tn-gw(8) · carta

NAME

tn-gw - TELNET proxy server

SYNOPSIS

tn-gw [invoked from inetd]

DESCRIPTION

tn-gw provides pass-through TELNET proxy services with logging and access control. When tn-gw is invoked from inetd(8), it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it shuts down with a message and logs the connection. If the peer is permitted to use the proxy, tn-gw enters a command loop in which it awaits for a user to specify a) the system they wish to connect with, b) the X-gateway they wish to invoke.

c[onnect] hostname [port]

Connects to a host.

sol-> telnet otter
Trying 192.33.112.117 ...
Connected to otter.
Escape character is '^]'.
otter telnet proxy (Version V1.0) ready:
tn-gw-> help
Valid commands are:
   connect hostname [port]
   x-gw [display]
   help/?
   quit/exit
tn-gw-> c hilo
HP-UX hilo A.09.01 A 9000/710 (ttys1)
login: Remote server has closed connection
Connection closed by foreign host.
sol->

Because of limitations in some telnet clients, it is possible that options negotiation will fail such that characters do not echo when typed to the tn-gw command interpreter.

x[-gw] [display/hostname]: Invokes the x-gateway for connection service to the user's display. The default display (without the argument) is the connecting hostname followed by port number 0.0. See man page x-gw for details.

OPTIONS

tn-gw reads its configuration rules and permissions information from the firewall configuration table netperm-table, retrieving all rules specified for "tn-gw". The following configuration rules are recognized:

userid user: specify a numeric user-id or the name of a password file entry. If this value is specified, tn-gw will set its user-id before providing service. Note that this option is included mostly for completeness, as tn-gw performs no local operations that are likely to introduce a security hole.

directory pathname: specifies a directory to which tn-gw will chroot(2) prior to providing service.

prompt string: specifies a prompt for tn-gw to use while it is in command mode.

denial-msg filename: specifies the name of a file to display to the remote user if they are denied permission to use the proxy. If this option is not set, a default message is generated.

timeout seconds: specifies the number of seconds of idleness after which the proxy should disconnect. Default is no timeout.

welcome-msg filename: specifies the name of a file to display as a welcome banner upon successful connection. If this option is not set, a default message is generated.

help-msg filename: specifies the name of a file to display if the "help" command is issued. If this option is not set, a listing of the internal commands is printed.

denydest-msg filename: specifies the name of a file to display if a user attempts to connect to a remote server that they are not permitted to. If this option is not set, a default message is generated.

authserver hostname [portnumber [cipherkey]]: specifies the name or address of a system to use for network authentication. If tn-gw is built with a compiled-in value for the server and port, they will be used as defaults but can be overridden if specified as above. If support for DES-encryption of traffic is present in the server, an optional cipherkey can be provided, to secure communications with the server.

hosts host-pattern [host-pattern2...] [options]

rules specify host and access permissions. Typically, a hosts rule will be in the form of:

tn-gw: deny-hosts unknown
tn-gw: hosts 192.33.112.* 192.94.214.*

There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters are:

-dest pattern
-dest { pattern1 pattern2 ... }
specifies a list of valid destinations. If no list is specified, all destinations are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

-dest !*.mit.edu -dest *

will permit hosts that are not in the domain "mit.edu" to be connected to.

: -auth
specifies that the proxy should require a user to authenticate with a valid user-id prior to being permitted to use the gateway.

: -passok
specifies that the proxy should permit users to change their passwords if they are connected from the designated host. Only hosts on a trusted network should be permitted to change passwords, unless token-type authenticators are distributed to all users.

INSTALLATION

To install tn-gw first place the executable in a system area, then modify inetd.conf(5) to reflect the appropriate executable path. The TELNET proxy must be installed on the TELNET port (port 23) in order to function properly. This is because many client side implementations of the telnet(1) command disable options processing unless they are connecting to port 23. In some installations this may cause a dilemma. In a conventional firewall, where the proxy server is running on a system that does not support user access, one solution is to install tn-gw on the telnet port, and to install telnetd(8) on another port, so that the systems administrator can still access the machine. Another option is to permit rlogind(8) to run with netacl protecting it so that only a small number of administrative machines can even attempt to log in. Verify installation by attempting a connection, and monitoring the system logs.

FILES

/etc/inetd.conf: netperm-table

BUGS