telnetd.tproj/telnetd.8

   1 .\" Copyright (c) 1983, 1993
   2 .\"     The Regents of the University of California.  All rights reserved.
   3 .\"
   4 .\" Redistribution and use in source and binary forms, with or without
   5 .\" modification, are permitted provided that the following conditions
   6 .\" are met:
   7 .\" 1. Redistributions of source code must retain the above copyright
   8 .\"    notice, this list of conditions and the following disclaimer.
   9 .\" 2. Redistributions in binary form must reproduce the above copyright
  10 .\"    notice, this list of conditions and the following disclaimer in the
  11 .\"    documentation and/or other materials provided with the distribution.
  12 .\" 3. All advertising materials mentioning features or use of this software
  13 .\"    must display the following acknowledgement:
  14 .\"     This product includes software developed by the University of
  15 .\"     California, Berkeley and its contributors.
  16 .\" 4. Neither the name of the University nor the names of its contributors
  17 .\"    may be used to endorse or promote products derived from this software
  18 .\"    without specific prior written permission.
  19 .\"
  20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30 .\" SUCH DAMAGE.
  31 .\"
  32 .\"     @(#)telnetd.8   8.4 (Berkeley) 6/1/94
  33 .\"
  34 .Dd June 1, 1994
  35 .Dt TELNETD 8
  36 .Os BSD 4.2
  37 .Sh NAME
  38 .Nm telnetd
  39 .Nd DARPA
  40 .Tn TELNET
  41 protocol server
  42 .Sh SYNOPSIS
  43 .Nm /usr/libexec/telnetd
  44 .Op Fl BUhlkns
  45 .Op Fl D Ar debugmode
  46 .Op Fl I Ns Ar initid
  47 .Op Fl S Ar tos
  48 .Op Fl X Ar authtype
  49 .Op Fl a Ar authmode
  50 .Op Fl edebug
  51 .Op Fl r Ns Ar lowpty-highpty
  52 .Op Fl u Ar len
  53 .Op Fl debug Op Ar port
  54 .Sh DESCRIPTION
  55 The
  56 .Nm telnetd
  57 command is a server which supports the
  58 .Tn DARPA
  59 standard
  60 .Tn TELNET
  61 virtual terminal protocol.
  62 .Nm Telnetd
  63 is normally invoked by the internet server (see
  64 .Xr inetd 8 )
  65 for requests to connect to the
  66 .Tn TELNET
  67 port as indicated by the
  68 .Pa /etc/services
  69 file (see
  70 .Xr services 5 ) .
  71 The
  72 .Fl debug
  73 option may be used to start up
  74 .Nm telnetd
  75 manually, instead of through
  76 .Xr inetd 8 .
  77 If started up this way,
  78 .Ar port
  79 may be specified to run
  80 .Nm telnetd
  81 on an alternate
  82 .Tn TCP
  83 port number.
  84 .Pp
  85 The
  86 .Nm telnetd
  87 command accepts the following options:
  88 .Bl -tag -width "-a authmode"
  89 .It Fl a Ar authmode
  90 This option may be used for specifying what mode should
  91 be used for authentication.
  92 Note that this option is only useful if
  93 .Nm telnetd
  94 has been compiled with support for the
  95 .Dv AUTHENTICATION
  96 option.
  97 There are several valid values for
  98 .Ar authmode:
  99 .Bl -tag -width debug
 100 .It debug
 101 Turns on authentication debugging code.
 102 .It user
 103 Only allow connections when the remote user
 104 can provide valid authentication information
 105 to identify the remote user,
 106 and is allowed access to the specified account
 107 without providing a password.
 108 .It valid
 109 Only allow connections when the remote user
 110 can provide valid authentication information
 111 to identify the remote user.
 112 The
 113 .Xr login 1
 114 command will provide any additional user verification
 115 needed if the remote user is not allowed automatic
 116 access to the specified account.
 117 .It other
 118 Only allow connections that supply some authentication information.
 119 This option is currently not supported
 120 by any of the existing authentication mechanisms,
 121 and is thus the same as specifying
 122 .Fl a
 123 .Cm valid .
 124 .It none
 125 This is the default state.
 126 Authentication information is not required.
 127 If no or insufficient authentication information
 128 is provided, then the
 129 .Xr login 1
 130 program will provide the necessary user
 131 verification.
 132 .It off
 133 This disables the authentication code.
 134 All user verification will happen through the
 135 .Xr login 1
 136 program.
 137 .El
 138 .It Fl B
 139 Specifies bftp server mode.  In this mode,
 140 .Nm telnetd
 141 causes login to start a
 142 .Xr bftp 1
 143 session rather than the user's
 144 normal shell.  In bftp daemon mode normal
 145 logins are not supported, and it must be used
 146 on a port other than the normal
 147 .Tn TELNET
 148 port.
 149 .It Fl D Ar debugmode
 150 This option may be used for debugging purposes.
 151 This allows
 152 .Nm telnetd
 153 to print out debugging information
 154 to the connection, allowing the user to see what
 155 .Nm telnetd
 156 is doing.
