Allowing guest SSH and Telnet access

Question

Currently, whenever people Telnet to my server (or SSH), they are prompted for a username/password.

I do my own authentication afterwards on that specific user, so this is redundant. The user automatically launches a specific bash script rather than the bash shell.

I've encountered systems where if you telnet or SSH to them without specifying a user, it will automatically login and connect to a service or script. Yet, I can't find out how to change my configuration so I can do that. Most answers are related to automatically passing the password through to a remote connection.

Is it possible in Debain to configure SSH/Telnet so that if no username is specified, it defaults to this username for the script and doesn't prompt for a password either? (Essentially immediately connecting without prompting for anything).

I should still be able to manually specify a username, like root@server - otherwise I'd have no way of getting in myself!

Here's an example of what I'm looking for:

When you SSH to [email protected], you instantly bypass the login screen and go straight to the BBS program.

Here is an even better example of something that does exactly what I'm looking for: ssh sshtron.zachlatta.com

This is exactly what I'd like to. Having a username is one thing, but either the password should be bypassed or it should be null and automatically continue.

I tried modifying pam and sshd_config just now to allow this, and neither the old password nor a null one worked.

Answer 1

With SSH, the username is actually passed as part of the connection information in the protocol, there's no Username: prompt coming from your SSH server and, if you do see one, it's being prompted by your SSH client.

(This is common in platforms such as Windows where you're not likely to find a Linux/Unix-like username locally, so clients such as PuTTY will prompt for a username if one is not configured.)

So, in short, you always need to configure a username for SSH.

You can bypass a password prompt by setting up a blank password (i.e. no password) for that specific account. If you do so, SSH in will drop you directly into the user's configured shell. It is possible that SSH or PAM is configured to block access without password, but it should be possible to reconfigure them to allow that (see /etc/ssh/sshd_config and /etc/pam.d/ssh or sshd or similar for specifics.) Please note that this is a terrible idea. SSH without some form of authentication is probably a terrible idea, especially if you're considering exposing this on the wild Internet, so think twice before you decide to do this.

Regarding Telnet, the Telnet protocol is really simple and can in many cases be mostly ignored. You might just write a conversational program reading from stdin and writing to stdout and use minimal hooks such as tcpd or some form of nc or a systemd socket unit with Accept=yes and a multi-instance service (name ending in @) to expose that on a TCP port, and use telnet to connect to it. You'll get straight to your program, so no authentication or username exchange will be performed on your behalf. Please note that Telnet is an unencrypted protocol and others in the same network or in the network path can see the full information that is exchanged, so if you're planning to exchange sensitive information (which might include passwords, since you mentioned you're planning to do authentication in your own app), then you should probably avoid Telnet altogether.