Linux系統telnet服務設置大全
關于Linux系統，這次我們來講解一下telnet服務的相關內容。那么對于Linux下的telnet設置，我們針對不同的版本以及相關的一些問題來進行一下講解。那么具體內容請大家參考正文。
一、telnet基礎知識
telnet:提供telnet服務,使用未加密的用戶/密碼組進行驗證,依附于xinetd服務.文件位于/etc/xinetd.d/telnet.
krb5-telnet:提供telnet服務,允許普通的telnet登陸,默認是不允許root用戶登錄,使用kerberos5驗證 ,依附于xinetd服務.文件位于/etc/xinetd.d/krb5-telnet.
ekrb5-telnet:提供加密的telnet服務,但是必須要ekrb5的加密服務器.文件位于/etc/xinetd.d/ekrb5-telnet.
xinetd:因特網操作服務程序.提供類似于inetd+tcp_wrapper的功能,但是更加強大和安全,監控網絡對各種它管理的服務的需求,并在要的時候啟動相應的服務程序.文件位于/etc/xinetd.d中。
二、telnet服務安裝
1、查看telnet rpm包
- [root@rhel52 /]# rpm -qa | grep telnet
- telnet-0.17-38.el5
- telnet-server-0.17-38.el5 《=RHEL5CD#4
- [root@rhel52 /]#
2、安裝telnet server rpm包
- [root@rhel52 work]# rpm -ivh telnet-server-0.17-38.el5.i386.rpm
- warning: telnet-server-0.17-38.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID 37017186
- Preparing... ########################################### [100%]
- package telnet-server-0.17-38.el5 is already installed
- [root@rhel52 work]#
注:安裝完畢以后會在/etc/xinetd.d/中出現一個telnet配置文件#p#
三、telnet服務檢測
1、查看telnet服務
- [root@rhel52 /]# chkconfig --list | grep telnet
- ekrb5-telnet: off
- krb5-telnet: off
- telnet: off
- [root@rhel52 /]#
2、開啟telnet服務
- [root@rhel52 /]# chkconfig telnet on
- 也可以用[root@rhel52 /]# ntsysv開啟
3、設置自動啟動
- [root@rhel52 /]# chkconfig --level 35 telnet on
- [root@rhel52 /]# chkconfig --list | grep telnet
- ekrb5-telnet: off
- krb5-telnet: off
- telnet: on
- [root@rhel52 /]#
四、telnet服務調試
1、配置telnet文件
- [root@rhel52 /]# vim /etc/xinetd.d/telnet
- # default: on
- # description: The telnet server serves telnet sessions; it uses \
- # unencrypted username/password pairs for authentication.
- service telnet
- {
- disable = no 《=確認是no
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/sbin/in.telnetd
- log_on_failure += USERID
- }
2、注意/etc/xinetd.d/ekrb5-telnet 和 krb5-telnet兩個文件中的disable,稍后說明其作用.#p#
五、telnet開啟root
1、確認/etc/pam.d/login中的pam_securetty.so行,并將其注釋掉"#"
- [root@rhel52 /]# vim /etc/pam.d/login
- #%PAM-1.0
- #auth [user_unknown=ignore success=ok ignoreignore=ignore default=bad] pam_securetty.so
- auth include system-auth
- account required pam_nologin.so
- account include system-auth
- password include system-auth
- # pam_selinux.so close should be the first session rule
- session required pam_selinux.so close
- session include system-auth
- session required pam_loginuid.so
- session optional pam_console.so
- # pam_selinux.so open should only be followed by sessions to be executed in the
- user context
- session required pam_selinux.so open
- session optional pam_keyinit.so force revoke
2、開通telnet控制臺,在/etc/securetty文件中設定
- [root@rhel52 /]# vim /etc/securetty
- console
- vc/1
- vc/2
- vc/3
- tty1
- tty2
- tty3
- tty4
- tty5
- ...
- pts/1
- pts/2
- pts/3
- pts/4
- pts/5
- 在文件后面追加"pts/1....pts/n"
#p#
六、telnet服務啟動
- 因為telnet服務是由xinetd調用,所以只要重新啟動xinetd即可
- [root@rhel52 /]# service xinetd restart
- Stopping xinetd: [ OK ]
- Starting xinetd: [ OK ]
- [root@rhel52 /]#
七、telnet服務測試
- Microsoft Windows [版本 6.1.7100]
- 版權所有 (c) 2009 Microsoft Corporation.保留所有權利.
