Linux

Ask something
Discussion Locked

Restrict Telnet users

0 helpful
15 replies

by dennisbv

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I administer a RS6000 box with AIX 4.3 most of my users login through thier Com ports or Terminal connected to a Ran box. Basicly they are connected to a port by thier cable conected to thier com port. I have some users that Telnet in through the Ethernet network. On all the PC's we are using a terminal emulator, the only difference is that some go over the Ethernet instaed of the cable conected to thier com port. I can disable the ports for the users that direct connect but I need to know How I can disable the Telnet users. When I do maintenace on the server and I disable to tty ports the Telnet users can still log in.

15 replies

by mshavrov

If you just need to prevent some users from Telneting to UNIX box, why not to disable these accounts on the server? Generaly what you may do in any kind of UNIX, just edit /etc/passwd (or /etc/shadow) file and enter any "extra" character to passwordfield for user, you want to disable (for example, "*" or "~"). This will change password hash and user will be unable to login. Then, when you will need to re-enable this user, just remove this "extra" character from the password field and user willhave same password he had before.

In some UNIX systems you may configure "time based" restrictions for user accounts or "enable/disable" users accounts from GUI interface, but the method, described above works on all UNIX systems.

Good luck.

by dennisbv

The first answer may work but with a bunch of users that will create a lot of extra work. Is there away to automate the 1st answer or is there an automated way to disable telent?

by kshcsuf

Most BSD and System V variants support a file called /etc/nologin that you can touch to prevent interactive access during maintenance periods.

Any text you place in the /etc/nologin file will be displayed to users when they attempt to login. So,a nice sample message like "Rebuilding database indexes... try again later." or "Repairing disks... back up in 10 minutes." would be helpful.

When you are done with your maintenance, you can simply remove this file:

# rm /etc/nologin

by cavedweller

To stop the telnet daemon, comment it out in the /etc/inetd.conf file and then restart inetd. You might also want to turn off some other services like ftp.

by dennisbv

I am increasing the points on this question as the questions that have been submitted are correct but I have an additional part. How can I stop some users from telneting while allowing other users to telnet in?

by nickmkhn

OK, with that bunch of users, is it possible for you to organize those users in one (primary?) group?
And restrict temporarely to telnet for the whole group, by similar way as it is described in Answer1?

by nickmkhn

RE: Can you have Groups in AIX ? If so how do you do it?

- Yes, in terms of UNIX in general, (and “Ain’t UNIX”=AIX particularly) :

http://www.ucalgary.ca/it/aix/accesscontrol.html
(remove all spaces from the link before opening !)

You have to decide first who those yours “a bunch of users” are, and which specific group they belong to.
Or otherwise: you can assume, and keep, and treat “a bunch of users” as others, but you have to implement some work and arrange in a group(s) the users that you trust and allow to telnet at the moment.

That will do your work easy, and you will be able to switch permissions to telnet ON and OFF in seconds, as a snap.

Please, read man on chmod (Change Access Permission Mode of File).
For example, you can set Group ID on the execution for a certain group (you want), and restrict the execution for Others (you don’t like at the moment):

chmod g+s,o-x /usr/bin/telnet

Then at any time you can grant the execution back to Others in a second. Also, as you can see from man, you have more options when working with groups annd users.

This discussion is closed to new replies.