Disable telnet access, but allow cron and su access

[Robert Funk_1]

Can anyone offer guidance for the following question?:

How do you disable telnet access for a particular UX account while still allowing local and su access?

I added the following lines to the user's .profile file to prevent telnet logins, but it also prevented cron jobs and su - access:

# no telnet sessions
echo "#####################################"
echo "### sorry, telnet access disabled ###"
echo "#####################################"
exit

Thank you,
Robert

[Mark Greene_1]

You can set the login shell for the user in /etc/passwd to /bin/false. This will prevent telnet login, but still allow cron, as cron doesn't use the login shell. However, "su -" will probably fail. You can perhaps get away with doing just an "su", but you may experience problems with then environment. You can work around that by setting up a file with the environment settings you need and manually envoking it after doing the su.

Mark

[RAC_1]

This came up few times on the forum. Please search forms for "disable telnet"

Do you want to disable the telnet access to a particular user?? If yes, you can lock his account. passwd -l user_name.
You can also put some code in /etc/profile to check if user_name==xx and then deny access.

If user always comes from certain ip, then you can disable the access in /var/adm/inetd.sec file.

For cron jobs, you can make use of /var/adm/cron.allow and /var/adm/cron.deny files. About the use of su, you will have do some coding. Move the su to something else and put a script there. This script will chck which user is doing su and will grant access depening upon the checks you have put.

You may also want to look at /etc/default/security file. man 4 security for details.

Anil

[Sridhar Bhaskarla]

Hi Robert,

I usually do the following way. Create a file called /etc/nodirectlogin with the following syntax

suonly1:First User
suonly2:Second User

Then put the following snippet in /etc/profile and (modify it to suit to csh.login for cshell)


ME=$(who am i|awk '{print $1}')
grep -q "^${ME}:" /etc/nodirectlogin
if [ $? = 0 ]
then
MYNAME=$(grep "^${ME}:" /etc/nodirectlogin|awk '{FS=":";print $2}')
echo "$MYNAME!!! You cannot login directly. Login with your own id and then SU to
$ME"
exit
fi

Here suonly user cannot login directly. But he/she can login as some user and then do an 'su' to suonly. The key is 'who am i' not "whoami".

-Sri

[Mel Burslan]

your code segment can do a little checking before exitting:

# no telnet sessions
SHELL=ksh # chage this according to user's default shell
pid=`ps | grep ${SHELL} | grep -v grep | awk {'print $1'}`
ppid=`ppid=`ps -ef | grep ${pid} | grep ${SHELL} | grep -v grep | awk {'print $3'}`
ps -ef | grep ${ppid} | grep telnetd
r=`echo $?`
if [ $r -eq 0 ]
then
echo "#####################################"
echo "### sorry, telnet access disabled ###"
echo "#####################################"
exit
fi

Hope this helps

[Muthukumar_5]

We can control on .profile file or /etc/profile easily to block for the particular user as,


USER --> telnet disabled user

if [[ "$LOGNAME" = "USER" ]]
then

if [[ $(ps | grep -q 'telnet') -eq 0 ]]
then
# no telnet sessions
echo "#####################################"
echo "### sorry, telnet access disabled ###"
echo "#####################################"

# Sleep to display message and give time to read

sleep 3

exit 1

fi

fi

It will check weather login service is with telnet, if so print the message and exit.
Sleep time will be needed to print the message for 3 seconds, so that user know the reason without exiting at once ;)

Regards
-Muthu

[Mark Greene_1]

If you go with one of these scripted solutions, be sure to add trap statements at the start and end of each script to intercept attempts to break-out of the script.


mark