Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Regrettably I need to enable telnet for a single user on a Linux machine. Everyone else will have to use ssh.

How do I configure PAM to restrict which users may login via the telnet server?

share|improve this question
up vote 9 down vote accepted

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file:

auth required user = ${telnet_user} quiet

Where ${telnet_user} is the user allowed to use telnet.

But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if at all possible.

Edit: Whoops, fudged the logic. Thanks joeforker.

share|improve this answer
+1 for "telnet is a Bad Thing" – theotherreceive Jul 6 '09 at 14:50
Unless, of course, you're using IPsec. Then SSH becomes an unnecessary CPU drain. – Teddy Jul 6 '09 at 15:16
Arguably, if you're putting enough data over an interactive shell for it to make the difference, then there's probably a better way to achieve what you're doing. – Dan Carley Jul 6 '09 at 15:43
I'm using RHEL5, I added a telnet group and 'auth required quiet user ingroup telnet' as the second non-comment line in /etc/pam.d/remote. It works! – joeforker Jul 6 '09 at 18:08

You could use pam_localuser:

of for a more flexible approach, pam_listfile:

Both basically look for allowed/forbidden usernames in a local file and check logins against that.

share|improve this answer

I see that on RHEL 5 this is not possible as "telnet-server" nor "krb5-telnet" are PAM compatible. Running "ldd" on these binaries doesn't give a pam library reference. The user must compile the telnet-server itself with PAM support.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.