{
  "port": 513,
  "protocol": "tcp",
  "service": "rlogin",
  "oneLiner": "BSD rlogin — a remote shell session that trusts the client host instead of asking for a password.",
  "whatItIs": "rlogin, documented in RFC 1282, gives a terminal session much like Telnet, but its authentication is host-based: the server trusts a connection from a privileged source port if the client host and user appear in /etc/hosts.equiv or the target user's ~/.rhosts. That trust model is the reason it died — anyone who can spoof an address or compromise one trusted host inherits accounts everywhere. The traffic, including anything typed into the session, is unencrypted. UDP 513 is a different service entirely, rwho, which broadcasts who is logged in and the machine's load average.",
  "exposure": {
    "verdict": "never",
    "note": "Cleartext interactive login with address-based trust — a .rhosts entry plus a spoofed or compromised peer is a remote shell. SSH replaced this in the 1990s."
  },
  "checkCommand": "nc -vz -w 3 TARGET 513",
  "links": [
    {
      "title": "RFC 1282 — BSD Rlogin",
      "url": "https://www.rfc-editor.org/rfc/rfc1282.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 513",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=513",
      "kind": "iana"
    }
  ]
}