topic Re: ssh login in Operating System - HP-UX

ssh login

hemant_mopari — Sat, 19 Aug 2006 00:34:14 GMT

How can i disable all user telnet access to my system and configure ssh so that the user have to use ssh by default when they login...

Please help

Re: ssh login

Geoff Wild — Sat, 19 Aug 2006 00:58:17 GMT

Install HP Secure Shell.

Comment out telnet from /etc/services and kill -HUP inetd

Rgds...Geoff

Re: ssh login

mohan singh — Sat, 19 Aug 2006 01:16:54 GMT

Hemet ,

To disable the telnet service you need to disable the telnet services in /etc/inetd.conf file.
and for ssh , you need to install the ssh and configure for each user.

Mohan

Re: ssh login

hemant_mopari — Sat, 19 Aug 2006 02:40:39 GMT

Thanks for the reply ..

SSH is already installed in my machine how can i configure all users to user it . Also i have make changes to /etc/inetd file to disable telnet login .

Please help
Thanks

Re: ssh login

IT_2007 — Sat, 19 Aug 2006 07:20:33 GMT

you need to modify /etc/sshd/sshd.config file but before you modify, you better read how to install and configure ssh otherwise you don't know what you are doing with config file.

Re: ssh login

Bill Hassell — Sat, 19 Aug 2006 11:59:47 GMT

And of course, your users must have an SSH client installed on their computers. Most terminal emulators do not have ssh capability. The latest versions of WRQ's Reflection (11.0 and higher), TinyTerm Plus, PuTTY, etc will support the SSH protocol (Windows does not have any internal SSH capability).

Re: ssh login

Mel Burslan — Sat, 19 Aug 2006 15:54:49 GMT

If I am understanfding your correctly you want your system to force people to use ssh when they telnet to this system. If this is what you are after, I can tell you that it is not going to happen. Forcing people to use ssh instead of telnet, will take user education and user end client updates. And still some users will resist because they do not like the change. If someone is using a plain old windows telnet client, telling them that they will have to use putty because you require ssh connections, will face a lot of resentment and resistance. This is why we are still keeping the telnet service running on our servers.

Re: ssh login

Steven E. Protter — Sat, 19 Aug 2006 17:43:53 GMT

Shalom,

You should disable telnet, thats a good thing.

Even if you get ssh to listen on port 23 an attempted telnet connection will not receive any useful information.

The clients are not compatible.

This is a policy issue and your users need to be notified.

SEP

Re: ssh login

GBR — Mon, 21 Aug 2006 07:49:28 GMT

Make it as easy as possible for the users to install an ssh client on their machines. Creat a MoP (Method of Procedure) document and distribute via E-mail. Indicate within the document how to install the ssh client and the proper configuration.

I think it is important to move from telnet to ssh, security is crutial, as I'm sure you're aware since this is the direction you want to head in.

GBR

Re: ssh login

Geoff Wild — Mon, 21 Aug 2006 10:25:43 GMT

Is SSH running?

ps -ef | grep "/opt/ssh/sbin/sshd"

If not, enable it:

set SSHD_START=1 in /etc/rc.config.d/sshd

/sbin/init.d/secsh start

All users can now use ssh

Disable telent in /etc/inetd.conf and run inetd -c

Rgds...Geoff

Re: ssh login

DCE — Mon, 21 Aug 2006 10:59:05 GMT

You can also use TCP wrappers
http://h20293.www2.hp.com/portal/swdepot/searchProducts.do

to disable telnet in a more user friendly way

Re: ssh login

PAVIC Thierry — Thu, 31 Aug 2006 09:35:01 GMT

1 - Desactivate telnet :
edit your /etc/inetd.conf file and comment the following line :
telnet stream tcp6 nowait root /usr/lbin/telnetd telnetd
After user 'inetd â c' command in order to force to read the changes.

2 - Check if the following product is on our server
T1471AA A.03.91.009 HP-UX Secure Shell

3 - run the /opt/ssh/sbin/sshd deamon and try with an ssh client to connect to your server

4 - Generate key if you want to echange information with scp or ssh with other account or server.