topic Re: Disalbing Telnet for specific users in Operating System - HP-UX

Disalbing Telnet for specific users

Bruce Link — Wed, 16 Apr 2003 15:45:50 GMT

I'm looking to migrate users on a 11i system off of telnet and onto SSH. I am unable to stop the telnetd process, as our production systems require that a generic login be able to access the server. I'm not too worried about this traffic as no sensitive information is being passed over these sessions.

I fear that asking them nicely not to use telnet will have a limited effect.

In a nutshell, what I need to do is do is disable telnet for all users except 'menu'. I've looked into slapping some script to kick them off into /etc/profile but I fear that will take effect when they login through ssh as well. I'm unable to find a way to tell the difference between a telnet session and a ssh session in a shell script so I can terminate the connection appropriatly.

Thanks in advance (and please excuse my abhorrent spelling)
Bruce

Re: Disalbing Telnet for specific users

Paula J Frazer-Campbell — Wed, 16 Apr 2003 15:50:34 GMT

Bruce

In a script pick up the process id and its parent id and if parent telnd then exit.

Just an idea.

Paula

Re: Disalbing Telnet for specific users

Pete Randall — Wed, 16 Apr 2003 15:51:23 GMT

Bruce,

You get an A+ for spelling! Not a single mistake.

Pete

Re: Disalbing Telnet for specific users

Uday_S_Ankolekar — Wed, 16 Apr 2003 15:51:45 GMT

man on inetd.sec.

you can configure /var/adm/inetd.sec file to allow only the specific ipadress to access ftp,telnet,rlogin etc. You can configure for entire subnet or perticular ip.

Good luck

-USA..

Re: Disalbing Telnet for specific users

Gregory Lee_1 — Wed, 16 Apr 2003 17:28:18 GMT

Bruce,

Being relatively new to Unix I could be wrong on this, but couldn't you use TCP Wrappers and then deny all in the hosts.deny file.

You could have the telnet process running but no one could access it.

Regards,
Greg

Re: Disalbing Telnet for specific users

Kelli Ward — Wed, 16 Apr 2003 18:15:45 GMT

Hi Gregory,
Although tcp_wrappers and inetd.sec will allow or restrict networks and hosts, I do not believe they will restrict users on networks or hosts, so as I understand, they won't work for his needs.

HTH,
Kel

Re: Disalbing Telnet for specific users

Jeff Schussele — Wed, 16 Apr 2003 18:39:20 GMT

Hi Bruce,

Yes, you CAN do this with tcp_wrappers.

First - set up the hosts.deny as follows

telnetd : ALL

Then - set up the hosts.allow as follows

telnetd : menu@ALL

Of course this does nothing about FTP, rlogin, finger, etc. But you can tailor the files to cover those as well or use inetd.sec to limit those in addition. And you could limit the user menu to a specific host or subnet

telnetd : menu@host1
telnetd : menu@128.1.1

HTH,
Jeff

P.S. Sorry Kel...had to set the record straight.

Re: Disalbing Telnet for specific users

Kelli Ward — Thu, 17 Apr 2003 13:12:42 GMT

No Problem,
I don't use tcp_wrappers all that much.
Can you use user@ with inetd.sec?
Never seen it in the man pages, didn't think you could.
If not, I think it should be added, that's a usable tool.
Thanks for the info.
Kel

Re: Disalbing Telnet for specific users

Jeff Schussele — Thu, 17 Apr 2003 13:20:45 GMT

Hi Kel,

AFAIK only tcp_wrappers has this functionality - you're correct, inted.sec does not.

Rgds,
Jeff

P.S. The new hat looks good on you. Purple must be your color.

Re: Disalbing Telnet for specific users

Jim Krol — Thu, 12 Jun 2003 20:13:20 GMT

I found this question interesting, because I am trying to do a similar function. I have need to disable telnetd specifically for one user. I want the user to have access to ftp and they must have full access to their startup files, i.e, /etc/profile, .profile, etc.

I loaded the tcp_wrappers for 11.0 from the "dspp" page. Seems to have loaded ok.

However, I cannot get the /etc/hosts.allow or the /etc/hosts.deny to act as I wish. I have read the hosts_access man pages...I thought things were pretty clear, but, I can't seem to deny telnetd to a specific user.

This is my entry in the hosts.deny (I have no host.allow):
telnetd: myuserid@ALL

(I'm really looking for a function like the /etc/securetty --- the root only deny mechanism).

Any help would be appreciated.