1

Currently, whenever people Telnet to my server (or SSH), they are prompted for a username/password.

I do my own authentication afterwards on that specific user, so this is redundant. The user automatically launches a specific bash script rather than the bash shell.

I've encountered systems where if you telnet or SSH to them without specifying a user, it will automatically login and connect to a service or script. Yet, I can't find out how to change my configuration so I can do that. Most answers are related to automatically passing the password through to a remote connection.

Is it possible in Debain to configure SSH/Telnet so that if no username is specified, it defaults to this username for the script and doesn't prompt for a password either? (Essentially immediately connecting without prompting for anything).

I should still be able to manually specify a username, like root@server - otherwise I'd have no way of getting in myself!

Here's an example of what I'm looking for:

When you SSH to bbs@ssh.osuny.bell-labs.co, you instantly bypass the login screen and go straight to the BBS program.

Here is an even better example of something that does exactly what I'm looking for: ssh sshtron.zachlatta.com

This is exactly what I'd like to. Having a username is one thing, but either the password should be bypassed or it should be null and automatically continue.

I tried modifying pam and sshd_config just now to allow this, and neither the old password nor a null one worked.

  • 1
    OpenSSH's ssh, at least, uses the current username as the default username, so it always specifies a username. What client are your people using that no username is sent to SSH at all? – muru Jul 16 at 12:50
  • @muru Could be anything. For instance, in PuTTY I just usually type the host and then specify the user root when I connect. The goal is to just specify the host for both telnet and SSH and go right to the script, no prompt for user/pw (assume the default specified user) – InterLinked Jul 16 at 13:01
  • 2
    This looks like an XY problem. What is it that you're actually trying to achieve? Who do you want connecting to your machine and what do you want them to have access to? – filbranden Jul 16 at 13:05
  • OK, an update: auto connect for user@host SSH and then auto login for host via Telnet. I know Telnet is insecure why is why I allow SSH in the first place. But I still need to allow it – InterLinked Jul 16 at 13:10
  • Then the "default specified username" is a client property, and no business of the server. – muru Jul 16 at 13:40
3

With SSH, the username is actually passed as part of the connection information in the protocol, there's no Username: prompt coming from your SSH server and, if you do see one, it's being prompted by your SSH client.

(This is common in platforms such as Windows where you're not likely to find a Linux/Unix-like username locally, so clients such as PuTTY will prompt for a username if one is not configured.)

So, in short, you always need to configure a username for SSH.

You can bypass a password prompt by setting up a blank password (i.e. no password) for that specific account. If you do so, SSH in will drop you directly into the user's configured shell. It is possible that SSH or PAM is configured to block access without password, but it should be possible to reconfigure them to allow that (see /etc/ssh/sshd_config and /etc/pam.d/ssh or sshd or similar for specifics.) Please note that this is a terrible idea. SSH without some form of authentication is probably a terrible idea, especially if you're considering exposing this on the wild Internet, so think twice before you decide to do this.

Regarding Telnet, the Telnet protocol is really simple and can in many cases be mostly ignored. You might just write a conversational program reading from stdin and writing to stdout and use minimal hooks such as tcpd or some form of nc or a systemd socket unit with Accept=yes and a multi-instance service (name ending in @) to expose that on a TCP port, and use telnet to connect to it. You'll get straight to your program, so no authentication or username exchange will be performed on your behalf. Please note that Telnet is an unencrypted protocol and others in the same network or in the network path can see the full information that is exchanged, so if you're planning to exchange sensitive information (which might include passwords, since you mentioned you're planning to do authentication in your own app), then you should probably avoid Telnet altogether.

  • See also: unix.stackexchange.com/a/530121/281844 – filbranden Jul 16 at 13:03
  • It's a BBS system, I probably should have explained that – InterLinked Jul 16 at 13:09
  • Haven't seen those in a couple of... decades! 😂 – filbranden Jul 16 at 13:12
  • +1 for pointing out that this is a bad idea. – dr01 Jul 16 at 13:27
  • 1
    If you have these ports open in the Internet, count on them getting scanned by malicious actors all the time. If they find out there's no password authentication, count on getting hit heavily with attempts to break in and get root access. Remember that SSH is running as root, so a vulnerability in it would expose root access to your machine. But even if they crack into your BBS program and just get a shell, that would easily turn your computer into a bitcoin miner / spam sender machine for the bad actors. Be very careful as you proceed. – filbranden Jul 16 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.