up vote 0 down vote favorite
share [g+] share [fb]

Regrettably I need to enable telnet for a single user on a Linux machine. Everyone else will have to use ssh.

How do I configure PAM to restrict which users may login via the telnet server?

link|improve this question
58% accept rate
feedback

3 Answers

up vote 8 down vote accepted

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file:

auth required pam_suceed_if.so user = ${telnet_user} quiet

Where ${telnet_user} is the user allowed to use telnet.

But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if at all possible.

Edit: Whoops, fudged the logic. Thanks joeforker.

link|improve this answer
2  
+1 for "telnet is a Bad Thing" – theotherreceive Jul 6 '09 at 14:50
Unless, of course, you're using IPsec. Then SSH becomes an unnecessary CPU drain. – Teddy Jul 6 '09 at 15:16
1  
Arguably, if you're putting enough data over an interactive shell for it to make the difference, then there's probably a better way to achieve what you're doing. – Dan Carley Jul 6 '09 at 15:43
I'm using RHEL5, I added a telnet group and 'auth required pam_succeed_if.so quiet user ingroup telnet' as the second non-comment line in /etc/pam.d/remote. It works! – joeforker Jul 6 '09 at 18:08
feedback
up vote 2 down vote

You could use pam_localuser:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_localuser.html

of for a more flexible approach, pam_listfile:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_listfile.html

Both basically look for allowed/forbidden usernames in a local file and check logins against that.

link|improve this answer
feedback
up vote 0 down vote

I see that on RHEL 5 this is not possible as "telnet-server" nor "krb5-telnet" are PAM compatible. Running "ldd" on these binaries doesn't give a pam library reference. The user must compile the telnet-server itself with PAM support.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.