it would seem that this rlogind (and the same bug with telnetd/rlogind using -l -hfoo.bar) depends on if the getopt(3) routine takes arguments in the form of "-Xblah" and "-X blah" to mean "-X" with argument "blah". a number of "new" systems (*bsd/linux) allow you to pass a username of "-hblah" thus changing the host you login from. as far as i've been able to determine this only affects utmp/wtmp stuff, but i could be wrong ;-)