1

Regrettably I need to enable telnet for a single user on a Linux machine. Everyone else will have to use ssh.

How do I configure PAM to restrict which users may login via the telnet server?

Improve this question

3 Answers 3

Reset to default
9

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file:

auth required pam_suceed_if.so user = ${telnet_user} quiet

Where ${telnet_user} is the user allowed to use telnet.

But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if at all possible.

Edit: Whoops, fudged the logic. Thanks joeforker.

Improve this answer
3
  • 1
    Unless, of course, you're using IPsec. Then SSH becomes an unnecessary CPU drain.
    – Teddy
    Jul 6, 2009 at 15:16
  • 1
    Arguably, if you're putting enough data over an interactive shell for it to make the difference, then there's probably a better way to achieve what you're doing.
    – Dan Carley
    Jul 6, 2009 at 15:43
  • I'm using RHEL5, I added a telnet group and 'auth required pam_succeed_if.so quiet user ingroup telnet' as the second non-comment line in /etc/pam.d/remote. It works!
    – joeforker
    Jul 6, 2009 at 18:08
2

You could use pam_localuser:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_localuser.html

of for a more flexible approach, pam_listfile:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_listfile.html

Both basically look for allowed/forbidden usernames in a local file and check logins against that.

Improve this answer
-1

I see that on RHEL 5 this is not possible as "telnet-server" nor "krb5-telnet" are PAM compatible. Running "ldd" on these binaries doesn't give a pam library reference. The user must compile the telnet-server itself with PAM support.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .