| blob | 2dfa35a1d1300769462152281aad1c5379b1b562 |
1 '\" te
2 .\" Copyright 1989 AT&T
3 .\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH IN.TELNETD 1M "Nov 10, 2005"
8 .SH NAME
9 in.telnetd, telnetd \- DARPA TELNET protocol server
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fB/usr/sbin/in.telnetd\fR [\fB-a\fR \fIauthmode\fR] [\fB-EXUh\fR] [\fB-s\fR \fItos\fR]
14 [\fB-S\fR \fIkeytab\fR] [\fB-M\fR \fIrealm\fR]
15 .fi
17 .SH DESCRIPTION
18 .sp
19 .LP
20 \fBin.telnetd\fR is a server that supports the \fBDARPA\fR standard
21 \fBTELNET\fR virtual terminal protocol. \fBin.telnetd\fR is normally invoked in
22 the internet server (see \fBinetd\fR(1M)), for requests to connect to the
23 \fBTELNET\fR port as indicated by the \fB/etc/services\fR file (see
24 \fBservices\fR(4)).
25 .sp
26 .LP
27 \fBin.telnetd\fR operates by allocating a pseudo-terminal device for a client,
28 then creating a login process which has the slave side of the pseudo-terminal
29 as its standard input, output, and error. \fBin.telnetd\fR manipulates the
30 master side of the pseudo-terminal, implementing the \fBTELNET\fR protocol and
31 passing characters between the remote client and the login process.
32 .sp
33 .LP
34 When a \fBTELNET\fR session starts up, \fBin.telnetd\fR sends \fBTELNET\fR
35 options to the client side indicating a willingness to do \fIremote\fR
36 \fBecho\fR of characters, and to \fIsuppress\fR \fIgo\fR \fIahead\fR. The
37 pseudo-terminal allocated to the client is configured to operate in "cooked"
38 mode, and with \fBXTABS\fR, \fBICRNL\fR and \fBONLCR\fR enabled. See
39 \fBtermio\fR(7I).
40 .sp
41 .LP
42 \fBin.telnetd\fR is willing to do: \fIecho\fR, \fIbinary\fR, \fIsuppress\fR
43 \fIgo\fR \fIahead\fR, and \fItiming\fR \fImark\fR. \fBin.telnetd\fR is willing
44 to have the remote client do: \fIbinary\fR, \fIterminal\fR \fItype\fR,
45 \fIterminal\fR \fIsize\fR, \fIlogout\fR \fIoption\fR, and \fIsuppress\fR
46 \fIgo\fR \fIahead\fR.
47 .sp
48 .LP
49 \fBin.telnetd\fR also allows environment variables to be passed, provided that
50 the client negotiates this during the initial option negotiation. The
51 \fBDISPLAY\fR environment variable may be sent this way, either by the
52 \fBTELNET\fR general environment passing methods, or by means of the
53 \fBXDISPLOC\fR \fBTELNET\fR option. \fBDISPLAY\fR can be passed in the
54 environment option during the same negotiation where \fBXDISPLOC\fR is used.
55 Note that if you use both methods, use the same value for both. Otherwise, the
56 results may be unpredictable.
57 .sp
58 .LP
59 These options are specified in Internet standards \fIRFC 1096\fR, \fIRFC
60 1408\fR, \fIRFC 1510\fR, \fIRFC 1571\fR, \fIRFC 2941\fR, \fIRFC 2942\fR, \fIRFC
61 2946\fR, and \fIRFC 1572\fR. The following Informational draft is also
62 supported: \fIRFC 2952\fR.
63 .sp
64 .LP
65 The banner printed by \fBin.telnetd\fR is configurable. The default is (more or
66 less) equivalent to `\fBuname\fR \fB-sr\fR` and will be used if no banner is
67 set in \fB/etc/default/telnetd\fR. To set the banner, add a line of the form
68 .sp
69 .in +2
70 .nf
71 BANNER="..."
72 .fi
73 .in -2
75 .sp
76 .LP
77 to \fB/etc/default/telnetd\fR. Nonempty banner strings are fed to shells for
78 evaluation. The default banner may be obtained by
79 .sp
80 .in +2
81 .nf
82 BANNER="\e\er\e\en\e\er\e\en`uname -s` `uname -r`\e\er\e\en\e\er\e\en"
83 .fi
84 .in -2
86 .sp
87 .LP
88 and no banner will be printed if \fB/etc/default/telnetd\fR contains
89 .sp
90 .in +2
91 .nf
92 BANNER=""
93 .fi
94 .in -2
96 .SH OPTIONS
97 .sp
98 .LP
99 The following options are supported:
100 .sp
101 .ne 2
102 .na
103 \fB\fB-a\fR \fIauthmode\fR\fR
104 .ad
105 .RS 15n
106 This option may be used for specifying what mode should be used for
107 authentication. There are several valid values for \fIauthmode\fR:
108 .sp
109 .ne 2
110 .na
111 \fB\fBvalid\fR\fR
112 .ad
113 .RS 9n
114 Only allows connections when the remote user can provide valid authentication
115 information to identify the remote user, and is allowed access to the specified
116 account without providing a password.
117 .RE
119 .sp
120 .ne 2
121 .na
122 \fB\fBuser\fR\fR
123 .ad
124 .RS 9n
125 Only allows connections when the remote user can provide valid authentication
126 information to identify the remote user. The \fBlogin\fR(1) command will
127 provide any additional user verification needed if the remote user is not
128 allowed automatic access to the specified account.
129 .RE
131 .sp
132 .ne 2
133 .na
134 \fB\fBnone\fR\fR
135 .ad
136 .RS 9n
137 This is the default state. Authentication information is not required. If no or
138 insufficient authentication information is provided, then the \fBlogin\fR(1)
139 program provides the necessary user verification.
140 .RE
142 .sp
143 .ne 2
144 .na
145 \fB\fBoff\fR\fR
146 .ad
147 .RS 9n
148 This disables the authentication code. All user verification happens through
149 the \fBlogin\fR(1) program.
150 .RE
152 .RE
154 .sp
155 .ne 2
156 .na
157 \fB\fB-E\fR\fR
158 .ad
159 .RS 15n
160 Disables encryption support negotiation.
161 .RE
163 .sp
164 .ne 2
165 .na
166 \fB\fB-h\fR\fR
167 .ad
168 .RS 15n
169 Disables displaying host specific information before login has been completed.
170 .RE
172 .sp
173 .ne 2
174 .na
175 \fB\fB-M\fR \fIrealm\fR\fR
176 .ad
177 .RS 15n
178 Uses the indicated Kerberos V5 realm. By default, the daemon will determine its
179 realm from the settings in the \fBkrb5.conf\fR(4) file.
180 .RE
182 .sp
183 .ne 2
184 .na
185 \fB\fB-s\fR \fItos\fR\fR
186 .ad
187 .RS 15n
188 Sets the \fBIP\fR \fBTOS\fR option.
189 .RE
191 .sp
192 .ne 2
193 .na
194 \fB\fB-S\fR \fIkeytab\fR\fR
195 .ad
196 .RS 15n
197 Sets the \fBKRB5\fR keytab file to use. The\fB/etc/krb5/krb5.keytab\fR file is
198 used by default.
199 .RE
201 .sp
202 .ne 2
203 .na
204 \fB\fB-U\fR\fR
205 .ad
206 .RS 15n
207 Refuses connections that cannot be mapped to a name through the
208 \fBgetnameinfo\fR(3SOCKET) function.
209 .RE
211 .sp
212 .ne 2
213 .na
214 \fB\fB-X\fR\fR
215 .ad
216 .RS 15n
217 Disables Kerberos V5 authentication support negotiation.
218 .RE
220 .SH USAGE
221 .sp
222 .LP
223 \fBtelnetd\fR and \fBin.telnetd\fR are IPv6-enabled. See \fBip6\fR(7P).
224 .SH SECURITY
225 .sp
226 .LP
227 \fBin.telnetd\fR can authenticate using Kerberos V5 authentication,
228 \fBpam\fR(3PAM), or both. By default, the telnet server will accept valid
229 Kerberos V5 authentication credentials from a \fBtelnet\fR client that supports
230 Kerberos. \fBin.telnetd\fR can also support an encrypted session from such a
231 client if the client requests it.
232 .sp
233 .LP
234 The \fBtelnet\fR protocol only uses single DES for session
235 protection\(emclients request service tickets with single DES session keys. The
236 KDC must know that host service principals that offer the \fBtelnet\fR service
237 support single DES, which, in practice, means that such principals must have
238 single DES keys in the KDC database.
239 .sp
240 .LP
241 In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
242 Kerberos principal must exist for each Fully Qualified Domain Name associated
243 with the \fBtelnetd\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR principals
244 must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR file on the
245 \fBtelnetd\fR server. An example principal might be:
246 .sp
247 .LP
248 \fBhost/bigmachine.eng.example.com\fR
249 .sp
250 .LP
251 See \fBkadmin\fR(1M) or \fBgkadmin\fR(1M) for instructions on adding a
252 principal to a \fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
253 authentication.
254 .sp
255 .LP
256 \fBin.telnetd\fR uses \fBpam\fR(3PAM) for authentication, account management,
257 session management, and password management. The \fBPAM\fR configuration
258 policy, listed through \fB/etc/pam.conf\fR, specifies the modules to be used
259 for \fBin.telnetd\fR. Here is a partial \fBpam.conf\fR file with entries for
260 the \fBtelnet\fR command using the UNIX authentication, account management,
261 session management, and password management modules.
262 .sp
263 .in +2
264 .nf
265 telnet auth requisite pam_authtok_get.so.1
266 telent auth required pam_dhkeys.so.1
267 telent auth required pam_unix_auth.so.1
269 telnet account requisite pam_roles.so.1
270 telnet account required pam_projects.so.1
271 telnet account required pam_unix_account.so.1
273 telnet session required pam_unix_session.so.1
275 telnet password required pam_dhkeys.so.1
276 telent password requisite pam_authtok_get.so.1
277 telnet password requisite pam_authtok_check.so.1
278 telnet password required pam_authtok_store.so.1
279 .fi
280 .in -2
282 .sp
283 .LP
284 If there are no entries for the \fBtelnet\fR service, then the entries for the
285 "other" service will be used. If multiple authentication modules are listed,
286 then the user may be prompted for multiple passwords.
