restricting telnet access

[A Pandey]

Hi All,

I want to restrict telnet access for everyone except myself (root) and some other users.

Everyone else uses telnets (secure telnet) however they still have a telnet icon on their desktop which will take weeks to remove (so says the windows sys admin).

thanks,

ap.

[George_Dodds · Accepted solution]

You can either use tcpwrappers or or edit each users profile to restrict telnet access.

[DCE]

Use TCP wrappers

Download and install the TCP Wrapper depot from the HP website


The files are installed in two directories
/usr/lbin
/usr/newconfig/etc

Make the following directories
/usr/lbin/wrapper
/usr/local/sbin/messages
/usr/local/sbin/messages/reject

Move the original telnet daemon file
mv /usr/lbin/telnetd /usr/lbin/wrapper/telnetd

Copy the tcpd file
cp /usr/lbin/tcpd /usr/lbin/telnetd

Copy the configuration files
cp /usr/newconfig/etc/hosts.allow /etc/hosts.allow
cp /usr/newconfig/etc/hosts.deny /etc/hosts.deny
cp /usr/newconfig/etc/tcpd.conf /etc/tcpd.conf

Customize the /etc/hosts.allow file
Add the following line to the end of the file:

telnetd : hostnames

Customize the /etc/hosts.deny file
Add the following line to the end of the file
Telnetd : ALL : BANNERS /usr/local/sbin/messages/reject

Customize the /etc/tcpd.conf file
Remove the remark from the rfc931_timeout line

Create the BANNER file
The file name must be the same as the daemon being manipulated â in the case telnetd
Change to /usr/local/sbin/messages/reject
Create a file called telnetd with the following entry:

WARNING!!

The system you are attempting to connect to does not allow telnet sessions


Force the inet daemon to re-read the configuration file

inetd â c

[baiju_3]

check out inetd.sec file .

Man inetd.sec , you can allow telnet ,
from particular host and disable from all other hosts on the network .


thx,
bl.

[Ivan Ferreira]

It will be a little hard to restrict by user, what you could do is to check if you can pass the port to listen to the telnet daemon and change it. Configure your sesions to connect to the specified port. Anyway tcpwrappers seems to be more apropiate.