topic Re: Telnet logins in Operating System - HP-UX

Telnet logins

Eugene Klaus — Mon, 11 Apr 2005 09:11:05 GMT

I have a server running HPUX 11.0.
Problem has arisen : any user attempting to log into server using a telnet session is granted access without requesting a password.
I have shutdown inetd until I have this solved.
I have remove an and all .rhosts files and /etc/hosts.equiv. The system has been rebooted.

Any ideas???

Re: Telnet logins

Mark Nieuwboer — Mon, 11 Apr 2005 09:20:32 GMT

First you can shutdown telnet in
/var/adm/inetd.sec and put in this:
telnet deny

so you won't have to shutdown inetd.

Futher is it a trusted system or is it a non trusted system. If it is a non trusted system did you disable the non-password in the security file? if don't fix it.

Re: Telnet logins

Chris Wilshaw — Mon, 11 Apr 2005 09:23:17 GMT

Eugene,

There are 2 possibilities here that I can think of;

1) Users have no passwords. If the password field of /etc/passwd is empty, users won't be asked to enter a password.

2) TAC access control is enabled on the server. This works in a similar way to host equivalency for rlogin. Check the telnetd line in /etc/inetd.conf If this contains the parameter -t, TAC is enabled. This is a security problem, as it works based on the UID number of the account, rather than the user name, so equivalence between hosts is not necessarily to the same user ID. This equivalence is based on /etc/hosts.equiv and local .rhosts files, so if you've removed those, it's unlikely to be this that's the problem.

Re: Telnet logins

harry d brown jr — Mon, 11 Apr 2005 09:23:53 GMT

any user name?

What do the following commands

grep telnet /etc/services /etc/inetd.conf

ps -ef | grep -e telnet -e ssh

ls -l /var/adm/inetd.sec

grep -v "^#" /var/adm/inetd.sec

what /usr/lbin/telnetd

return?

If you rebooted then most likely inetd restarted.

live free or die
harry d brown jr

Re: Telnet logins

Steven E. Protter — Mon, 11 Apr 2005 09:30:14 GMT

When you shut down inetd users with existing connections will not be logged off.

You can spot them with netstat -an

You have to terminate those users manually until your security problem is solved.

The inetd.sec file can be used to deny access by ip address if warranted. Once again the effect will not be immediate, just on new sessions.

SEP

Re: Telnet logins

Eugene Klaus — Mon, 11 Apr 2005 10:10:29 GMT

grep telnet /etc/services /etc/inetd.conf
/etc/services:telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b/etc/issue

ps -ef|grep -e telnet -e ssh
eklaus1 3846 3844 8 08:27:22 ? 0:08 sshd: eklaus1@pts/0
root 2506 1 0 06:04:39 ? 0:00 /opt.ssh/sbin/sshd
root 4248 3882 6 10:43:59 pts/0 0:00 grep -e telnet -e ssh
r00t 3844 2506 0 08:27:12 ? 0:01 sshd: eklaus1 [priv]

grep -v "^#" /var/adm/inetd.sec
dtspc allow 127.0.0.1 loopback ese007

I have already shut inetd down using inetd -k.

inetd.conf has been copied from a working 11.0 server.

Re: Telnet logins

harry d brown jr — Mon, 11 Apr 2005 10:36:13 GMT

Can you POST the output of this command again?

grep telnet /etc/services /etc/inetd.conf

because this is VERY wrong:
/etc/services:telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b/etc/issue

It should read:

/etc/services:telnet 23/tcp # Virtual Terminal Protocol
/etc/inetd.conf:telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b /etc/issue

from your output /etc/services has the contents of /etc/inetd.conf - Hopefully just a TYPO of cut & paste

live free or die
harry d brown jr

Re: Telnet logins

Eugene Klaus — Mon, 11 Apr 2005 11:17:47 GMT

#grep telnet /etc/services /etc/inetd.conf
/etc/services:telnet 23/tcp #Virtual Terminal protocol
/etc/inetd.conf:telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b/etc/issue

Re: Telnet logins

Eugene Klaus — Mon, 11 Apr 2005 12:54:07 GMT

I thank you all for your attention to this matter. I have discovered the problem.
We had an abortive effort to install netbackup last week. I never completed.
During that attempt I believe that /etc/pam.conf was over written eliminating the passwd check. This was probably inteded to be temporary.

Upon updating the /etc/pam.conf file with a file from a working system our problem was solved.

Re: Telnet logins

Eugene Klaus — Mon, 11 Apr 2005 12:55:49 GMT

Thanks to everyone who responded.