diff --git a/ChangeLog b/ChangeLog
index e117652e..6a7a0223 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,35 @@
+2012-07-27  Mats Erik Andersson  <gnu@gisladisker.se>
+
+	rlogin, rshd: Protocol coherence.
+
+	* configure.ac: Check for `getpwuid_r'.
+	* libinetutils/kcmd.c (kcmd) [SHISHI]: Transmit `locuser' if
+	defined at all.  Set `errno' to ENOENT at protocol failure.
+	* libinetutils/krcmd.c [SHISHI && HAVE_GETPWUID_R]: Include
+	<stdlib.h>, <unistd.h>, and <pwd.h>.  New static variables
+	`pwbuflen', `pwbuf', `pwstor', and `pwd'.
+	(krcmd) [SHISHI && HAVE_GETPWUID_R]: Determine local user
+	using getpwuid_r() and pass this on to kcmd().
+	(krcmd_mutual) [SHISHI && HAVE_GETPWUID_R]: Likewise.
+
+	* src/rlogin.c (main) <label try_connect>: New variable
+	KRB_ERRNO, used to track error causes reliably.
+	* src/rlogind.c: Include <stdarg.h>.
+	(rlogind_error): New function, reusing code from fatal().
+	(fatal): Altered as trivial wrapper around rlogind_error().
+	(do_krb_login): Check `*err_msg' in detecting messages.
+	(do_shishi_login): Read `ad->rusername' and `ad->lusername'
+	in the order mandated by exchange protocol, observing their
+	meaning from server's view.  Check `error' in verifying
+	successful exchange.  Provide error messages in case of
+	failure.  Delay syslog message for success until applicable,
+	and provide more detail in both syslog messages.
+	* src/rshd.c (doit) [SHISHI]: Read `remuser' and `locuser'
+	in the order relevant from server side perspective.  Check
+	`error' in verifying successful exchange.  Pass error
+	messages and better syslog messages in response to exchange
+	and authentication.
+
 2012-07-24  Mats Erik Andersson  <gnu@gisladisker.se>
 
 	rcp: Non-encrypting libshishi support.
diff --git a/configure.ac b/configure.ac
index 376a0639..ca9f267f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -661,7 +661,8 @@ AC_FUNC_MMAP
 
 AC_CHECK_FUNCS(cfsetspeed cgetent dirfd fchdir flock \
                fork fpathconf ftruncate \
-	       getcwd getmsg getspnam initgroups initsetproctitle killpg \
+               getcwd getmsg getpwuid_r getspnam \
+               initgroups initsetproctitle killpg \
                ptsname \
                setegid seteuid setpgid \
                setsid setregid setreuid setresgid setresuid setutent_r \
diff --git a/libinetutils/kcmd.c b/libinetutils/kcmd.c
index 4b61c417..6a43882a 100644
--- a/libinetutils/kcmd.c
+++ b/libinetutils/kcmd.c
@@ -431,14 +431,17 @@ kcmd (Shishi ** h, int *sock, char **ahost, unsigned short rport, char *locuser,
 		    realm)) != SHISHI_OK)
     goto bad2;
 
-  write (s, *remuser, strlen (*remuser) + 1);
+  if (locuser && locuser[0])
+    write (s, locuser, strlen (locuser) + 1);
+  else
+    write (s, *remuser, strlen (*remuser) + 1);
 # endif	/* SHISHI */
 
   write (s, cmd, strlen (cmd) + 1);
 
 # ifdef SHISHI
   write (s, *remuser, strlen (*remuser) + 1);
-  write (s, &zero, sizeof (int));
+  write (s, &zero, sizeof (int));	/* XXX: not protocol */
 # endif
 
   if ((rc = read (s, &c, 1)) != 1)
@@ -459,6 +462,7 @@ kcmd (Shishi ** h, int *sock, char **ahost, unsigned short rport, char *locuser,
 	    break;
 	}
       status = -1;
+      errno = ENOENT;
       goto bad2;
     }
 # if HAVE_SIGACTION
diff --git a/libinetutils/krcmd.c b/libinetutils/krcmd.c
index 4435f0d1..6e8ee35c 100644
--- a/libinetutils/krcmd.c
+++ b/libinetutils/krcmd.c
@@ -67,7 +67,12 @@
 # elif defined(SHISHI)
 #  include <shishi.h>
 #  include "shishi_def.h"
-# endif
+#  ifdef HAVE_GETPWUID_R
+#   include <stdlib.h>
+#   include <unistd.h>
+#   include <pwd.h>
+#  endif /* HAVE_GETPWUID_R */
+# endif /* SHISHI */
 
