How to deny telnet access

[Preet Dhillon]

I want to deny a user called 'pine' telnet access to my HP-UX server.
I've edited /var/adm/inetd.sec to include the following line :
telnet deny pine
and then initialised the inetd daemon using inetd -c.
BUT when I try telnet to this server as the pine user, it STILL allows telnet access!
Does anyone know why?
Many thanks in advance :-)

[James R. Ferguson · Accepted solution]

Hi Preet:

/var/adm/inetd.sec holds 'hostnames' (or IPaddresses) *not* user names for allowing or denying services.

...JRF...

[Stefan Farrelly]

/var/adm/inetd.sec is really for denying network access - via ip, not per user.

If you want to deny by user you will need to add some scripting to either /etc/profile or the users .profile.

[Magdi KAMAL]

Hi Preet,

The syntaxe of the file /var/adm/inetd.sec is as follow :



example :
telnetd denny 132.141.15.3

This will denny access to telnetd process by ALL connections comming from server identified by address 132.141.15.3.

You may filter the user that you want to denny access by codding in the /etc/profile file.

Magdi

[Magdi KAMAL]

Hi again Preet,

you may code in the /etc/profile file the following test :

if [ $LOGNAME = 'badUser' ]
then
exit 1
fi


I tried it and it works fine giving the following message :

Connection closed by foreign host.

Magdi

[Joseph C. Denman]

You can also take away his shell so he cannot telnet.

echo "exit 1" > /usr/bin/false
chmod 555 /usr/bin/false

Modify the user's shell as /usr/bin/false.

The user will not be able to telnet but will still be able to ftp.

Hope this helps.

...jcd...

[Ralf Hildebrandt]

If you want to do this on a per user level, you need to use tcp_wrappers instead of inetd.sec ...
You can get it at
ftp://ftp.porcupine.org/pub/security/index.html

[Deshpande Prashant]

HI
Dening telnet access will need to be done through little scripting in /etc/profile file.
Alternatively change the user shell to /usr/bin/false to restrict user to only ftp.

inetd.sec file will help you to restict access by IP addresses/host names.

Thanks.
Prashant