 157 There are several possible values for
 158 .Ar debugmode:
 159 .Bl -tag -width exercise
 160 .It Cm options
 161 Prints information about the negotiation of
 162 .Tn TELNET
 163 options.
 164 .It Cm report
 165 Prints the
 166 .Cm options
 167 information, plus some additional information
 168 about what processing is going on.
 169 .It Cm netdata
 170 Displays the data stream received by
 171 .Nm telnetd.
 172 .It Cm ptydata
 173 Displays data written to the pty.
 174 .It Cm exercise
 175 Has not been implemented yet.
 176 .El
 177 .It Fl debug
 178 Enables debugging on each socket created by
 179 .Nm telnetd
 180 (see
 181 .Dv SO_DEBUG
 182 in
 183 .Xr socket 2 ) .
 184 .It Fl edebug
 185 If
 186 .Nm telnetd
 187 has been compiled with support for data encryption, then the
 188 .Fl edebug
 189 option may be used to enable encryption debugging code.
 190 .It Fl h
 191 Disables the printing of host-specific information before
 192 login has been completed.
 193 .It Fl I Ar initid
 194 This option is only applicable to
 195 .Tn UNICOS
 196 systems prior to 7.0.
 197 It specifies the
 198 .Dv ID
 199 from
 200 .Pa /etc/inittab
 201 to use when init starts login sessions.  The default
 202 .Dv ID
 203 is
 204 .Dv fe.
 205 .It Fl k
 206 This option is only useful if
 207 .Nm telnetd
 208 has been compiled with both linemode and kludge linemode
 209 support.  If the
 210 .Fl k
 211 option is specified, then if the remote client does not
 212 support the
 213 .Dv LINEMODE
 214 option, then
 215 .Nm telnetd
 216 will operate in character at a time mode.
 217 It will still support kludge linemode, but will only
 218 go into kludge linemode if the remote client requests
 219 it.
 220 (This is done by by the client sending
 221 .Dv DONT SUPPRESS-GO-AHEAD
 222 and
 223 .Dv DONT ECHO . )
 224 The
 225 .Fl k
 226 option is most useful when there are remote clients
 227 that do not support kludge linemode, but pass the heuristic
 228 (if they respond with
 229 .Dv WILL TIMING-MARK
 230 in response to a
 231 .Dv DO TIMING-MARK)
 232 for kludge linemode support.
 233 .It Fl l
 234 Specifies line mode.  Tries to force clients to use line-
 235 at-a-time mode.
 236 If the
 237 .Dv LINEMODE
 238 option is not supported, it will go
 239 into kludge linemode.
 240 .It Fl n
 241 Disable
 242 .Dv TCP
 243 keep-alives.  Normally
 244 .Nm telnetd
 245 enables the
 246 .Tn TCP
 247 keep-alive mechanism to probe connections that
 248 have been idle for some period of time to determine
 249 if the client is still there, so that idle connections
 250 from machines that have crashed or can no longer
 251 be reached may be cleaned up.
 252 .It Fl r Ar lowpty-highpty
 253 This option is only enabled when
 254 .Nm telnetd
 255 is compiled for
 256 .Dv UNICOS.
 257 It specifies an inclusive range of pseudo-terminal devices to
 258 use.  If the system has sysconf variable
 259 .Dv _SC_CRAY_NPTY
 260 configured, the default pty search range is 0 to
 261 .Dv _SC_CRAY_NPTY;
 262 otherwise, the default range is 0 to 128.  Either
 263 .Ar lowpty
 264 or
 265 .Ar highpty
 266 may be omitted to allow changing
 267 either end of the search range.  If
 268 .Ar lowpty
 269 is omitted, the - character is still required so that
 270 .Nm telnetd
 271 can differentiate
 272 .Ar highpty
 273 from
 274 .Ar lowpty .
 275 .It Fl s
 276 This option is only enabled if
 277 .Nm telnetd
 278 is compiled with support for
 279 .Tn SecurID
 280 cards.
 281 It causes the
 282 .Fl s
 283 option to be passed on to
 284 .Xr login 1 ,
 285 and thus is only useful if
 286 .Xr login 1
 287 supports the
 288 .Fl s
 289 flag to indicate that only
 290 .Tn SecurID
 291 validated logins are allowed, and is
 292 usually useful for controlling remote logins
 293 from outside of a firewall.
 294 .It Fl S Ar tos
 295 .It Fl u Ar len
 296 This option is used to specify the size of the field
 297 in the
 298 .Dv utmp
 299 structure that holds the remote host name.
 300 If the resolved host name is longer than
 301 .Ar len ,
 302 the dotted decimal value will be used instead.
 303 This allows hosts with very long host names that
 304 overflow this field to still be uniquely identified.
 305 Specifying
 306 .Fl u0
 307 indicates that only dotted decimal addresses
 308 should be put into the
 309 .Pa utmp
 310 file.
 311 .ne 1i
 312 .It Fl U
 313 This option causes
 314 .Nm telnetd
 315 to refuse connections from addresses that
 316 cannot be mapped back into a symbolic name
 317 via the
 318 .Xr gethostbyaddr 3
 319 routine.