 # include <stdio.h>
 
@@ -91,6 +96,12 @@ int kcmd (int *, char **, unsigned short, char *, char *, char *, int *,
  */
 
 # if defined SHISHI
+#  ifdef HAVE_GETPWUID_R
+static int pwbuflen;
+static char *pwbuf = NULL;	/* Reused after first allocation.  */
+static struct passwd pwstor, *pwd;
+#  endif /* HAVE_GETPWUID_R */
+
 int
 krcmd (Shishi ** h, char **ahost, unsigned short rport, char **remuser, char *cmd,
        int *fd2p, char *realm, int af)
@@ -98,8 +109,29 @@ krcmd (Shishi ** h, char **ahost, unsigned short rport, char **remuser, char *cm
   int sock = -1, err = 0;
   long authopts = 0L;
 
-  err = kcmd (h, &sock, ahost, rport, NULL,	/* locuser not used */
-	      remuser, cmd, fd2p, SERVICE_NAME, realm, NULL,	/* key schedule not used */
+#  ifdef HAVE_GETPWUID_R
+  if (!pwbuf)
+    {
+      pwbuflen = sysconf (_SC_GETPW_R_SIZE_MAX);
+      if (pwbuflen <= 0)
+	pwbuflen = 1024;	/* Guessing only.  */
+
+      pwbuf = malloc (pwbuflen);
+    }
+
+  if (pwbuf)
+    (void) getpwuid_r (getuid (), &pwstor, pwbuf, pwbuflen, &pwd);
+#  endif /* HAVE_GETPWUID_R */
+
+  err = kcmd (h, &sock, ahost, rport,
+#  ifdef HAVE_GETPWUID_R
+	      pwd ? pwd->pw_name : *remuser,	/* locuser */
+#  else /* !HAVE_GETPWUID_R */
+	      NULL,		/* locuser not used */
+#  endif
+	      remuser, cmd, fd2p,
+	      SERVICE_NAME, realm,
+	      NULL,		/* key schedule not used */
 	      NULL,		/* local addr not used */
 	      NULL,		/* foreign addr not used */
 	      authopts, af);
@@ -153,8 +185,28 @@ krcmd_mutual (Shishi ** h, char **ahost, unsigned short rport, char **remuser,
   struct sockaddr_storage laddr, faddr;
   long authopts = SHISHI_APOPTIONS_MUTUAL_REQUIRED;
 
-  err = kcmd (h, &sock, ahost, rport, NULL,	/* locuser not used */
-	      remuser, cmd, fd2p, SERVICE_NAME, realm, key,	/* filled in */
+#   ifdef HAVE_GETPWUID_R
+  if (!pwbuf)
+    {
+      pwbuflen = sysconf (_SC_GETPW_R_SIZE_MAX);
+      if (pwbuflen <= 0)
+	pwbuflen = 1024;	/* Guessing only.  */
+
+      pwbuf = malloc (pwbuflen);
+    }
+
+  if (pwbuf)
+    (void) getpwuid_r (getuid (), &pwstor, pwbuf, pwbuflen, &pwd);
+#   endif /* HAVE_GETPWUID_R */
+
+  err = kcmd (h, &sock, ahost, rport,
+#   ifdef HAVE_GETPWUID_R
+	      pwd ? pwd->pw_name : *remuser,	/* locuser */
+#   else /* !HAVE_GETPWUID_R */
+	      NULL,		/* locuser not used */
+#   endif
+	      remuser, cmd, fd2p,
+	      SERVICE_NAME, realm, key,	/* filled in */
 	      &laddr,		/* filled in */
 	      &faddr,		/* filled in */
 	      authopts, af);
diff --git a/src/rlogin.c b/src/rlogin.c
index a7cea19c..a42f27a4 100644
--- a/src/rlogin.c
+++ b/src/rlogin.c
@@ -448,6 +448,7 @@ main (int argc, char *argv[])
 try_connect:
   if (use_kerberos)
     {
+      int krb_errno = 0;
       struct hostent *hp;
 