287 .sp
288 .LP
289 For a Kerberized telnet service, the correct \fBPAM\fR service name is
290 \fBktelnet\fR.
291 .SH FILES
292 .sp
293 .ne 2
294 .na
295 \fB\fB/etc/default/telnetd\fR\fR
296 .ad
297 .RS 24n
299 .RE
301 .SH SEE ALSO
302 .sp
303 .LP
304 \fBlogin\fR(1), \fBsvcs\fR(1), \fBtelnet\fR(1), \fBgkadmin\fR(1M),
305 \fBinetadm\fR(1M), \fBinetd\fR(1M), \fBkadmin\fR(1M), \fBsvcadm\fR(1M),
306 \fBpam\fR(3PAM), \fBgetnameinfo\fR(3SOCKET), \fBissue\fR(4),
307 \fBkrb5.conf\fR(4), \fBpam.conf\fR(4), \fBservices\fR(4), \fBattributes\fR(5),
308 \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
309 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
310 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5),
311 \fBsmf\fR(5), \fBip6\fR(7P), \fBtermio\fR(7I)
312 .sp
313 .LP
314 \fI\fR
315 .sp
316 .LP
317 Alexander, S. \fIRFC 1572, TELNET Environment Option\fR. Network Information
318 Center, SRI International, Menlo Park, Calif., January 1994.
319 .sp
320 .LP
321 Borman, Dave. \fIRFC 1408, TELNET Environment Option\fR. Network Information
322 Center, SRI International, Menlo Park, Calif., January 1993.
323 .sp
324 .LP
325 Borman, Dave. \fIRFC 1571, TELNET Environment Option Interoperability
326 Issues\fR. Network Information Center, SRI International, Menlo Park, Calif.,
327 January 1994.
328 .sp
329 .LP
330 Crispin, Mark. \fIRFC 727, TELNET Logout Option\fR. Network Information Center,
331 SRI International, Menlo Park, Calif., April 1977.
332 .sp
333 .LP
334 Marcy, G. \fIRFC 1096, TELNET X Display Location Option\fR. Network Information
335 Center, SRI International, Menlo Park, Calif., March 1989.
336 .sp
337 .LP
338 Postel, Jon, and Joyce Reynolds. \fIRFC 854, TELNET Protocol Specification\fR.
339 Network Information Center, SRI International, Menlo Park, Calif., May 1983.
340 .sp
341 .LP
342 Waitzman, D. \fIRFC 1073, TELNET Window Size Option\fR. Network Information
343 Center, SRI International, Menlo Park, Calif., October 1988.
344 .sp
345 .LP
346 Kohl, J., Neuman, C., \fIThe Kerberos Network Authentication Service (V5), RFC
347 1510\fR. September 1993.
348 .sp
349 .LP
350 Ts'o, T. and J. Altman, \fITelnet Authentication Option, RFC 2941\fR. September
351 2000.
352 .sp
353 .LP
354 Ts'o, T., \fITelnet Authentication: Kerberos Version 5, RFC 2942\fR. September
355 2000.
356 .sp
357 .LP
358 Ts'o, T., \fITelnet Data Encryption Option, RFC 2946\fR. September 2000.
359 .sp
360 .LP
361 Ts'o, T., \fITelnet Encryption: DES 64 bit Cipher Feedback, RFC 2952\fR.
362 September 2000.
363 .SH NOTES
364 .sp
365 .LP
366 Some \fBTELNET\fR commands are only partially implemented.
367 .sp
368 .LP
369 Binary mode has no common interpretation except between similar operating
370 systems.
371 .sp
372 .LP
373 The terminal type name received from the remote client is converted to lower
374 case.
375 .sp
376 .LP
377 The \fIpacket\fR interface to the pseudo-terminal should be used for more
378 intelligent flushing of input and output queues.
379 .sp
380 .LP
381 \fBin.telnetd\fR never sends \fBTELNET\fR \fIgo\fR \fIahead\fR commands.
382 .sp
383 .LP
384 The \fBpam_unix\fR(5) module is no longer supported.. Similar functionality is
385 provided by \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
386 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
387 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), and
388 \fBpam_unix_session\fR(5).
389 .sp
390 .LP
391 The \fBin.telnetd\fR service is managed by the service management facility,
392 \fBsmf\fR(5), under the service identifier:
393 .sp
394 .in +2
395 .nf
396 svc:/network/telnet
397 .fi
398 .in -2
399 .sp
401 .sp
402 .LP
403 Administrative actions on this service, such as enabling, disabling, or
404 requesting restart, can be performed using \fBsvcadm\fR(1M). Responsibility for
405 initiating and restarting this service is delegated to \fBinetd\fR(1M). Use
406 \fBinetadm\fR(1M) to make configuration changes and to view configuration
407 information for this service. The service's status can be queried using the
408 \fBsvcs\fR(1) command.