5.10.5 Restrict Telnet And Ssh Access

Telnet and SSH, while both used for remote access, have distinct security profiles. Understanding the nuances of restricting access to these protocols is crucial for maintaining a secure network environment.

Understanding Telnet and SSH

Telnet (Telecommunication Network) is an older protocol that provides bidirectional interactive text-oriented communication using a virtual terminal connection over a network. It's simple to use, but transmits data, including usernames and passwords, in plaintext, making it highly vulnerable to eavesdropping and interception.

SSH (Secure Shell) is a cryptographic network protocol for operating network services securely over an unsecured network. It encrypts all transmitted data, protecting it from eavesdropping, tampering, and hijacking. SSH provides a secure channel over an insecure network by using cryptographic techniques to authenticate the remote computer, encrypt the data stream between the client and server, and maintain the integrity of the data.

Given the inherent security risks of Telnet, it is often recommended to disable it entirely in favor of SSH. However, there might be legacy systems or specific use cases where Telnet is still required. In such scenarios, restricting access to Telnet becomes paramount.

Why Restrict Telnet and SSH Access?

• Security: Telnet's plaintext transmission makes it a prime target for attackers. SSH, while secure, can still be vulnerable if not configured correctly or if weak passwords are used.
• Compliance: Many security standards and regulations require secure remote access, mandating the use of SSH and prohibiting Telnet.
• Resource Management: Limiting access to these services can reduce the attack surface and prevent unauthorized users from consuming system resources.
• Auditing and Accountability: Restricting access allows for better monitoring and logging of remote access attempts, improving accountability and aiding in forensic investigations.

Methods to Restrict Telnet Access

Given the security vulnerabilities of Telnet, the best approach is often to disable it entirely. However, if Telnet is required, restrict access through various methods:

1. Disabling Telnet

The most effective way to restrict Telnet access is to disable the Telnet server altogether.

• Linux:
  • Systemd: Use the command sudo systemctl stop telnet.socket followed by sudo systemctl disable telnet.socket to stop and disable the Telnet service.
  • SysVinit: Use the command sudo service xinetd stop (if Telnet is managed by xinetd) or sudo service telnetd stop followed by removing or commenting out the Telnet service entry in the /etc/inetd.conf or /etc/xinetd.d/ directory.
• Windows:
  • Open the Services application (services.msc).
  • Locate the "Telnet" service.
  • Right-click and select "Properties."
  • Change the "Startup type" to "Disabled."
  • Click "Apply" and then "OK."
  • Click "Stop" to immediately stop the service.

2. Firewall Rules

Firewall rules can restrict Telnet access to specific IP addresses or networks.

• Linux (iptables):
  • sudo iptables -A INPUT -p tcp --dport 23 -s <allowed_ip_address> -j ACCEPT (Allow Telnet access from a specific IP address).
  • sudo iptables -A INPUT -p tcp --dport 23 -j DROP (Drop all other Telnet connections).
  • sudo iptables -A INPUT -p tcp --dport 23 -j REJECT --reject-with tcp-reset (Reject all other Telnet connections with a TCP reset).
• Linux (firewalld):
  • sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<allowed_ip_address>" port port="23" protocol="tcp" accept' (Allow Telnet access from a specific IP address).
  • sudo firewall-cmd --permanent --add-port=23/tcp --remove-port=23/tcp (Remove general access to Telnet).
  • sudo firewall-cmd --reload (Reload the firewall rules).
• Windows Firewall:
  • Open "Windows Firewall with Advanced Security."
  • Create a new inbound rule.
  • Select "Port" as the rule type.
  • Specify TCP port 23.
  • Allow connections only from specific IP addresses or networks.
  • Block connections from all other IP addresses.

3. TCP Wrappers

TCP Wrappers (tcpd) is a host-based access control list system. It controls access to network services based on the client's IP address or hostname.

• Configuration:
  • Edit /etc/hosts.allow to specify allowed IP addresses or networks.
  • Edit /etc/hosts.deny to specify denied IP addresses or networks.
  • Example:
    • /etc/hosts.allow: telnet: 192.168.1.0/24 (Allow Telnet access from the 192.168.1.0/24 network).
    • /etc/hosts.deny: telnet: ALL (Deny Telnet access from all other IP addresses).
• Note: Ensure that the Telnet service is configured to use TCP Wrappers (usually managed by xinetd).

4. xinetd Configuration

xinetd (extended Internet daemon) is a powerful replacement for inetd. It manages network services and provides enhanced security features.