       /* Fully qualified hostname (needed for krb_realmofhost).  */
@@ -473,6 +474,7 @@ try_connect:
 
 	  rem = krcmd_mutual (&handle, &host, sp->s_port, &user, term, 0,
 			      dest_realm, &key, family);
+	  krb_errno = errno;
 	  if (rem > 0)
 	    {
 	      keytype = shishi_key_type (key);
@@ -524,27 +526,32 @@ try_connect:
 
       else
 #  else /* KERBEROS */
-	rem = krcmd_mutual (&host, sp->s_port, user, term, 0,
-			    dest_realm, &cred, schedule);
+	{
+	  rem = krcmd_mutual (&host, sp->s_port, user, term, 0,
+			      dest_realm, &cred, schedule);
+	  krb_errno = errno;
+	}
       else
 #  endif
-# endif	/* CRYPT */
-
+# endif	/* ENCRYPTION */
+	{
 # if defined SHISHI
-	rem = krcmd (&handle, &host, sp->s_port, &user, term, 0,
-		     dest_realm, family);
+	  rem = krcmd (&handle, &host, sp->s_port, &user, term, 0,
+		       dest_realm, family);
 # else /* KERBEROS */
-	rem = krcmd (&host, sp->s_port, user, term, 0, dest_realm);
+	  rem = krcmd (&host, sp->s_port, user, term, 0, dest_realm);
 # endif
+	  krb_errno = errno;
+	}
       if (rem < 0)
 	{
 	  use_kerberos = 0;
 	  sp = getservbyname ("login", "tcp");
 	  if (sp == NULL)
 	    error (EXIT_FAILURE, 0, "unknown service login/tcp.");
-	  if (errno == ECONNREFUSED)
+	  if (krb_errno == ECONNREFUSED)
 	    warning ("remote host doesn't support Kerberos");
-	  if (errno == ENOENT)
+	  if (krb_errno == ENOENT)
 	    warning ("can't provide Kerberos auth data");
 	  goto try_connect;
 	}
diff --git a/src/rlogind.c b/src/rlogind.c
index b5d8ea62..cd021da2 100644
--- a/src/rlogind.c
+++ b/src/rlogind.c
@@ -56,6 +56,7 @@
 #include <syslog.h>
 #include <errno.h>
 #include <stdio.h>
+#include <stdarg.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <stdlib.h>
@@ -212,6 +213,7 @@ void protocol (int f, int p, struct auth_data *ap);
 int control (int pty, char *cp, size_t n);
 void cleanup (int signo);
 void fatal (int f, const char *msg, int syserr);
+void rlogind_error (int f, int syserr, const char *msg, ...);
 int in_local_domain (char *hostname);
 char *topdomain (char *name, int max_dots);
 
@@ -944,7 +946,7 @@ rlogind_mainloop (int infd, int outfd)
 	}
 # endif
     }
-#endif
+#endif /* SHISHI */
 
   return 0;
 }
@@ -1037,7 +1039,7 @@ do_krb_login (int infd, struct auth_data *ap, const char **err_msg)
   rc = do_krb4_login (infd, ap, err_msg);
 # endif
 
-  if (rc && !err_msg)
+  if (rc && !*err_msg)
     *err_msg = kerberos_error_string (rc);
 
   return rc;
@@ -1118,7 +1120,7 @@ do_krb4_login (int infd, struct auth_data *ap, const char **err_msg)
 
   return 0;
 }
-# endif
+# endif /* KRB4 */
 
 # ifdef KRB5
 int
@@ -1217,7 +1219,7 @@ do_krb5_login (int infd, struct auth_data *ap, const char **err_msg)
   return 0;
 }
 
-# endif
+# endif /* KRB5 */
 
 # ifdef SHISHI
 int
@@ -1298,16 +1300,17 @@ do_shishi_login (int infd, struct auth_data *ad, const char **err_msg)
     }
 #  endif
 
