Regrettably I need to enable telnet for a single user on a Linux machine. Everyone else will have to use ssh.

How do I configure PAM to restrict which users may login via the telnet server?


You can use pam_succeed_if in your /etc/pam.d/telnet or similar file:

auth required pam_suceed_if.so user = ${telnet_user} quiet

Where ${telnet_user} is the user allowed to use telnet.

But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if at all possible.

Edit: Whoops, fudged the logic. Thanks joeforker.

  • 2
    +1 for "telnet is a Bad Thing" – theotherreceive Jul 6 '09 at 14:50
  • 1
    Unless, of course, you're using IPsec. Then SSH becomes an unnecessary CPU drain. – Teddy Jul 6 '09 at 15:16
  • 1
    Arguably, if you're putting enough data over an interactive shell for it to make the difference, then there's probably a better way to achieve what you're doing. – Dan Carley Jul 6 '09 at 15:43
  • I'm using RHEL5, I added a telnet group and 'auth required pam_succeed_if.so quiet user ingroup telnet' as the second non-comment line in /etc/pam.d/remote. It works! – joeforker Jul 6 '09 at 18:08

You could use pam_localuser:


of for a more flexible approach, pam_listfile:


Both basically look for allowed/forbidden usernames in a local file and check logins against that.


I see that on RHEL 5 this is not possible as "telnet-server" nor "krb5-telnet" are PAM compatible. Running "ldd" on these binaries doesn't give a pam library reference. The user must compile the telnet-server itself with PAM support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.