Disalbing Telnet for specific users

[Bruce Link]

I'm looking to migrate users on a 11i system off of telnet and onto SSH. I am unable to stop the telnetd process, as our production systems require that a generic login be able to access the server. I'm not too worried about this traffic as no sensitive information is being passed over these sessions.

I fear that asking them nicely not to use telnet will have a limited effect.

In a nutshell, what I need to do is do is disable telnet for all users except 'menu'. I've looked into slapping some script to kick them off into /etc/profile but I fear that will take effect when they login through ssh as well. I'm unable to find a way to tell the difference between a telnet session and a ssh session in a shell script so I can terminate the connection appropriatly.

Thanks in advance (and please excuse my abhorrent spelling)
Bruce

[Paula J Frazer-Campbell]

Bruce


In a script pick up the process id and its parent id and if parent telnd then exit.

Just an idea.

Paula

[Pete Randall]

Bruce,

You get an A+ for spelling! Not a single mistake.


Pete

[Uday_S_Ankolekar]

man on inetd.sec.

you can configure /var/adm/inetd.sec file to allow only the specific ipadress to access ftp,telnet,rlogin etc. You can configure for entire subnet or perticular ip.

Good luck

-USA..

[Gregory Lee_1]

Bruce,

Being relatively new to Unix I could be wrong on this, but couldn't you use TCP Wrappers and then deny all in the hosts.deny file.

You could have the telnet process running but no one could access it.

Regards,
Greg

[Kelli Ward]

Hi Gregory,
Although tcp_wrappers and inetd.sec will allow or restrict networks and hosts, I do not believe they will restrict users on networks or hosts, so as I understand, they won't work for his needs.

HTH,
Kel

[Jeff Schussele · Accepted solution]

Hi Bruce,

Yes, you CAN do this with tcp_wrappers.

First - set up the hosts.deny as follows

telnetd : ALL

Then - set up the hosts.allow as follows

telnetd : menu@ALL

Of course this does nothing about FTP, rlogin, finger, etc. But you can tailor the files to cover those as well or use inetd.sec to limit those in addition. And you could limit the user menu to a specific host or subnet

telnetd : menu@host1
telnetd : menu@128.1.1

HTH,
Jeff

P.S. Sorry Kel...had to set the record straight.

[Kelli Ward]

No Problem,
I don't use tcp_wrappers all that much.
Can you use user@ with inetd.sec?
Never seen it in the man pages, didn't think you could.
If not, I think it should be added, that's a usable tool.
Thanks for the info.
Kel

[Jeff Schussele]

Hi Kel,

AFAIK only tcp_wrappers has this functionality - you're correct, inted.sec does not.

Rgds,
Jeff

P.S. The new hat looks good on you. Purple must be your color.

[Jim Krol]

I found this question interesting, because I am trying to do a similar function. I have need to disable telnetd specifically for one user. I want the user to have access to ftp and they must have full access to their startup files, i.e, /etc/profile, .profile, etc.

I loaded the tcp_wrappers for 11.0 from the "dspp" page. Seems to have loaded ok.

However, I cannot get the /etc/hosts.allow or the /etc/hosts.deny to act as I wish. I have read the hosts_access man pages...I thought things were pretty clear, but, I can't seem to deny telnetd to a specific user.

This is my entry in the hosts.deny (I have no host.allow):
telnetd: myuserid@ALL

(I'm really looking for a function like the /etc/securetty --- the root only deny mechanism).

Any help would be appreciated.