restrict a particular user from telnet

[Sanjeev gupta_2]

How can we restrict a particular user to telnet a system.
is there anyway to do it.
Thx

[Steve Steel]

Hi


If he comes from a certain system then with
inetd.sec see man inetd.sec

Otherwise on his machine of origin get rid of telnet for this user with an alias or such thing

What is the connection

pc-ux ux-ux

Steve Steel

[Sanjay Kumar Suri]

If you know the ip number of user system then following entery in /var/adm/inetd.sec should work:

telnet deny xxx.xxx.xxx.xxx

sks

[Sanjeev gupta_2]

Hi

But using inetd.sec i can retrict telenet from a particular system , but my case is that this user may come from any system and i do not want to restrict other user of that system to telnet.

[Sunil Sharma_1]

Hi,

it's not possible to restrict any perticular user to telnet to system.

You can put restriction on the basic of IP address of client. it can be done using inetd.sec file.

but if user will use some other IP address he will be allowed.

Sunil

[Sanjay Kumar Suri]

Remove the user from the /etc/passwd of target system.

sks

[RAC_1]

Put some code in in /etc/profile. Something like follows.

user_id=${LOGNAME}

if [ $user_id = unix_user_id ]
then
echo "Telnet not allowed for you"
exit 0
else
echo "Welcome to the system"
fi

You may also want to have a look at tcp wrappers. If you latest SSH installed(HP ssh), tcp wrappers is built in. You can put appropriate entried in /etc/hosts.allow and /etc/hosts.deny. tcp wrappers can go upto user level. for your case the entry will go in /etc/hosts.deny. The exact syntax you will have to check. IT should be something like
telnetd:user_id

The code part is easy.

Anil

[Henrik Palmqvist]

You could check if the parent process is telnetd in the users loginscript (.profile). If so, then just exit from the .profile script.

MYPPID=$( ps -fp $$ | tail -1 | awk '{print $3}' )
MYPPROCESS=$( ps -fp $MYPPID | tail -1 | awk '{print $NF}' )

[ "$MYPPROCESS" = "telnetd" ] && echo "Telnet not allowed" && exit

[Slawomir Gora]

Hi,

it is not possible to restrict any perticular user to telnet to system - maby ssh will solve you problem.

[Jose Mosquera]

Hi,

Configuring /var/adm/inetd.sec file is a good way to control a specific node into a LAN environment. The trouble is that user could connect into other LAN node. In my opinion the best way is by /etc/profile control. By this way doesn't matter where user is connected from and if the environment is LAN or not.

Rgds.

[Sunil Sharma_1 · Accepted solution]

Hi,

Another work around.

add an exit in users .profile first line.


so when user will login he will get logout immediately

Sunil

[Thayanidhi]

If you cannot delete the user, and the user needed for some other purpose (e.g. ftp) then change the shell to some thing else.
(/usr/bin/false) - Not sure about the path

TT

[Ravi_8]

Hi,

on uid basis you can't disable telnet. where as on IP basis you can

[Muthukumar_5]

We can restrict a particular user from telnet /ssh or any other login services then,

1. Lock the user account as,
passwd -l

It can be done only by super user


2. Add an entry in /etc/profile as,

if [[ $LOGNAME = "username" ]]
then
echo "You are blocked to login. contact @"
# Sleep time to show to user
sleep 5
exit 0
fi

To block only telnet service then,

if [[ $LOGNAME = "testusr" ]]
then
if [[ `ps | grep -q telnet` -eq 0 ]]
then
echo "Your account login using telnet is blocked"
sleep 5
exit 0
fi
fi

So you can block using user accounts too.

Regards
Muthu