topic Re: restrict access to telnet in Operating System - HP-UX

restrict access to telnet

Andres Martinez — Tue, 16 Oct 2001 13:25:12 GMT

How can I restrict access to telnet by user name but other user can access by su

Thanks in advance

Re: restrict access to telnet

harry d brown jr — Tue, 16 Oct 2001 13:31:47 GMT

You want to restrict users from using telnet on a machine or to a machine. By referencing "su", I'm assuming you are talking about using telnet on a machine to get to another. You could change the permissions on telnet, which should be r-xr-xr-x right now, to r-x------.

Re: restrict access to telnet

Andres Martinez — Tue, 16 Oct 2001 13:47:32 GMT

No, I want that user named notelnet (by example) can't make telnet, but user named pepe (by example) can make telnet and can make su notelnet from his session.

Re: restrict access to telnet

harry d brown jr — Tue, 16 Oct 2001 13:53:38 GMT

Change the permissions to r-xr-x--- (chmod 550), then change the group to "telnets" (chgrp telnets /usr/bin/telnet). Add the users you want to the "telnets" group in /etc/group.

Now if you want to restrict users from telnetting into your machine use inetd.sec (see man pages).

Re: restrict access to telnet

Hamdy Al-Sebaey — Tue, 16 Oct 2001 14:10:47 GMT

Harry,
it also possible as U say to use inetd.sec to restirct of using telnet fo some users.
Andres, U need to create this file inetd.sec onder /var/adm, inh this file u can put the name of the user or the ip adr.of his pc to prevent hem from using telnet example

telnet deny (username or ip adres.)
regards,
Hamdy

Re: restrict access to telnet

harry d brown jr — Tue, 16 Oct 2001 14:26:22 GMT

Hamdy,

I think he is talking about a user logged into serverA trying to execute a telnet to another server.

If he is talking about restricting someone from logging into serverA using telnet, then he needs to use the inetd.sec file in /var/adm/.

harry

Re: restrict access to telnet

Andres Martinez — Tue, 16 Oct 2001 14:27:00 GMT

inetd.sec don't permit use username or I don't use it

Re: restrict access to telnet

Wodisch — Tue, 16 Oct 2001 14:29:54 GMT

Hello Andres,

if I got you right, you will have to enter something into ALL login scripts (TELNET,RLOGIN,XDMCP) and in there do something like:

case "$0" in
-su|su) echo ok ;;
*) echo "no"; exit 1 ;;
esac

HTH,
Wodisch