It seems that in.rexecd is buggy and hangs, it can be reproduced on a base Red Hat 6.0 box with a simple rexec -l user -p pass localhost date Doing an strace on it, we see that the rexec client sends the port number as the first "argument": write(3, "1716\0", 5) = 5 and waits for the socket to be created accept(4, <unfinished ...> while the rexec daemon reads the second argument (user) *before* creating the socket...
As a workaround, add -a to the rexec command line.
*** This bug has been marked as a duplicate of 2318 ***