TELNET

TELNET is a program that allows users to log into your server and get a command prompt just as if they were logged into the VGA console. The TELNET server RPM is installed and disabled by default on Fedora Linux.

One of the disadvantages of Telnet is that the data is sent as clear text. This means that it is possible for someone to use a network analyzer to peek into your data packets and see your username and password. A more secure method for remote logins would be via Secure Shell (SSH), which uses varying degrees of encryption.

In spite of this, the older TELNET application remains popular. Many network devices don't have SSH clients, making Telnet the only means of accessing other devices and servers from them. I'll show you how to limit your exposure to TELNET's insecurities later in this chapter.

Using The TELNET Client

The command to do remote logins via TELNET from the command line is simple. You enter the word "telnet" and then the IP address or server name to which you want to connect.

Here is an example of someone logging into a remote server named smallfry from server Bigboy. The user looks at the routing table and then logs out.

     [root@bigboy tmp]# telnet 192.168.1.105
     Trying 192.168.1.105...
     Connected to 192.168.1.105.
     Escape character is '^]'.

     Linux 2.4.18-14 (smallfry.my-web-site.org) (10:35 on Sunday, 05
     January 2003)

     Login: peter
     Password:
     Last login: Fri Nov 22 23:29:44 on ttyS0
     You have new mail.
     [peter@smallfry peter]$
     [peter@smallfry peter]$ netstat nr
     Kernel IP routing table
     Destination     Gateway      Genmask         Flags  MSS Window irtt
     Iface
     255.255.255.255 0.0.0.0       255.255.255.255 UH     40  0      0
     wlan0
     192.168.1.0     0.0.0.0       255.255.255.0   U      40  0      0
     wlan0
     127.0.0.0       0.0.0.0       255.0.0.0       U      40  0      0
     lo
     0.0.0.0         192.168.1.1   0.0.0.0         UG     40  0      0
     wlan0
     [peter@smallfry peter]$ exit
     logout

     Connection closed by foreign host.
     [root@bigboy tmp]#

Installing the TELNET Server Software

Older versions of Red Hat had the TELNET server installed by default. Fedora Linux doesn't do this, and you will have to install it yourself.

Most Red Hat and Fedora Linux software products are available in the RPM format. Downloading and installing RPMs isn't hard. If you need a refresher, Chapter 6, "Installing RPM Software," covers how to do this in detail.

When searching for the file, remember that the TELNET server RPM's filename usually starts with telnet-server followed by a version number, as in telnet-server-0.17-28.i386.rpm.

Setting Up a TELNET Server

To set up a TELNET server, use the chkconfig command to activate TELNET:

     [root@bigboy tmp]# chkconfig telnet on

You can test whether the TELNET process is running with the netstat command, which is used to check the TCP/UDP ports on which your server is listening. If it isn't running, then there will be no response.

     [root@bigboy tmp]# netstat -a | grep telnet
     tcp         0        0         *:telnet        *:*
     LISTEN
     [root@bigboy tmp]#

You can also use the chkconfig --list command to verify that TELNET will be started on the next reboot:

     [root@bigboy tmp]# chkconfig --list | grep telnet
              telnet: on
     [root@bigboy tmp]#

Stopping a TELNET Server

Use the chkconfig command to deactivate TELNET, even after the next reboot:

     [root@bigboy tmp]# chkconfig telnet off

Basic TELNET Security

There are a number of things you can do to improve the security of TELNET. For example, you should also try to ensure that TELNET sessions run over secure internal networks or across VPNs to reduce the risk of exposing sensitive data to unauthorized eyes. Check out some other options.

Let Telnet Listen on Another TCP Port

Letting TELNET run on an alternate TCP port doesn't encrypt the traffic, but it makes it less likely to be detected as TELNET traffic. Remember that this isn't a foolproof strategy; good port scanning programs can detect TELNET and other applications running on alternative ports. The steps are:

# Local services
stelnet          7777/tcp                          # "secure"
telnet

[root@bigboy tmp]# cp /etc/xinetd.d/telnet /etc/xinetd.d/stel-
net

# default: on
# description: The telnet server serves telnet sessions
# unencrypted username/password pairs for authentication.
service stelnet
{
        flags           = REUSE
        socket_type    = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure += USERID
        disable         = no
    port            = 7777
}

[root@bigboy tmp]# chkconfig stelnet on

[root@bigboy tmp]# netstat -an | grep 777
tcp   0  0 0.0.0.0:7777        0.0.0.0:*          LISTEN
[root@bigboy tmp]#

You should now be able to log into the new stelnet server on port 7777. This is done using the telnet command with the TCP port as the second argument.

     [root@smallfry tmp]# telnet 192.168.1.100 7777
     Trying 192.168.1.100...
     Connected to 192.168.1.100.
     Escape character is '^]'.
     Fedora Core release 2 (Tettnang)
     Kernel 2.6.8-1.521 on an i686
     login:

Let TELNET Allow Connections from Trusted Addresses

You can restrict TELNET logins' access to individual remote servers by using the only_from keyword in the TELNET configuration file. Here's how:

# default: on
# description: The telnet server serves telnet sessions
# unencrypted username/password pairs for authentication.
service telnet
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure += USERID
        disable         = no
        only_from       = 192.168.1.100 127.0.0.1
192.168.1.200
}

[root@bigboy tmp]# chkconfig telnet off
[root@bigboy tmp]# chkconfig telnet on

[root@smallfry tmp]# telnet 192.168.1.100
Trying 192.168.1.100...
Connected to 192.168.1.100.
Escape character is '^]'.
Connection closed by foreign host.
[root@smallfry tmp]#