关于Linux系统，这次我们来讲解一下telnet服务的相关内容。那么对于Linux下的telnet设置，我们针对不同的版本以及相关的一些问题来进行一下讲解。那么具体内容请大家参考正文。
一、telnet基础知识
telnet:提供telnet服务,使用未加密的用户/密码组进行验证,依附于xinetd服务.文件位于/etc/xinetd.d/telnet.
krb5-telnet:提供telnet服务,允许普通的telnet登陆,默认是不允许root用户登录,使用kerberos5验证 ,依附于xinetd服务.文件位于/etc/xinetd.d/krb5-telnet.
ekrb5-telnet:提供加密的telnet服务,但是必须要ekrb5的加密服务器.文件位于/etc/xinetd.d/ekrb5-telnet.
xinetd:因特网操作服务程序.提供类似于inetd+tcp_wrapper的功能,但是更加强大和安全,监控网络对各种它管理的服务的需求,并在要的时候启动相应的服务程序.文件位于/etc/xinetd.d中。
二、telnet服务安装
1、查看telnet rpm包
- [root@rhel52 /]# rpm -qa | grep telnet
- telnet-0.17-38.el5
- telnet-server-0.17-38.el5 《=RHEL5CD#4
- [root@rhel52 /]#
2、安装telnet server rpm包
- [root@rhel52 work]# rpm -ivh telnet-server-0.17-38.el5.i386.rpm
- warning: telnet-server-0.17-38.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID 37017186
- Preparing... ########################################### [100%]
- package telnet-server-0.17-38.el5 is already installed
- [root@rhel52 work]#
注:安装完毕以后会在/etc/xinetd.d/中出现一个telnet配置文件#p#
三、telnet服务检测
1、查看telnet服务
- [root@rhel52 /]# chkconfig --list | grep telnet
- ekrb5-telnet: off
- krb5-telnet: off
- telnet: off
- [root@rhel52 /]#
2、开启telnet服务
- [root@rhel52 /]# chkconfig telnet on
- 也可以用[root@rhel52 /]# ntsysv开启
3、设置自动启动
- [root@rhel52 /]# chkconfig --level 35 telnet on
- [root@rhel52 /]# chkconfig --list | grep telnet
- ekrb5-telnet: off
- krb5-telnet: off
- telnet: on
- [root@rhel52 /]#
四、telnet服务调试
1、配置telnet文件
- [root@rhel52 /]# vim /etc/xinetd.d/telnet
- # default: on
- # description: The telnet server serves telnet sessions; it uses \
- # unencrypted username/password pairs for authentication.
- service telnet
- {
- disable = no 《=确认是no
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/sbin/in.telnetd
- log_on_failure += USERID
- }
2、注意/etc/xinetd.d/ekrb5-telnet 和 krb5-telnet两个文件中的disable,稍后说明其作用.#p#
五、telnet开启root
1、确认/etc/pam.d/login中的pam_securetty.so行,并将其注释掉"#"
- [root@rhel52 /]# vim /etc/pam.d/login
- #%PAM-1.0
- #auth [user_unknown=ignore success=ok ignoreignore=ignore default=bad] pam_securetty.so
- auth include system-auth
- account required pam_nologin.so
- account include system-auth
- password include system-auth
- # pam_selinux.so close should be the first session rule
- session required pam_selinux.so close
- session include system-auth
- session required pam_loginuid.so
- session optional pam_console.so
- # pam_selinux.so open should only be followed by sessions to be executed in the
- user context
- session required pam_selinux.so open
- session optional pam_keyinit.so force revoke
2、开通telnet控制台,在/etc/securetty文件中设定
- [root@rhel52 /]# vim /etc/securetty
- console
- vc/1
- vc/2
- vc/3
- tty1
- tty2
- tty3
- tty4
- tty5
- ...
- pts/1
- pts/2
- pts/3
- pts/4
- pts/5
- 在文件后面追加"pts/1....pts/n"
#p#
六、telnet服务启动
- 因为telnet服务是由xinetd调用,所以只要重新启动xinetd即可
- [root@rhel52 /]# service xinetd restart
- Stopping xinetd: [ OK ]
- Starting xinetd: [ OK ]
- [root@rhel52 /]#
七、telnet服务测试
- Microsoft Windows [版本 6.1.7100]
- 版权所有 (c) 2009 Microsoft Corporation.保留所有权利.
