14. Configuring Telnet in Knoppix

Transcription

1 14. Configuring Telnet in Knoppix Estimated Time: 45 Minutes Objective In this lab, the student will learn how to configure the Telnet service on a system so that the user can remotely administer a Knoppix server. Equipment The following equipment is required for this exercise: o A computer running Knoppix 3.9 or greater. o Another system, either Linux or Windows, to attempt to Telnet into the Knoppix server. Scenario The student is setting up a Knoppix server that will need to be administered and accessed remotely. To do this, Telnet services will be installed on the Knoppix server. Procedures First, a user will be added to the system, since Telnet normally does not allow root to login. The student will then create a file in the home directory, so that the directory will be easily recognized when a Telnet connection is made. In Knoppix, the Telnet service is not started by default. In this lab, the student will edit two configuration files to add information that will be necessary when the service is started. After that, the student will start the internet daemon. In the last part of the lab, the student will test the Telnet service to confirm that it is properly installed and started on the server. Preliminary step First, click the Knoppix Penguin icon, to get to the root shell. Assign yourself a root password with the passwd command, and enter the password twice. passwd Changing password for user root. Enter new UNIX password: Retype new UNIX password: The password will be successfully updated. Step 1: Adding a user that can login to Telnet 1. The Telnet server requires a user to have a home directory. One option is needed with the useradd command to accomplish this. Create a user account, based on your name. For example, root could create an account for Maria Chavez like this: useradd m mchavez 2. As root, assign your new account a password in this way. For Maria s case, she would type (while logged in as root): passwd mchavez Changing password for user mchavez. Enter new UNIX password: Retype new UNIX password: Type it twice and it will be accepted. In Knoppix, passwords are locked by default. That is why mchavez couldn t create her own password immediately after her user account was created. Root has to do it. Step 2: Create a file that will be seen by a Telnet user Later in this lab, the student will connect to the Knoppix server via Telnet. After connecting to Telnet, the student will be placed into their home directory. Create a file there now that will be easy to recognize later. Type: touch /home/mchavez/testfile

2 or use the directory corresponding to your user s name. Step 3: Editing the internet daemon configuration file The Telnet service is not listed in this file in the standard Knoppix OS. A line must be added. 1. If not already root, login with the root account and open up a terminal emulator window. From the terminal window, type the following command. cd /etc This will change the user to the directory where the internet daemon configuration file is located. Verify that the file is present. Type: ls inetd* Does the output show the file inetd.conf? Yes The file /etc/inetd.conf. Note that there is no line for telnet. 2. Use the vi Editor to change this internet daemon configuration file. Type: vi inetd.conf

3 Navigate to the line below these ones: #:STANDARD: These are standard services. ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.ftpd Press i to go into insert mode. type this line: telnet stream tcp nowait root Step 4: Creating a dummy ssl certificate This is a workaround, because the Knoppix telnet daemon requires a ssl certificate file to be present on the server (a dummy one will do), before it will run the login program that accepts a username and password. In addition, the certificate works when only the first field (Country Name) is filled in. The other fields should be left empty by putting a dot in them. In the following output, openssl is a command. The rest of the text is issued by that command. Notice that each line ends with a dot, which is typed by the student. Country Name ends with US, or any other country abbreviation. root@0[sbin]# cd /usr/lib/ssl/certs root@0[certs]# openssl req -new -x509 -nodes -out telnetd.pem -keyout telnetd.pem Generating a 1024 bit RSA private key writing new private key to 'telnetd.pem' You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:. Locality Name (eg, city) []:. Organization Name (eg, company) [Internet Widgits Pty Ltd]:. Organizational Unit Name (eg, section) []:. Common Name (eg, YOUR name) []:. Address []:. root@0[certs]# Step 5: Starting the internet daemon (inetd) Most daemons have start, stop and restart commands. If the internet daemon has not been started previously during this Knoppix session, start is used. If it is running, and you want it to re-read some altered configuration files, restart is used. Login with the root account. The internet daemon can only be started with the root account. Type: /etc/init.d/inetd start or restart, if you have previously started it during this session. Step 6: Testing Telnet Access to the Localhost 1. To test the Telnet service, type:

4 telnet localhost This will use the system to access the Telnet services on the same system. At this point the system will attempt to make a Telnet to the system through the local loopback address, It will prompt the user to enter a username and password. 2. A user cannot login to a remote site with the root account. Use the student account you created earlier to log on and test the Telnet configuration. If a connection to the system is established, then the Knoppix server has been successfully configured for Telnet access. Here is sample output of a successful connection to Telnet. root@0[certs]# telnet localhost Trying Connected to Knoppix. Escape character is '^]'. Debian GNU/Linux 3.1 Knoppix Knoppix login: mchavez Password: Welcome to Knoppix! mchavez@1[~]$ pwd /home/mchavez mchavez@1[~]$ ls Desktop GNUstep testfile tmp mchavez@1[~]$ exit Connection closed by foreign host. root@0[certs]# 3. What directory are you in? To find out, type: pwd In the space below, write down the current working directory: /home/mchavez 4. Type: ls Do you see testfile, that you created earlier in this lab? Yes Step 7: Connecting to Other Systems via Telnet (optional) To connect to the Knoppix Telnet server from another system, another configuration file must be edited, and the NIC must be configured. 1. Using vi, edit the file /etc/hosts.allow, that has these contents. # /etc/hosts.allow: list of hosts that are allowed to access the system. # See the manual pages hosts_access(5), hosts_options(5) # and /usr/doc/netbase/portmapper.txt.gz # # Example: ALL: # ALL:.foobar.edu EXCEPT terminalserver.foobar.edu # # If you're going to protect the portmapper use the name "portmap" for the # daemon name. Remember that you can only use the keyword "ALL" and IP # addresses (NOT host or domain names) for the portmapper. See portmap(8) # and /usr/doc/netbase/portmapper.txt.gz for further information. # ssh sshd : ALL@ALL : ALLOW

5 ALL : LOCAL : ALLOW ALL : ALL@ALL : DENY As root, type: vi /etc/hosts.allow Navigate down to the last line: ALL : ALL@ALL : DENY Move the cursor to the D of DENY. Press x four times to remove the word DENY. Press i to enter insert mode. Type ALLOW in uppercase. ALL : ALL@ALL : ALLOW Press ESC to exit insert mode. Type :wq to exit and save the file. Step 8: Configuring the NIC In order to make a connection to the Knoppix server, its NIC, called eth0, must be configured and enabled. Select an IP address, network mask and broadcast address for your Knoppix server that is compatible with the other hosts on the network. Ask your instructor if you have questions. Then type: ifconfig eth netmask broadcast up Use numbers that are appropriate to your system. Remember to type the word up at the end of the line. That enables the eth0 card. The Knoppix server should now accept Telnet logins from remote hosts. Step 9: Restarting the internet daemon See step 5 for details. Type /etc/init.d/inetd restart Step 10: Testing network access to the Knoppix Telnet server 1. To test the Telnet service, type: telnet or use your address The Knoppix telnet server will prompt the user to enter a username and password. There will be some delay, because Knoppix runs from the CD, and there is probably some processing involving the dummy ssl certificate. Note: The student can use a MS Windows computer or a Linux computer to Telnet to the Knoppix server. 2. A user cannot login to a remote site with the root account. Use the student account you created earlier to log on and test the Telnet configuration. If a connection to the system is established, then the Knoppix server has been successfully configured for Telnet access.

6 Example of a successful connection to Telnet from Windows XP 3. What directory are you in? To find out, type: pwd In the space below, write down the current working directory: /home/mchavez 4. Type: ls Do you see testfile, that you created earlier in this lab? Yes Troubleshooting Configuring services like Telnet for a Linux operating system can be somewhat confusing to the inexperienced user. Editing the configuration files can be a difficult task, so it is important to remember where these files are located and how to navigate to them. Telnet can be a useful troubleshooting tool, which will allow access to the system from virtually any operating system that has an Internet connection. As a system administrator, this can help with troubleshooting efforts. Reflection 1. What security risks does enabling Telnet pose to a system? Passwords and text are sent unencrypted 2. What are some precautions that would allow an administrator to provide security while having Telnet access enabled on a system? Giving users access to only their home directory. Only giving Tlnet to users who need it. Not allowing root to have Telnet access. 3. Which daemon is used for the Telnet service? inetd