How can I stop telnet access for a particular IP address on the command line?
2 Answers
A more general solution than Laurentiu Roescu's would be to use iptables, which works the same in every distribution and essentially regardless of which software is installed.
# iptables -A INPUT -p tcp -s <ip_address> --dport telnet -j DROP
You may optionally use -j REJECT
instead of -j DROP
. Using REJECT will tell whoever is at the other end that there is nothing on that particular port; using DROP will drop the packet, which leads to the connection attempt timing out after the remote host's connect timeout interval has passed.
It's possible that you will need to insert the rule before any "ACCEPT" rules that may already be in place. If so, I like to do it like this:
# iptables -L INPUT --line-number
<some or lots of output>
# iptables -I INPUT <number of telnet accept rule> ...
where the ...
is everything from -p tcp
onward in the command above. Essentially, -I INPUT n
replaces -A INPUT
. (-I is insert just before position n, -A is append.)
You can use --dport telnet
because telnet
is listed in /etc/services. Try grep telnet /etc/services
if you are curious. If it weren't, you'd have to use the numerical port number, which is 23
.
You may need to use something like iptables-save
to preserve the rule across reboots. The details on that will depend on your distribution and setup, and thus cannot be answered generally. If you specify your distribution and version, someone may be able to offer specific insights as to that (or it may work better as a separate question "how do I preserve iptables rules across reboots in Distribution X Version Y?").
That said, I agree with that one should use SSH instead. But you still may want to block access from certain IPs, and the lower level at which that can be done, the less you risk a bug in a higher-level portion of the stack leading to a compromise or denial of service.
telnet
is an open security sore and a breach waiting to happen. Disable all telnet servers ASAP.