- C:\>telnet 192.168.238.220
- 正在连接192.168.238.220...
- Red Hat Enterprise Linux Server release 5 (Tikanga)
- Kernel 2.6.18-8.el5 on an i686
- login: root
- Password:
- Last login: Sat Aug 1 22:47:15 from 192.168.238.1
- [root@rhel52 ~]#
八、telnet端口更改
- 设定配置文件/etc/services
- [root@CentOS5 /]#vi /etc/services
找到下面的两行:
- telnet 23/tcp
- telnet 23/udp
#p#
九、telnet服务限制
设定配置文件/etc/xinetd.d/telnet
- [root@rhel52 /]# vim /etc/xinetd.d/telnet
- access_time = 20:00-24:00
- # default: on
- # description: The telnet server serves telnet sessions; it uses \
- # unencrypted username/password pairs for authentication.
- service telnet
- {
- disable = no
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/sbin/in.telnetd
- log_on_failure += USERID
- only_from = 192.168.0.0/16
- }
- #bind = 192.168.0.100
- #only_from = 192.168.0.0/24
- #no_access = 192.168.0.{80,90}
- #access_times = 8:00-9:00 20:00-23:00
十、配置文件krb5-telnet
文件所在位置 /etc/xinetd.d/krb5-telnet
其实rhel5已经装了krb5-telnet,那么就可以启用这个服务来达到开启telnet的目的.不用再安装telnet-server这个软件包了.可以使用Kerberos 5来进行认证.
1、开启krb5-telnet服务.
- [root@rhel52 /]# vim /etc/xinetd.d/krb5-telnet
- 将"disabledisable = yes" 改为"disable = no"
2、启动服务
- [root@rhel52 /]# service xinetd restart
十一、配置文件ekrb5-telnet
文件所在位置 /etc/xinetd.d/ekrb5-telnet
ekrb5- telnet可以用来提供加密的telnet服务.如果启用了ekrb5-telnet服务,但是又没有Kerberos服务器的话,那么在进行 telnet登录时,总是会报"Unencrypted connection refused. Goodbye.（未加密的连接,拒绝服务）"这个错误.
1、开启ekrb5-telnet服务.
[root@rhel52 /]# vim /etc/xinetd.d/ekrb5-telnet
将"disable = yes" 改为"disable = no"
2、启动服务
[root@rhel52 /]# vim service xinetd restart
注:使用Kerberos 5来认证和加密telnet会话前,需要先搭建一个Kerberos服务器.
#p#
十二、telnet服务登陆错误解析
①错误信息:
- Cannot resolve network address for KDC in requested realm while getting initial credentials
当出现如上信息时,请检查/etc/xinetd.d/krb5-telnet,并将"disable = no"改成yes
- [root@rhel52 /]# vim /etc/xinetd.d/krb5-telnet
- # default: off
- # description: The kerberized telnet server accepts normal telnet sessions, \
- # but can also use Kerberos 5 authentication.
- service telnet
- {
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/kerberos/sbin/telnetd
- log_on_failure += USERID
- disable = no <- no改成yes
- }
②错误信息:
- Unencrypted connection refused. Goodbye.
遗失对主机的连接.当出现如上信息时,请检查/etc/xinetd.d/ekrb5-telnet,并将"disable = no"改成yes
- [root@rhel52 /]# vim /etc/xinetd.d/ekrb5-telnet
- # default: off
- # description: The kerberized telnet server accepts only telnet sessions, \
- # which use Kerberos 5 authentication and encryption.
- service telnet
- {
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/kerberos/sbin/telnetd
- server_args = -e
- log_on_failure += USERID
- disable = no <- no改成yes
- }
③错误信息:
- getnameinfo: localhost: Success
- Temporary failure in name resolution: Illegal seek
当出现如上信息时,请检查/etc/hosts,并将客户端的地址和主机名写进去.
- [root@rhel52 /]# vim /etc/hosts
- # Do not remove the following line, or various programs
- # that require network functionality will fail.
- 127.0.0.1 localhost.localdomain localhost rhel52
- #::1 rhel52 localhost6
- 192.168.238.220 rhel52
- 192.168.0.100 win-gk18e84nu08
本文来自CSDN博客,转载请标明出处:http://blog.csdn.net/zhangxue198501/archive/2009/12/15/5011479.aspx
