disabling telnet, rlogin... etc....

[spyghost]

hi,

i have implemented ssh on my remote logins to my solaris. i have already disabled those uneeded remote access services such as telnet, rlogin, etc... as well as ftp.

now how can i create a prompt such that if telnet <system> is used, i would be able to see some message saying... "Telnet to this machine is disabled... exiting..."
or if ftp <system> is used, the user would see something like "FTP is not allowed in this machine"

how can i do that?

???

 

[KenCunningham]

Presumably if telnet and ftp are disabled, the connection would fail anyway, therefore any message wouldn't be necessary or even possible?

 

[Wonboodoo]

Presumably they were disabled by just commenting out or removing the /etc/services entries and restarting or sending a HUP signal to inetd?

I don't particularly no why you need these messages since they can't get in anyway. But you could do the following:

1) Write a little C-program that just prints out your message:
#include <stdio.h>
main() {
printf("This services has been disabled on this machine\n");
}

2) Change the /etc/inetd.conf entry for the service to point to your C program binary. For example for telnet it probably was this:
telnet stream tcp6 nowait root /usr/sbin/in.telnetd in.telned
change it to this:
telnet stream tcp6 nowait root /usr/local/bin/foo foo
(assuming your program is called "/usr/local/bin/foo")

3) Re-enable the /etc/services entries

4) kill -HUP `ps -ef | grep inetd | grep -v grep | awk '{print $2}'`

 

[spamly]

The only problem with creating your own program and binding it to the applicable disabled ports is that you may be vulernable to exploits.

How much memory would each instance of your program use if it was called? What if a hacker called it 10 times? What if a hacker called it 1000 times? Do you have a restriction on how many connections the port will allow (See xinetd and/or ipfilter)?

In Wonboodoo's example, the program would be run as root. This isn't a good idea for many reasons. If you do decide to persue this, consider using a user with no real access.

Don't get me wrong. I've done exactly what Wonboodoo has suggested (as a different user and using IPV4 though) and it worked for me. Just be aware that there may be other issues that come up.

Good luck!