• Configuration:
  • Edit the Telnet service configuration file in the /etc/xinetd.d/ directory (e.g., /etc/xinetd.d/telnet).
  • Use the only_from directive to specify allowed IP addresses or networks.
  • Example:

    service telnet
    {
        disable = no
        flags = REUSE
        socket_type = stream
        wait = no
        user = root
        server = /usr/sbin/tcpd
        log_on_failure += USERID
        only_from = 192.168.1.0/24 10.0.0.0/24
    }
    

  • Restart the xinetd service: sudo systemctl restart xinetd or sudo service xinetd restart.

5. Limiting User Access

Even if Telnet is enabled, you can restrict which users are allowed to log in via Telnet. This can be achieved through PAM (Pluggable Authentication Modules) configuration.

• PAM Configuration:
  • Edit the Telnet PAM configuration file (e.g., /etc/pam.d/login or /etc/pam.d/telnetd).
  • Add or modify rules to control user access.
  • Example (using pam_listfile.so to allow only specific users):

    auth    required pam_listfile.so item=user sense=allow file=/etc/telnet_users onerr=deny
    

  • Create the /etc/telnet_users file and list the allowed usernames, one per line.

Best Practices for Restricting Telnet

• Prioritize Disabling: If Telnet is not absolutely necessary, disable it entirely.
• Implement Multiple Layers: Use a combination of firewall rules, TCP Wrappers, and xinetd configuration for enhanced security.
• Regularly Audit: Regularly review and update access control lists to ensure they are accurate and reflect current security needs.
• Monitor Logs: Monitor Telnet logs for suspicious activity or unauthorized access attempts.
• Educate Users: Educate users about the risks of using Telnet and the importance of using secure alternatives like SSH.

Methods to Restrict SSH Access

While SSH is a secure protocol, restricting access to it is still essential to maintain a robust security posture.

1. Firewall Rules

Firewall rules are crucial for controlling SSH access.

• Linux (iptables):
  • sudo iptables -A INPUT -p tcp --dport 22 -s <allowed_ip_address> -j ACCEPT (Allow SSH access from a specific IP address).
  • sudo iptables -A INPUT -p tcp --dport 22 -j DROP (Drop all other SSH connections).
  • sudo iptables -A INPUT -p tcp --dport 22 -j REJECT --reject-with tcp-reset (Reject all other SSH connections with a TCP reset).
• Linux (firewalld):
  • sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<allowed_ip_address>" port port="22" protocol="tcp" accept' (Allow SSH access from a specific IP address).
  • sudo firewall-cmd --permanent --add-port=22/tcp --remove-port=22/tcp (Remove general access to SSH).
  • sudo firewall-cmd --reload (Reload the firewall rules).
• Windows Firewall:
  • Open "Windows Firewall with Advanced Security."
  • Create a new inbound rule.
  • Select "Port" as the rule type.
  • Specify TCP port 22 (or the custom port if you've changed it).
  • Allow connections only from specific IP addresses or networks.
  • Block connections from all other IP addresses.

2. SSH Configuration (sshd_config)

The sshd_config file (typically located at /etc/ssh/sshd_config) allows for fine-grained control over SSH access.

• ListenAddress: Specify the IP addresses that the SSH server listens on.
  • ListenAddress 192.168.1.100 (Listen only on the IP address 192.168.1.100).
  • ListenAddress 0.0.0.0 (Listen on all available interfaces - generally not recommended).
• Port: Change the default SSH port (22) to a non-standard port. This can help reduce automated attacks.
  • Port 2222 (Change the SSH port to 2222). Remember to adjust firewall rules accordingly.
• AllowUsers: Specify a list of usernames that are allowed to log in via SSH.
  • AllowUsers user1 user2 user3 (Allow only user1, user2, and user3 to log in).
• DenyUsers: Specify a list of usernames that are denied access via SSH.
  • DenyUsers user4 user5 (Deny access to user4 and user5).
• AllowGroups: Specify a list of group names that are allowed to log in via SSH.
  • AllowGroups ssh_users admin_users (Allow users belonging to the ssh_users or admin_users groups to log in).
• DenyGroups: Specify a list of group names that are denied access via SSH.
  • DenyGroups disabled_users (Deny access to users belonging to the disabled_users group).
• PermitRootLogin: Disable root login via SSH. This forces users to log in with a regular account and then escalate privileges using sudo.
  • PermitRootLogin no (Disable root login).
• PasswordAuthentication: Disable password authentication and enforce the use of SSH keys. This significantly enhances security.
  • PasswordAuthentication no (Disable password authentication).
• PubkeyAuthentication: Enable public key authentication. This is required if you disable password authentication.
  • PubkeyAuthentication yes (Enable public key authentication).
• MaxAuthTries: Limit the number of authentication attempts per connection. This helps prevent brute-force attacks.
  • MaxAuthTries 3 (Limit authentication attempts to 3).
• MaxSessions: Limit the number of concurrent SSH sessions per connection.
  • MaxSessions 2 (Limit concurrent sessions to 2).
• ClientAliveInterval and ClientAliveCountMax: Configure SSH to periodically send keep-alive messages to the client. If the client doesn't respond after a certain number of attempts, the connection is closed. This helps prevent idle sessions from consuming resources.
  • ClientAliveInterval 300 (Send a keep-alive message every 300 seconds).
  • ClientAliveCountMax 3 (Close the connection if the client doesn't respond after 3 attempts).
• UsePAM: Enable PAM (Pluggable Authentication Modules) to leverage PAM's authentication and authorization capabilities.
  • UsePAM yes (Enable PAM).
• After making changes to sshd_config, restart the SSH service: sudo systemctl restart sshd or sudo service ssh restart.

