Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Im looking to implement telnet on Server 2012, i know its not secure yada yada, its just a project.

Whats the best security practices regarding this including software to use, if not inbuilt. I'm also putting an SSH server on there if theres anything that can combine the 2.

Thanks.

share|improve this question

closed as not constructive by HopelessN00b, Michael Hampton, petrus, Dave M, mdpc Jan 24 '13 at 21:06

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

9  
The best practice for telnet is to disable it. Period. End of discussion. Do not pass go, do not collect 200 security breaches and stolen passwords. If you tell us why you're trying to do this maybe we can give you a solution that doesn't make the Internet cry :-) –  voretaq7 Jan 24 '13 at 18:36
1  
One IP or one hundred makes little difference: you are still exposed to man-in-the-middle attacks and/or connection eavesdropping... –  voretaq7 Jan 24 '13 at 19:19
3  
IPSec doesn't have much of anything to do with Telnet. It's a generic security layer that can be applied to any IP based communication. We're looking for a practical, answerable question based on an actual problem are you facing. –  Chris S Jan 24 '13 at 19:36
1  
What exactly do you mean by telnet server? Do you mean to say that you plan on writing an application that opens a TCP socket for some purpose, or are you actually looking to provide Windows command line access via telnet? –  Zoredache Jan 24 '13 at 20:01
1  
You're not explaining why it must be telnet and can't be SSH. –  mfinni Jan 24 '13 at 20:45

6 Answers 6

Best security practices for telnet is to not use it. Failing that, restrict everything you possibly can, what IPs it will talk to, who can login, etc.

I have no idea what you mean by "combine the 2".

share|improve this answer
    
It will only be accessed by 1 ip who is myself, it won't actually be open to the world, just 1 client who will act as 'the world' in this project. A mean a third party install that can act as the telnet & ssh server. –  Dan Farrall Jan 24 '13 at 18:39

Everyone else is right: You will ultimately come to regret the day you ever thought of installing a telnet server on your Windows computer. When that day comes, please remember that you were thoroughly warned.

Now with that out of the way, if you're absolutely certain you want to hang yourself, here's the rope.

You can install the telnet server in the Add Roles and Features Wizard, accessible from Server Manager. (You can also install the telnet client.)

Rope to hang yourself with

Other ways to install telnet can be found on Microsoft TechNet.

share|improve this answer

If you're putting an SSH server on there as well, the solution is to use SSH instead of telnet.

SSH is the "more secure" development of telnet you're asking about in your comment. As to combining the two, no. Telnet is unencrypted. SSH is, for all intents and purposes, an encrypted telnet connection. The combination of telnet and "security" is SSH.

share|improve this answer

Just to humor the question.

You can do a few things to help secure a telnet server on Windows Server 2012.

You can:

  • change the default listening port (barely helps but still)
  • enable NTLM authentication instead of plain text
  • allow or disallow administrative privileges (using NTLM)

articles here:

http://technet.microsoft.com/en-us/library/cc754837%28v=ws.10%29.aspx

share|improve this answer

If you are looking for a command line, for yourself and administrative purpose, and the server is local (not over a firewall), use WinRS (Windows Remote Shell).

When you have everything setup and running, you can enter commands like:

winrs -r:serverName command  
share|improve this answer

Since you HAVE to use Telnet there are a couple of things that you can do to secure this.

I presume that you are running a recent version of Windows Server (2008 or better) and a recent version of the Windows client (Vista or better).

First, make sure that your server has the Windows Firewall running and limit the access to telnet on the proper interface, and to the proper machine that you will be running the client from.

Second, I would implement what is called "Domain Isolation" to IPSEC encrypt all traffic between your host and the server. If these systems are on a Windows domain you can use a GPO to configure that. If you are not you can implement local policies.

Mark Ringo

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.