fixup protocol rsh command comes in.

The PIX Security Appliance inspects port 514 connections for rsh traffic by default. If there are other rsh servers on the network that use ports other than port 514, the administrator must use the fixup protocol rsh command to have the PIX Security Appliance inspect these other ports for rsh traffic. The fixup protocol rsh command causes the PIX Security Appliance to dynamically create conduits for rsh standard error connections for rsh traffic on the indicated port.

This command and its syntax are examined in the associated Command Reference.