Re: [cobalt-developers] Restricting Telnet Users

[Jeff Lasman <jblists@xxxxxxxxxxxxx>]

Richard Badua wrote:

> How do you restrict telnet users from leaving their directories.

Short answer:  you don't.

Long answer:  You write your own telnet daemon.

Answer you can't implement on the RaQ:  You use freeBSD instead of
linux.

Some answers to the question you didn't ask...

1. You NEVER use telnet.  You turn it off.  You take it off your
system.  But before you do, you install and thoroughly test a viable and
secure alternative, or you're in a lot of trouble <wry grin>.

2. If you don't trust your users to see all the "visible" directories,
you don't trust them to telnet in.  Or use shell accounts via SSH,
either...

Reason for #2:  Give me an unprivileged user account on your system, in
any of the domains, and also give me shell privileges, and give me five
minutes, and I'll own root, and change it's password.  I'm sure I'm not
the only one on this list who can do it.  (Though this is NOT a
hypothetical situation, I'll only do it if we have a written contract in
place.)

Jeff
-- 
Jeff Lasman <jblists@xxxxxxxxxxxxx>
nobaloney.net
P. O. Box 52672
Riverside, CA  92517
voice: (909) 787-8589  *  fax: (909) 782-0205