disable telnet to all users except for one.

[Guy Haase]

I am running HP –UX 11.0 and 11i on N and L class machines. I what to know how

I can disable telnet for ALL users except for one.

What is the best way to go about this.


Thanks

[Steven E. Protter]

Best solution, use secure shell don't give the ssh client to those you don't want to connect.

/var/adm/inetd.sec

This file lets you specify by protocol what hosts are allowed and not allowed. You would allow one host to telnet and deny all other hosts on the next line of the configuration file.

SEP

[Bill Hassell]

If this user ALWAYS uses the same IP address for the client machine, you can use /var/adm/inetd.sec to allow telnet to a single IP address. Otherwise, you can use /etc/profile to test for the correct users and exit if not.

[Jeff Schussele]

Hi Guy,

In the same mode as Bill's response, you could also use TCP-wrappers & use the /etc/allow/disallow files to control telnet access. The advantage to it is that you can get granularity down to the username level. /var/adm/inetd.sec cannot do that. So that covers scenarios where the user comes in from diff workstations.

My 2 cents,
Jeff

[Don Mallory]

I don't know if it's compiled for HP-UX, but there is a PAM module for Linux called pam_listfile. If you set it to required, it allows or denies access based on the contents of a text file.

There's a good example in an article at www.samag.com - "PAM - Pluggable Authentication Modules" by Kurt Seifried.

The pam file entry would be:

auth required /lib/security/pam_listfile.so item=user sense=allow file=/etc/telnet-allow onerr=fail

Other than the base pam_kerberos, authz, ldap,unix files, does anyone know of any others that are pre-compiled for HP-UX?

-----------

Another sneakier way would be to edit the /etc/profile:

if `ps -ef | grep $PPID | grep telnet > /dev/null`
then
if `cat /etc/telnet-ok | grep $LOGNAME > /dev/null`
then
:
else
echo "Telnet is not allowed"
exit
fi
fi

This would check to see if the parent ID of the login is a telnet session, if it is, check the contents of /etc/telnet-ok and see if the LOGNAME is in there, and if not, exit.