3. SSH Keys

Using SSH keys instead of passwords provides a much more secure way to authenticate users.

• Generating SSH Keys:
  • On the client machine, use the ssh-keygen command to generate a key pair (private key and public key).
  • ssh-keygen -t rsa -b 4096 (Generate a 4096-bit RSA key).
• Copying the Public Key to the Server:
  • Use the ssh-copy-id command or manually copy the public key to the ~/.ssh/authorized_keys file on the server.
  • ssh-copy-id user@server_ip
• Disabling Password Authentication:
  • In sshd_config, set PasswordAuthentication no and PubkeyAuthentication yes.

4. Two-Factor Authentication (2FA)

Adding two-factor authentication provides an extra layer of security by requiring users to provide a second factor of authentication, such as a time-based one-time password (TOTP) generated by an app on their smartphone.

• Using Google Authenticator:
  • Install the google-authenticator PAM module: sudo apt-get install libpam-google-authenticator (Debian/Ubuntu) or sudo yum install google-authenticator (CentOS/RHEL).
  • Run google-authenticator as the user to configure 2FA. Follow the prompts to generate a secret key and configure the authentication settings.
  • Edit the PAM configuration file for SSH (e.g., /etc/pam.d/sshd) and add the following line: auth required pam_google_authenticator.so nullok.
  • In sshd_config, set ChallengeResponseAuthentication yes.
  • Restart the SSH service: sudo systemctl restart sshd or sudo service ssh restart.

5. Port Knocking

Port knocking is a technique where a client must send a sequence of TCP packets to specific ports in order to open a firewall to allow connection to a specific service, such as SSH.

• Implementation:
  • Use a port knocking daemon like knockd.
  • Configure knockd to listen for a specific sequence of port knocks.
  • When the correct sequence is received, knockd will open the firewall to allow SSH access from the client's IP address.
  • After a period of inactivity, the firewall rule is automatically removed.

6. Fail2ban

Fail2ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It monitors log files for failed login attempts and automatically blocks IP addresses that exhibit malicious behavior.

• Installation and Configuration:
  • Install Fail2ban: sudo apt-get install fail2ban (Debian/Ubuntu) or sudo yum install fail2ban (CentOS/RHEL).
  • Configure Fail2ban to monitor SSH logs (usually /var/log/auth.log or /var/log/secure).
  • Create a custom filter for SSH: /etc/fail2ban/filter.d/sshd.conf.
  • Create a custom jail for SSH: /etc/fail2ban/jail.d/sshd.conf.
  • Restart the Fail2ban service: sudo systemctl restart fail2ban or sudo service fail2ban restart.

Best Practices for Restricting SSH

• Disable Password Authentication: Enforce the use of SSH keys for authentication.
• Change the Default Port: Change the default SSH port (22) to a non-standard port.
• Limit User Access: Use AllowUsers and DenyUsers to control which users can log in via SSH.
• Disable Root Login: Prevent root login via SSH.
• Implement Two-Factor Authentication: Add an extra layer of security with 2FA.
• Use Fail2ban: Protect against brute-force attacks with Fail2ban.
• Regularly Audit: Regularly review and update your SSH configuration.
• Keep Software Updated: Keep your SSH server and client software up to date with the latest security patches.
• Monitor Logs: Monitor SSH logs for suspicious activity.

Conclusion

Restricting Telnet and SSH access is a fundamental aspect of securing any network or system. Given Telnet's inherent vulnerabilities, disabling it entirely and opting for SSH is often the best course of action. When SSH is used, implementing strong security measures, such as key-based authentication, two-factor authentication, and intrusion prevention systems like Fail2ban, is essential. Regularly reviewing and updating access controls, monitoring logs, and staying informed about the latest security threats are crucial for maintaining a secure environment. By following these guidelines, administrators can significantly reduce the risk of unauthorized access and protect their systems from potential attacks.