-  getstr (infd, &ad->lusername, NULL);
-  getstr (infd, &ad->term, "TERM=");
   getstr (infd, &ad->rusername, NULL);
+  getstr (infd, &ad->term, "TERM=");
+  getstr (infd, &ad->lusername, NULL);
 
-  rc = read (infd, &error, sizeof (int));
-  if ((rc != sizeof (int)) && rc)
+  rc = read (infd, &error, sizeof (int));	/* XXX: not protocol */
+  if ((rc != sizeof (int)) || error)
     {
+      *err_msg = "Authentication exchange failed.";
       free (pwd);
       free (cksum);
-      return 1;
+      return EXIT_FAILURE;
     }
 
   /*
@@ -1330,9 +1333,6 @@ do_shishi_login (int infd, struct auth_data *ad, const char **err_msg)
 
   free (pwd);
 
-  syslog (LOG_INFO | LOG_AUTH,
-	  "Kerberos V login from %s on %s\n", ad->lusername, ad->hostname);
-
   /* verify checksum */
 
   if (getsockname (infd, (struct sockaddr *) &sock, &socklen) < 0)
@@ -1351,32 +1351,38 @@ do_shishi_login (int infd, struct auth_data *ad, const char **err_msg)
   if (rc != SHISHI_OK
       || compcksumlen != cksumlen || memcmp (compcksum, cksum, cksumlen) != 0)
     {
-      /* err_msg crash ? */
-      /* *err_msg = "checksum verify failed"; */
+      *err_msg = "Authentication exchange failed.";
       syslog (LOG_ERR, "checksum verify failed: %s", shishi_error (ad->h));
       free (cksum);
       free (compcksum);
-      return 1;
+      return rc;
     }
 
   free (cksum);
+
   free (compcksum);
 
   rc = shishi_authorized_p (ad->h, shishi_ap_tkt (ad->ap), ad->lusername);
   if (!rc)
     {
-      syslog (LOG_ERR | LOG_AUTH, "User is not authorized to log in as: %s",
-	      ad->lusername);
+      syslog (LOG_ERR | LOG_AUTH,
+	      "User %s@%s is not authorized to log in as: %s.",
+	      ad->rusername, ad->hostname, ad->lusername);
       shishi_ap_done (ad->ap);
-      return 1;
+      rlogind_error (infd, 0, "Failed to get authorized as `%s'.\n", ad->lusername);
+      return rc;
     }
 
+  syslog (LOG_INFO | LOG_AUTH,
+	  "Kerberos V login from %s on %s as `%s'.\n",
+	  ad->rusername, ad->hostname, ad->lusername);
+
   shishi_ap_done (ad->ap);
 
   return SHISHI_OK;
 }
-# endif
-#endif
+# endif /* SHISHI */
+#endif /* KERBEROS || SHISHI */
 
 #define BUFFER_SIZE 128
 
@@ -1702,10 +1708,18 @@ topdomain (char *name, int max_dots)
 }
 
 void
-fatal (int f, const char *msg, int syserr)
+rlogind_error (int f, int syserr, const char *msg, ...)
 {
   int len;
-  char buf[BUFSIZ], *bp = buf;
+  char buf[BUFSIZ], buf2[BUFSIZ], *bp = buf;
+  va_list ap;
+  va_start (ap, msg);
+
+  /*
+   * Error message proper, with variadic parts.
+   */
+  vsnprintf (buf2, sizeof (buf2) - 1, msg, ap);
+  va_end (ap);
 
   /*
    * Prepend binary one to message if we haven't sent
@@ -1715,10 +1729,17 @@ fatal (int f, const char *msg, int syserr)
     *bp++ = '\01';		/* error indicator */
   if (syserr)
     snprintf (bp, sizeof buf - (bp - buf),
-	      "rlogind: %s: %s.\r\n", msg, strerror (errno));
+	      "rlogind: %s: %s.\r\n", buf2, strerror (errno));
   else
-    snprintf (bp, sizeof buf - (bp - buf), "rlogind: %s.\r\n", msg);
+    snprintf (bp, sizeof buf - (bp - buf), "rlogind: %s.\r\n", buf2);
+
   len = strlen (bp);
   write (f, buf, bp + len - buf);
+}
+
+void
+fatal (int f, const char *msg, int syserr)
+{
+  rlogind_error (f, syserr, msg);
   exit (EXIT_FAILURE);
 }
diff --git a/src/rshd.c b/src/rshd.c
index 5cf796c0..30b87f6b 100644
--- a/src/rshd.c
+++ b/src/rshd.c
@@ -86,12 +86,20 @@
  */
 
