How to disable a certain user to telnet to the server?

[yyghp]

I would like to block a certain user from logging into a server via "telnet", no matter this user tries to login from different clients. And I have to keep other users to be able to telnet the server.
What's the best way to achieve this?
Thanks!

[Torsten.]

The only way to do this is to delete the users account from this server, I guess.

[Rick Garland · Accepted solution]

Create a function in the /etc/profile.

if [ $LOGNAME == "acct" ]
then
not allowed to login on this server
sleep 3
exit
fi

(Double check the test syntax)

[Michael Steele_2]

On a lab machine fool around with /var/adm/inetd.sec and deny any specific ip address. In this case the work station ip.

telnet deny 123.345.56.7 987.87.5.322 584.485.5.7

[Torsten.]

Telnet is quite old and not designed for security, only for functionality.

I would extend Ricks post with an "echo" or something like that, but Michaels post assumes a certain IP address, this will other users stop too.

If you dislike the user, delete his account ;-))

Do you know the "operator from hell"?

[Steven E. Protter]

Shalom,

passwd -l username

Lock the account.

SEP

[Michael Steele_2]

inetd.sec will deny all telnet access or only one specific ip address.

telnet deny (* all telnet *)
telnet deny ip (* only that ip *)

There is also tcpwrappers.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=TCPWRAP

[Sanjay_6]

hi,

If you change the shell of this user to /usr/bin/false and add /usr/bin/false to the /etc/shells file, the user would not be able to do a telnet to the system. do you want to allow him to do a ssh or any other type of connection at all.

Hope this helps.

regds

[GBR]

I like SEP's idea. That way you can enable the account at some point in the future, without wiping out the account.

Disable user %> passwd -l user
Enable user %> passwd user

GBR

[Torsten.]

I would like to know why you want to disable the telnet access for this user and if the user have to access the server in different ways. This will decide the option.

[Bill Hassell]

I guess this is too simple: change the user's password. If the user knows multiple user logins (especially root), I would consider this a security issue and deal with the user. I would hope that your system does NOT have any duplicate logins:

logins -d

again, a serious security risk, just as having a lot of users login with the same user ID (a shared login).