inetd.sec - Telnet localhost only works for root

[Vinesh Dhevcharran_1]

Hi,

I have commenced tightening up on security by implementing inetd.sec. This is working fine for all users for all "allowable" ip addresses except for telnet to localhost for non root users!

entry in /var/adm/inetd.sec
telnet allow 123.12.34.02-20 127.0.0.1 localhost
permission on inetd.sec is 444 root:sys

e.g. for user abcd
telnet localhost
localhost: Unknown host
test=abcd>>ping localhost
PING localhost: 64 byte packets
64 bytes from 127.0.0.1: icmp_seq=0. time=0. ms

e.g. for user root
telnet localhost
Trying...
Connected to localhost.
Escape character is '^]'.
Local flow control on
Telnet TERMINAL-SPEED option ON

HP-UX test B.11.00 A 9000/800 (ta)

login:

Many thanks for any help

[Massimo Bianchi]

Hi,
for root there is another security mechanisms


Create a file called /etc/securetty.
this file lists the allowed terminal root can connect from.

Usually there is only just one entry:
console

This should help you .

HTH,
Massimo

[Vinesh Dhevcharran_1]

Hi,

Thanks for the response, but user root is NOT the problem.
1. I already have a file securetty with the word console in it.
2. If I try and telnet as user root, I get a login screen. From here I login as a non-root user.
3. If I try and telnet as a non-root user (uid ne 0) I get the message "unknown host"

My problem is with non-root users

[Massimo Bianchi]

Hi,
what are the permission of file /etc/hosts ?

HTH,
Massimo

[David_246 · Accepted solution]

Hi,

Please show us the contents of /etc/nsswitch.conf

Depending on what is in there show us the output of :
- grep localhost /etc/hosts
- nslookup localhost
- ls -l /etc/nsswitch.conf
- ls -l /etc/resolv.conf

If you can provide us all the requested output, the solution must be near.

Regs David

P.S. : Please assign points to your previous (16) answers. They at least spent time to help you, right ?

[Vinesh Dhevcharran_1]

Hi

As a non-root user, if I try telnet localhost I get:
test=abcd>>telnet localhost
localhost: Unknown host

As a non-root user, if I try telnet 127.0.0.1 I get:
Trying...
Connected to 127.0.0.1.
Escape character is '^]'.
Local flow control on
Telnet TERMINAL-SPEED option ON
HP-UX test B.11.00 A 9000/800 (ta)
login:

To summarize:
Telnet to localhost or 127.0.0.1 works as user root (Obviously I login as non-root user because of the securetty file)
Telnet to 127.0.0.1 works for non-root user
telnet to localhost does not work for non-root user

Any help is appreciated.

Vinesh

[Massimo Bianchi]

Hi Vinesh,
can you please check the permission of file /etc/hosts ?

If, as user non-root, you cannot resolve localhost, looks like a name resolution problem, more than a inetd.sec problem.

Massimo

[Vinesh Dhevcharran_1]

ls -al hosts
-rw-r--r-- 1 root sys 847 Jul 14 15:03 hosts
ls -al /etc/nsswitch.conf
-rw------- 1 root sys 122 Jun 14 2002 /etc/nsswitch.conf

as user root
test:/etc# nslookup localhost
Name Server: xxxxx.uuu.co.za
Address: 123.456.789.1

Trying DNS
looking up FILES
Name: localhost
Address: 127.0.0.1
Aliases: loopback

as user abcd
test=abcd>>nslookup localhost
Name Server: xxxxx.uuu.co.za
Address: 123.456.789.1

Trying DNS
Trying NIS
looking up FILES
Name: localhost
Address: 127.0.0.1
Aliases: loopback


more /etc/nsswitch.conf
hosts: dns [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] files[NOTFOUND
=return UNAVAIL=continue TRYAGAIN=return]

grep localhost /etc/hosts
127.0.0.1 localhost loopback

Thanks
PS. David, This is the second userid that I am using. I cannot access all other requests from my first userid. Apologies never-the-less.

[Vinesh Dhevcharran_1]

Hi,

The problem was the permissions on nsswitch.conf. It was 600. I changed this to 644 and the telnet now works.

Is the 644 permission fine as far as security goes?

[Massimo Bianchi]

Hi,
644 is optimal for security.

If you want very thighten security, you can go also down to 444, just to avoid accidental overwriting.

HTH,
Massimo

[James R. Ferguson]

Hi:

Yes, the permissions of 644 are correct and necessary. This simply means that the file's owner (here, 'root') can read-and-write the file but the group (here, 'sys') can only read; and all other users are also limited to read-only access.

Regards!

...JRF...