 /*
- * remote shell server exchange protocol:
+ * remote shell server exchange protocol (client view!):
  *	[port]\0
  *	remuser\0
  *	locuser\0
  *	command\0
  *	data
+ *
+ * Kerberized exchange delays the remote user name:
+ *
+ *      \0
+ *      locuser\0
+ *      command\0
+ *      remuser\0
+ *      data
  */
 
 #include <config.h>
@@ -830,10 +838,10 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen)
     }
   else
 #endif /* KERBEROS || SHISHI */
-    remuser = getstr ("remuser");
+    locuser = getstr ("locuser");
 
   /* Read three strings from the client. */
-  locuser = getstr ("locuser");
+  remuser = getstr ("remuser");		/* The acting client!  */
   cmdbuf = getstr ("command");
 
 #ifdef SHISHI
@@ -908,9 +916,10 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen)
 	  }
 # endif /* ENCRYPTION */
 
-    remuser = getstr ("remuser");
-    rc = read (STDIN_FILENO, &error, sizeof (int));
-    if ((rc != sizeof (int)) && rc)
+    locuser = getstr ("locuser");	/* The agent here!  */
+
+    rc = read (STDIN_FILENO, &error, sizeof (int)); /* XXX: not protocol */
+    if ((rc != sizeof (int)) || error)
       exit (EXIT_FAILURE);
 
     /* verify checksum */
@@ -942,14 +951,19 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen)
 	/* *err_msg = "checksum verify failed"; */
 	syslog (LOG_ERR, "checksum verify failed: %s", shishi_error (h));
 	free (compcksum);
+	shishi_ap_done (ap);
+	rshd_error ("Authentication exchange failed.\n");
 	exit (EXIT_FAILURE);
       }
 
     rc = shishi_authorized_p (h, shishi_ap_tkt (ap), locuser);
     if (!rc)
       {
-	syslog (LOG_ERR, "User is not authorized to log in as: %s", locuser);
+	syslog (LOG_AUTH | LOG_ERR,
+		"User %s@%s is not authorized to run as: %s.",
+		remuser, hostname, locuser);
 	shishi_ap_done (ap);
+	rshd_error ("Failed to get authorized as `%s'.\n", locuser);
 	exit (EXIT_FAILURE);
       }
 
@@ -1175,12 +1189,13 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen)
       exit (EXIT_FAILURE);
     }
 
-  /* Now write the null byte back to the client telling it
+  /* Now write the null byte back to the client, telling it
    * that everything is OK.
+   *
    * Note that this means that any error message that we generate
    * from now on (such as the perror() if the execl() fails), won't
-   * be seen by the rcomd() fucntion, but will be seen by the
-   * application that called rcmd() when it reads from the socket.
+   * be seen by the rcmd() function, but it will be seen by the
+   * application that called rcmd() once it reads from the socket.
    */
   if (write (STDERR_FILENO, "\0", 1) < 0)
     {
@@ -1592,7 +1607,11 @@ doit (int sockfd, struct sockaddr *fromp, socklen_t fromlen)
 		hostname, locuser, cmdbuf);
       else
 #endif /* KERBEROS */
-	syslog (LOG_INFO | LOG_AUTH, "%s@%s as %s: cmd='%.80s'",
+	syslog (LOG_INFO | LOG_AUTH,
+#ifdef SHISHI
+		"Kerberized "
+#endif
+		"%s@%s as %s: cmd='%.80s'",
 		remuser, hostname, locuser, cmdbuf);
     }
 #ifdef SHISHI
@@ -1626,7 +1645,7 @@ rshd_error (const char *fmt, ...)
   bp = buf;
   if (sent_null == 0)
     {
-      *bp++ = 1;
+      *bp++ = 1;	/* error indicator */
       len = 1;
     }
   else