Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

Regrettably I need to enable telnet for a single user on a Linux machine. Everyone else will have to use ssh.

How do I configure PAM to restrict which users may login via the telnet server?

share|improve this question

3 Answers

up vote 8 down vote accepted

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file:

auth required pam_suceed_if.so user = ${telnet_user} quiet

Where ${telnet_user} is the user allowed to use telnet.

But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if at all possible.

Edit: Whoops, fudged the logic. Thanks joeforker.

share|improve this answer
2  
+1 for "telnet is a Bad Thing" – theotherreceive Jul 6 '09 at 14:50
Unless, of course, you're using IPsec. Then SSH becomes an unnecessary CPU drain. – Teddy Jul 6 '09 at 15:16
1  
Arguably, if you're putting enough data over an interactive shell for it to make the difference, then there's probably a better way to achieve what you're doing. – Dan Carley Jul 6 '09 at 15:43
I'm using RHEL5, I added a telnet group and 'auth required pam_succeed_if.so quiet user ingroup telnet' as the second non-comment line in /etc/pam.d/remote. It works! – joeforker Jul 6 '09 at 18:08
up vote 2 down vote

You could use pam_localuser:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_localuser.html

of for a more flexible approach, pam_listfile:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_listfile.html

Both basically look for allowed/forbidden usernames in a local file and check logins against that.

share|improve this answer
up vote 0 down vote

I see that on RHEL 5 this is not possible as "telnet-server" nor "krb5-telnet" are PAM compatible. Running "ldd" on these binaries doesn't give a pam library reference. The user must compile the telnet-server itself with PAM support.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.