Limiting telnet access

[WakeBdr]

What do enable telnet logins only from my local network and not from the internet? I'm blocking port 23 at my router, but I want a rule on my box that will only allow telnet connections from a specific local IP.

[Bokkenka]

Well, there's prob'ly a couple ways to do it...

If you're using a latest/greatest version, telnet might be controlled by xinetd. You could go into /etc/xinetd.d/ and look for a telnet text file in there. Open it up and look for a line that says "only from =" and add your local network numbers... such as "192.168.xxx."

Or, you could use the standard hosts.* files. Add a line to your /etc/hosts.deny file that says "ALL: ALL". That will stop anything from connecting to the box. Then, in your /etc/hosts.allow file, add listings to allow your local network to connect to the services you want to allow... "telnet: localhost" "telnet: 192.168.xxx." Read up the man pages for both hosts.* files. The computer allows anything in the allow, denies anything in the deny, and allows anything not in either, hence the ALL: ALL in the deny.

And then, we come to the actual telnet service. We always suggest you use ssh instead. SSH uses encryption to protect your password and connection, telnet doesn't. If you're on a network that you have to worry about denying telnet access, then you also have to worry about snooping.