topic Re: telnet security in Operating System - HP-UX

telnet security

Ming.Dynasty — Wed, 04 Oct 2006 04:06:40 GMT

Hi

for security reason,how can I deny a certain user telnet from a host to all other hosts?modify only can do in this host,any idea?

Re: telnet security

Peter Godron — Wed, 04 Oct 2006 04:30:10 GMT

Hi,
the only way I know of and I have never used it in a real environment, is to create an ACL for the telnet command:

setacl -m user:fred:--- /usr/bin/telnet

This will give the user fred a message of "Permissions denied" when he issues the telnet command.

Re: telnet security

spex — Wed, 04 Oct 2006 07:14:56 GMT

Hi,

If you are unable to use ACLs, you could create a telnet wrapper script.

#!/usr/bin/sh
TELNET=/obfuscated/path/to/telnet
DENIED_USER=user1
[[ "$(whoami)" = "${DENIED_USER}" ]] && echo "telnet denied" || ${TELNET}
exit

Move the telnet binary to an obscure directory that's not listed in ${PATH}. Save the script as /usr/bin/telnet.

PCS

Re: telnet security

Ming.Dynasty — Wed, 04 Oct 2006 21:31:09 GMT

Thanks for reply

but if the user ftp in a new telnet program,all modify will not work. anyway it works for rookies well. lol

Re: telnet security

Robert Fritz — Thu, 05 Oct 2006 10:42:33 GMT

I don't think that limiting access to the client will be enough, since the user can easily install their own client, or compile their own locally.

I think you're only option is to use something like a restricted-shell for that user with a very carefully-crafted white-list of commands.

That said... I think your requirement may be going about it the wrong way. In general, the best security solutions rely on the resource to protect itself (in your case the hosts that you don't want the user to access). Going the other way around is asking for trouble... as one simple example illuminates...

Say you do a bunch of work to restrict telnet... the user plugs a laptop into a port on your network... and accesses the servers...

I'd think carefully about the threat you're trying to protect against, before investing in what could turn out to be a brittle solution.

Hope that helps,
-Robert

Re: telnet security

Ming.Dynasty — Thu, 05 Oct 2006 20:22:48 GMT

Sorted out

thanks all