telnetd and banner

[Betty Fessler]

My company considers it a security issue to have telnetd display the hostname/version prior to the login prompt. I've noticed that if I use /etc/issue it doesn't display the hostname/version, but my company also want us to force a sleep period between the display of /etc/issue and the login prompt. When I put a script in to display /etc/issue and sleep prior to the telnet session I'm back to displaying the hostname/version prior to login.
Any way to disable this display of hostname/version?

[harry d brown jr]

I don't believe setting a delay is possible.

As for /etc/issue, change /etc/inetd.conf to use a different banner page:

grep telnet /etc/inetd.conf
telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b /etc/telnetbannerpage -TCP_DELAY

Changing the banner page is ok, but for real security you need to make sure snmp isn't responding to system info requests.

Of course allowing only ssh connections would be better.

live free or die
harry d brown jr

[Betty Fessler]

Is there any way of getting telnet to stop displaying what IP its trying and who it connects to?

[harry d brown jr]

WHY? That's not a security threat as the user had to type it in in the first place! The answer is no.

live free or die
harry d brown jr

[A. Clay Stephenson · Accepted solution]

This here's a very sneaky way to add a delay to telnetd and thus outbushwhack the problem. I assume that you are adding the -b /etc/issue argument to the telnetd entry in inetd.conf.

We need to make the banner file, /etc/issue, a whole lot bigger but with invisible characters; ASCII NUL's should do the job. They will not alter the dispplay but each one introduces a finite tranmission delay.

1) cp /etc/issue /etc/issue.sav
2) dd if=/dev/zero bs=1k count=1024 of=/var/tmp/nuls
3) cat /var/tmp/nuls >> /etc/issue

Now try telnet'ing to your box. Step 3 can be repeated until the delay is long enough.
We are appending to the existing /etc/issue file. Step 2 creates a 1MB file but you may find that reducing count gives you better granularity for tuning the delay.

[RAC_1]

What CAN I say??

There is always A Clay....

[Robert Fisher_1]

I agree, RAC. I was trying to figure out how to put in a sleep and A. Clay just "outbushwhacks" it as he puts it. Small wonder that he is our only Triple Olmpian!!

Bob

[Betty Fessler]

Clays idea works, thanks.