(Linux) Telnet service

Linux作業系統開啟Telnet服務

安裝xinted

sudo apt-get install xinetd telnetd

設定xinted config

 sudo vi /etc/xinetd.conf

加入以下內容：

 # Simple configuration file for xinetd# # Some defaults, and include /etc/xinetd.d/ 
 defaults
 { 
     # Please note that you need a log_type line to be able to use log_on_success # and log_on_failure. The default is the following : # log_type = SYSLOG daemon info 
     instances = 60 log_type = SYSLOG authpriv log_on_success = HOST PID log_on_failure = HOST cps = 25 30
 } 
 includedir /etc/xinetd.d

 sudo vi /etc/xinetd.d/telnet

加入以下內容：

 # default: on
 # description: The telnet server serves telnet sessions; it uses
 # unencrypted username/password pairs for authentication.
 service telnet 
 { 
     disable = no flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in.telnetd log_on_failure += USERID 
 }

重啟網路服務

sudo /etc/init.d/xinetd restart
使用TELNET Client遠程登錄,即可進行非root用戶訪問
使用root登錄：

修改/etc/pam.d/login,下面一行註釋掉即可。
```
 #auth required lib/security/pam_securetty.so 
```

設定/etc/xinetd.d/telnet

 service telnet 
 { 
     disable =no 
     bind =192.168.1.2 
     only_from=192.168.1.0/24 
     #上面這兩行說明僅提供內部網段！ 
     Instance =UNLIMITED 
     Nice =0 
     Flags =REUSE 
     socket_type=stream 
     wait =no 
     user =root 
     #server =/usr/sbin/telnetd 
     server =/usr/sbin/in.telnetd 
     server_args =-a none 
     log_on_failure +=USERID 
 }

 service telnet 
 { 
     disable =no 
     bind =140.116.142.196 
     only_from=140.116.0.0/16 
     no_access=140.116.32.{10,26} 
     #上面三行設置外部較為嚴格的限制 
     instance =10 
     umask =022 
     nice =10 
     flags =REUSE 
     socket_type=stream 
     wait =no 
     user =root 
     #server =/usr/sbin/telnetd 
     server =/usr/sbin/in.telnetd 
     log_on_failure +=USERID 
 }

加設防火牆,使用iptables：
針對193.16.0.0/24這個網段及61.xxx.xxx.xxx這個IP進行telnet開放,增加下面幾行規則：

  /sbin/iptables -A INPUT -p tcp -i eth0 -s 193.16.0.0/24 --dport 23 -j ACCEPT
  /sbin/iptables -A INPUT -p tcp -i eth0 -s 61.xxx.xxx.xxx --dport 23 -j ACCEPT
  /sbin/iptables -A INPUT -p tcp -i eth0 --dport 23 -j DROP

加設防火牆,使用/etc/hosts.allow(deny)：
上面開放了193.16.0.0/24這個網段,如果只想讓其中的193.16.0.1~5進入,
```
  vi /etc/hosts.allow
```
```
  in.telnetd:193.16.0.1,193.16.0.2,193.16.0.3,193.16.0.4,193.16.0.5:allow
```