Subject: Re: restricted telnet access for users

From: Bob DeBula <[email-masked]>
Date: Thu, 9 Oct 1997 10:40:23 -0400 (EDT)

> > On Thu, 9 Oct 1997, Anne Baretta wrote:
> > 
> > 
> > in stead of a shell you give them a script that first checks if the user
> > logged in via telnet or ssh and trows them out or starts a shell...
> > *
> 
> Yes, that's a good workaround, if they use telnet they'll get
> /usr/bin/passwd, if they use ssh, they will get a real shell, user or
> guest (and guests will then be denied upon entering their passwd).
> 	Does anyone happen to know a clean way to determine whether telnet
> or ssh is used to connect to the server? (for use in the script;-)

The environment variables SSH_CLIENT and SSH_TTY get set for an ssh
connection. Upon login, I like to be reminded whether I've got a secure
connection or not, so I have the following one line PERL script at the
end of my .login file:

perl -e 'print defined($ENV{'SSH_TTY'}) ? "\n***Secure connection from $ENV{'SSH_CLIENT'} on $ENV{'SSH_TTY'}***\n\n" : "\n\<\<\<Non-secure connection\>\>\>\n\n";'

---

From: Kevin Walton <[email-masked]>
Date: Thu, 9 Oct 1997 10:53:18 +0100 (BST)

Not really a solution to your problem im afraid, but a few comments.

[snip]

> Needless to say, most users use win95, so it's not an option
> to let them use ssh (which is not free for DOS).

Not free, but you can get a 30 day eval of fsecure, an ssh client for
windows from:  http://www.datafellows.com

> P.S. I think the guest-HOWTO is a very good piece of documentation, it is
> much more to-the-point and concise than most HOWTO's 

Can you point me to this plz.

Cheers
Kev

-- 
Kevin Walton
UnSeen.org

---

From: "T's Mailing Lists" <[email-masked]>
Date: Thu, 9 Oct 1997 14:21:14 +0000 (GMT)

On Thu, 9 Oct 1997, Anne Baretta wrote:

> which is very convenient. This means of course that the telnet-daemon has
> to be up, and real users can login via telnet, thus compromising the
> security of the system. The telnet daemon cannot be configured to
> discriminate between guest and real users, any suggestions? I want the

t

--------------------------------------------------------------------------------
                   Tomas Pospisek's mailing-lists mailbox   
           www.SPIN.ch - Internet Services in Graubuenden/Switzerland
--------------------------------------------------------------------------------
Tom: So far, der winter kommt, ich schaff mir glaub ich noch ein paar
Tom: Zyxel traffos an...
Roli: Aber genug davon nehmen. Wenn die Dinger kapput gehen werden sie 
Roli: nicht mehr warm.

---

From: Anne Baretta <[email-masked]>
Date: Thu, 9 Oct 1997 15:48:51 +0200 (MET DST)

Thanks.

Anne

---

From: Anne Baretta <[email-masked]>
Date: Thu, 9 Oct 1997 11:25:37 +0200 (MET DST)

Hi,

I have set up guest-accounts on the local server some time ago. This
weekend I want the first 'guests' to be able to put their homepages on the
server. However, there seems to be a dillemma: security has a very high
priority on the server, so real users (a few interested people who are
involved in the organisation of this local project) are only allowed to
login via ssh. I have given the guests the shell /usr/bin/passwd (it's a
Linux box) so they can telnet to the server and change their password,
which is very convenient. This means of course that the telnet-daemon has
to be up, and real users can login via telnet, thus compromising the
security of the system. The telnet daemon cannot be configured to
discriminate between guest and real users, any suggestions? I want the
users to be able to change their passwords (by themselves) maybe there are
other ways? Needless to say, most users use win95, so it's not an option
to let them use ssh (which is not free for DOS).

Thanks in advance,	

Anne

P.S. I think the guest-HOWTO is a very good piece of documentation, it is
much more to-the-point and concise than most HOWTO's (moreover, if you
follow it, it will work;-). In fact, I liked it so much that I have put
together a document with a similar set-up for the Delete/BackSpace
problem:  http://www.ibbnet.nl/~anne/keyboard.html