disable telnet

[bbb3456]

Is there a way to disable telnet to any particular user account

[Tonya Underwood]

Do you mean disable login? Or disable only telnetting to that user's account?

Tonya Underwood

[Paul Sperry]

You can limit by IP address in
/var/adm/inted.sec

[Abdul Rahiman]

If you want to have access controlled for services started via inetd, you should consider using TCP wrappers.

Here is few notes about how to confiure TCP wrappers. It's an open source program and can be downloaded.

TCP Wrapper is a public domain computer program that provides firewall services for Unix servers. The program was developed by Wietse Venema.

It installs files for the tcpd daemons. And once installed you change the server process name(/usr/sbin/telnetd) to /usr/sbin/tcpd on your inetd.conf file.

You will then configure the access controls through a hosts.allow or hosts.deny file in the format ..

telnetd:IP Address.

This should get you started with tcp wrappers..

[Paul Sperry]

The easiest way to prevent a direct telnet or ftp session for a specific user is by changing the password field to '*'. On a normal system this can be done in /etc/passwd, on a trusted system you can find the file in /tcb/files/auth. Setting the password field (not the password, but the field) to '*' will still allow su, rcp, rlogin, cron scripts etc.

[Abdul Rahiman]

Paul,
I guess /var/adm/inetd.sec is an easy fix than going to TCP wrappers, isn't it?
How about if it's per user accounts?

[Jeff Schussele]

Hi Ravi,

To get down to user granularity you need tcp-wrappers - available here:

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/

See the man pages as to how to do this with the allow/deny files.

HTH,
Jeff

[bbb3456]

Tonya, yes I would like to disable telnet for specific user

[Dani Seely]

Hey Ravi,
In order login to a UNIX system via telnet, the user must have a shell. So, to revoke this, put /sbin/false in the shell field of that user will prevent access by telnet - if you don't have a shell, then you can't login. However, this also makes it so that the user cannot login to the system ... this would be useful for an ftp only account.

Hope this helps.

[bbb3456]

is there any other way to get into unix box without telnet

[Mel Burslan]

if you are running sshd, it is another way of comming in as well as remsh/rexec.

the best way to disable a user from coming in in any interactive way (telnet/ssh/remsh) is to set its shell to /usr/bin/false.

[Edgar Arroyo]

When you say "get it" you mean any type of transport? (ftp, telnet, ssh, rlogin?)

Another way is through serial ports on the back of the machine or if you have a digi board installed on the machine, I don't know if there are any available for hp-ux.

[bbb3456]

Edgar Arroyo
get it means to connect from a client pc to unix host or server

[Sridhar Bhaskarla]

Hi,

There are quite a few ways for the user to get into the box. telnet/ftp/rlogin/remsh/rexec etc.,. If you are running sshd on the box, then they can use ssh/sftp to get into the box.

For the clients such as telnet/rlogin/ssh that use /etc/profile, csh.login etc., you can put a piece of script in there to prevent the user to login. For the tools that do not use /etc/profile like ftp, you will need to find otherways like for ftp, you can use ftpusers etc.,

An example code is something like this. Put it at the beginning of /etc/profile.

ME=$(who am i|awk '{print $1}')
grep -q "^${ME}:" /etc/nodirectlogin
if [ $? = 0 ]
then
MYNAME=$(grep "^${ME}:" /etc/nodirectlogin|awk '{FS=":";print $2}')
echo "Connection refused for $MYNAME"
exit
fi

Create a file called /etc/nodirectlogin with the entries like this

login1:LOGIN NAME1
login2:LOGIN NAME2

For csh users, it's /etc/csh.login. You may need to modify the code to suit to csh. Since we are playing with the shell, there are ways to get around with it.

You will also need to configure your CDE as they can login to the system through XWINDOWS. To disallow that put a file called "/etc/dt/config/Xsession.d/0000.nologin" with the following code

grep -q "^${USER}:" /etc/nodirectlogin
if [ $? = 0 ]
then
/usr/dt/bin/dterror.ds "You Cannot login as $USER directly" "Login Denied" "Exit"
exit 1
fi

-Sri

[Dan Martin_1]

Instead of:

ME=$(who am i|awk '{print $1}')
grep -q "^${ME}:" /etc/nodirectlogin
if [ $? = 0 ]
then
MYNAME=$(grep "^${ME}:" /etc/nodirectlogin|awk '{FS=":";print $2}')
echo "Connection refused for $MYNAME"
exit
fi

How about:

grep "^$(whoami):" /etc/nodirectlogin | \
IFS=":" read logname fullname
if [[ -n "$logname" ]]
then
echo "Connection refused for $fullname"
exit
fi

A little more efficient code, don't you think? I hate to see awk called twice when it is not necessary. Actually, you could eliminate the grep, also.

[Sridhar Bhaskarla]

Sure. That's only an idea with an example script and you can possibly make it an one liner if you want.

And the usage of "who am i" against "whoami" was intentional. "whoami" there will avoid an extra awk but will also prevent "su" to that login which I didn't mean. Our idea is only to code /etc/profile to prevent telnet not 'su'.

I guess his requirement is for generic logins where users will login as themselves and su to the generic login instead of using generic login directly.

-Sri

[Dave La Mar]

Ravi -
Though there is great confusion on what you are attempting, let me add to it.
We have a generic user id that we prevent telnet access by performing an whoami | read user, if test "$user" = "your_prevent_user_id"
then
echo "cannot telnet in. Use your own user ID"
exit 0.
This shuts down the telnet session for anyone trying to login as "your_prevent_user_id" and the logic is placed in /etc/profile.
FTP access is another story, but we limit that as well. If you wish info on this, please advise.
Best of luck.
Regards,

dl

[Jose Mosquera]

Hi,

I suggest you to disable user's account by the command:

#passwd -l

This set a "*" in the second field of /etc/passwd file making inaccessible user's account for any porpouse. If you need more help about:
#man passwd

Rgds.

[Dan Martin_1]

Sri,

(With apologies to Ravi for this side exchange).

Don't you have it reversed? "who am i" gives you the real ID, whereas whoami gives the effective ID. So if you su to root, who am i returns not the ID of root but your user ID, which would cause you to be rejected. Or have I really got everything confused? I'm gettin' old . . . :)

And the question isn't the number of lines, but whether the shell has to call an external program. For instance, if you want to use "who am i", this construction is much more efficient because it doesn't go out of the shell except to run the who program:

who am i | read MYNAME therest

And if "whoami" is what you want, then you might as well save more cycles and use the name that is already set - $LOGNAME.

Dan