second telnetd?

[Ben Wilson_4]

Hi,
I tried in vain to stop my company from opening telnet to our HP 11.0 server from the internet for a single application.
After telneting in, the users login script starts the app, and logs out. I feel confident in the security of the log in scripts, but i only want the user accounts that start the application to be able to telnet from the internet.
Any ideas? I was looking at running a second telnet daemon on a different port, but how do you force an automatic logon (not letting them choose a username to log in as)?
I was looking at the telnetd on linux, and was curious about the -L option, providing a different program than "/bin/login" for authentication. Is this option available on HP-UX?

Thanks,
Ben

[G. Vrijhoeven]

Hi,

second telnetd on other port /etc/inetd.conf copy telnet line and alter the port reload (inetd -c) but think about the next option:

I think you should take a look at sshd, if you want your system available from the internet.

take a look at this url:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0xd4cecf38d6bdd5118ff10090279cd0f9,00.html

Hope this will help.

Gideon

[Ben Wilson_4]

I did install ssh, but i can't get anybody to use it. All the users connect with ProComm or Replections Windows telnet applications. I haven't seen an application like them for ssh that allow scriptsing and scheduling.

the real problem i have if trying to force the username and password that is used when connecting to the second "internet" telnetd. once that is done, i have pretty tight logins scripts to take care of the rest.

Thanks,
Ben

[G. Vrijhoeven]

Hi,

Ok. How are you planning to alter the tcp/port these applications are using to set up theire telnet connections?

telnet machine_name:32

A login procedure can be automated with a .rhosts file and remsh, but over the internet?!?!?

Is it possible to create a ssh tunnel and let those applications connect throug the tunnel?

Gideon

[Craig Rants]

If they are going to play that way I would turn their shell in to a TUI program that lets them execute their scripts.

Instead of /bin/sh in the password file for the user they get /usr/local/script.sh

When they sign in they get the TUI and no shell, they may change their tune after that.

Good Luck,
Keep fighting the good fight,
C

[Bernie Vande Griend]

I don't think you want to automate the telnet connection from the internet or then it will be too easy for someone to get in who shouldn't be. However, you can use /etc/profile to check the IP the user is coming from and the user ID they are using and stop the login if it doesn't fit your criteria. You should then be able to differentiate between a connection from internally and from the internet. Products like CA's Access Control and Symark's PowerBroker also have nice solutions for situations like this.

[Ben Wilson_4]

thanks for the suggestions.

my plan was to run a second telnet daemon on a different port, say 1023, then when a telnet is made to the internet ip on port 23, the firewall would forward it to port 1023 on the internal ip.

then that telnet daemon would auto-login as a user that excutes the app in the .login, then the next line is "logout".

maybe i should forget telnet and write a perl script to listen on the port then run the app?

ideas appreciated,
ben