You need to have the console enabled first. Go here for instructions on doing just that. Also, rcon DOES work on hosted games.

	First, you need to set up a password. Let's say you want "green" to be the password. You must have direct access to the server for this. For a hosted game, only the host can do this. For a dedicated server, only the owner can do this. Open up the console, and type "sv_rcon_password green". Remember this password. If you do not know it, or decide to try to use rcon on a random server, chances are, it won't work. That is all you need to do on the server end.
	When the client wants to do something they open up the console and type "rcon green <command>" still assuming the password is "green". In this case, the client is using the sv_players command.
	Don't think the host won't know what you are doing. When someone uses rcon, the host will see a message appear on their screen, similar to the one in the picture. In the picture, the client is executing the sv_players command.