- C:\>telnet 192.168.238.220
- 正在連接192.168.238.220...
- Red Hat Enterprise Linux Server release 5 (Tikanga)
- Kernel 2.6.18-8.el5 on an i686
- login: root
- Password:
- Last login: Sat Aug 1 22:47:15 from 192.168.238.1
- [root@rhel52 ~]#
八、telnet端口更改
- 設定配置文件/etc/services
- [root@CentOS5 /]#vi /etc/services
找到下面的兩行:
- telnet 23/tcp
- telnet 23/udp
#p#
九、telnet服務限制
設定配置文件/etc/xinetd.d/telnet
- [root@rhel52 /]# vim /etc/xinetd.d/telnet
- access_time = 20:00-24:00
- # default: on
- # description: The telnet server serves telnet sessions; it uses \
- # unencrypted username/password pairs for authentication.
- service telnet
- {
- disable = no
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/sbin/in.telnetd
- log_on_failure += USERID
- only_from = 192.168.0.0/16
- }
- #bind = 192.168.0.100
- #only_from = 192.168.0.0/24
- #no_access = 192.168.0.{80,90}
- #access_times = 8:00-9:00 20:00-23:00
十、配置文件krb5-telnet
文件所在位置 /etc/xinetd.d/krb5-telnet
其實rhel5已經裝了krb5-telnet,那么就可以啟用這個服務來達到開啟telnet的目的.不用再安裝telnet-server這個軟件包了.可以使用Kerberos 5來進行認證.
1、開啟krb5-telnet服務.
- [root@rhel52 /]# vim /etc/xinetd.d/krb5-telnet
- 將"disabledisable = yes" 改為"disable = no"
2、啟動服務
- [root@rhel52 /]# service xinetd restart
十一、配置文件ekrb5-telnet
文件所在位置 /etc/xinetd.d/ekrb5-telnet
ekrb5- telnet可以用來提供加密的telnet服務.如果啟用了ekrb5-telnet服務,但是又沒有Kerberos服務器的話,那么在進行 telnet登錄時,總是會報"Unencrypted connection refused. Goodbye.（未加密的連接,拒絕服務）"這個錯誤.
1、開啟ekrb5-telnet服務.
[root@rhel52 /]# vim /etc/xinetd.d/ekrb5-telnet
將"disable = yes" 改為"disable = no"
2、啟動服務
[root@rhel52 /]# vim service xinetd restart
注:使用Kerberos 5來認證和加密telnet會話前,需要先搭建一個Kerberos服務器.
#p#
十二、telnet服務登陸錯誤解析
①錯誤信息:
- Cannot resolve network address for KDC in requested realm while getting initial credentials
當出現如上信息時,請檢查/etc/xinetd.d/krb5-telnet,并將"disable = no"改成yes
- [root@rhel52 /]# vim /etc/xinetd.d/krb5-telnet
- # default: off
- # description: The kerberized telnet server accepts normal telnet sessions, \
- # but can also use Kerberos 5 authentication.
- service telnet
- {
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/kerberos/sbin/telnetd
- log_on_failure += USERID
- disable = no <- no改成yes
- }
②錯誤信息:
- Unencrypted connection refused. Goodbye.
遺失對主機的連接.當出現如上信息時,請檢查/etc/xinetd.d/ekrb5-telnet,并將"disable = no"改成yes
- [root@rhel52 /]# vim /etc/xinetd.d/ekrb5-telnet
- # default: off
- # description: The kerberized telnet server accepts only telnet sessions, \
- # which use Kerberos 5 authentication and encryption.
- service telnet
- {
- flags = REUSE
- socket_type = stream
- wait = no
- user = root
- server = /usr/kerberos/sbin/telnetd
- server_args = -e
- log_on_failure += USERID
- disable = no <- no改成yes
- }
③錯誤信息:
- getnameinfo: localhost: Success
- Temporary failure in name resolution: Illegal seek
當出現如上信息時,請檢查/etc/hosts,并將客戶端的地址和主機名寫進去.
- [root@rhel52 /]# vim /etc/hosts
- # Do not remove the following line, or various programs
- # that require network functionality will fail.
- 127.0.0.1 localhost.localdomain localhost rhel52
- #::1 rhel52 localhost6
- 192.168.238.220 rhel52
- 192.168.0.100 win-gk18e84nu08
本文來自CSDN博客,轉載請標明出處:http://blog.csdn.net/zhangxue198501/archive/2009/12/15/5011479.aspx