 320 .It Fl X Ar authtype
 321 This option is only valid if
 322 .Nm telnetd
 323 has been built with support for the authentication option.
 324 It disables the use of
 325 .Ar authtype
 326 authentication, and
 327 can be used to temporarily disable
 328 a specific authentication type without having to recompile
 329 .Nm telnetd .
 330 .El
 331 .Pp
 332 .Nm Telnetd
 333 operates by allocating a pseudo-terminal device (see
 334 .Xr pty 4 )
 335 for a client, then creating a login process which has
 336 the slave side of the pseudo-terminal as
 337 .Dv stdin ,
 338 .Dv stdout
 339 and
 340 .Dv stderr .
 341 .Nm Telnetd
 342 manipulates the master side of the pseudo-terminal,
 343 implementing the
 344 .Tn TELNET
 345 protocol and passing characters
 346 between the remote client and the login process.
 347 .Pp
 348 When a
 349 .Tn TELNET
 350 session is started up,
 351 .Nm telnetd
 352 sends
 353 .Tn TELNET
 354 options to the client side indicating
 355 a willingness to do the
 356 following
 357 .Tn TELNET
 358 options, which are described in more detail below:
 359 .Bd -literal -offset indent
 360 DO AUTHENTICATION
 361 WILL ENCRYPT
 362 DO TERMINAL TYPE
 363 DO TSPEED
 364 DO XDISPLOC
 365 DO NEW-ENVIRON
 366 DO ENVIRON
 367 WILL SUPPRESS GO AHEAD
 368 DO ECHO
 369 DO LINEMODE
 370 DO NAWS
 371 WILL STATUS
 372 DO LFLOW
 373 DO TIMING-MARK
 374 .Ed
 375 .Pp
 376 The pseudo-terminal allocated to the client is configured
 377 to operate in \*(lqcooked\*(rq mode, and with
 378 .Dv XTABS and
 379 .Dv CRMOD
 380 enabled (see
 381 .Xr tty 4 ) .
 382 .Pp
 383 .Nm Telnetd
 384 has support for enabling locally the following
 385 .Tn TELNET
 386 options:
 387 .Bl -tag -width "DO AUTHENTICATION"
 388 .It "WILL ECHO"
 389 When the
 390 .Dv LINEMODE
 391 option is enabled, a
 392 .Dv WILL ECHO
 393 or
 394 .Dv WONT ECHO
 395 will be sent to the client to indicate the
 396 current state of terminal echoing.
 397 When terminal echo is not desired, a
 398 .Dv WILL ECHO
 399 is sent to indicate that
 400 .Tn telnetd
 401 will take care of echoing any data that needs to be
 402 echoed to the terminal, and then nothing is echoed.
 403 When terminal echo is desired, a
 404 .Dv WONT ECHO
 405 is sent to indicate that
 406 .Tn telnetd
 407 will not be doing any terminal echoing, so the
 408 client should do any terminal echoing that is needed.
 409 .It "WILL BINARY"
 410 Indicates that the client is willing to send a
 411 8 bits of data, rather than the normal 7 bits
 412 of the Network Virtual Terminal.
 413 .It "WILL SGA"
 414 Indicates that it will not be sending
 415 .Dv IAC GA,
 416 go ahead, commands.
 417 .It "WILL STATUS"
 418 Indicates a willingness to send the client, upon
 419 request, of the current status of all
 420 .Tn TELNET
 421 options.
 422 .It "WILL TIMING-MARK"
 423 Whenever a
 424 .Dv DO TIMING-MARK
 425 command is received, it is always responded
 426 to with a
 427 .Dv WILL TIMING-MARK
 428 .ne 1i
 429 .It "WILL LOGOUT"
 430 When a
 431 .Dv DO LOGOUT
 432 is received, a
 433 .Dv WILL LOGOUT
 434 is sent in response, and the
 435 .Tn TELNET
 436 session is shut down.
 437 .It "WILL ENCRYPT"
 438 Only sent if
 439 .Nm telnetd
 440 is compiled with support for data encryption, and
 441 indicates a willingness to decrypt
 442 the data stream.
 443 .El
 444 .Pp
 445 .Nm Telnetd
 446 has support for enabling remotely the following
 447 .Tn TELNET
 448 options:
 449 .Bl -tag -width "DO AUTHENTICATION"
 450 .It "DO BINARY"
 451 Sent to indicate that
 452 .Tn telnetd
 453 is willing to receive an 8 bit data stream.
 454 .It "DO LFLOW"
 455 Requests that the client handle flow control
 456 characters remotely.
 457 .It "DO ECHO"
 458 This is not really supported, but is sent to identify a 4.2BSD
 459 .Xr telnet 1
 460 client, which will improperly respond with
 461 .Dv WILL ECHO.
 462 If a
 463 .Dv WILL ECHO
 464 is received, a
 465 .Dv DONT ECHO
 466 will be sent in response.
 467 .It "DO TERMINAL-TYPE"
 468 Indicates a desire to be able to request the
 469 name of the type of terminal that is attached
 470 to the client side of the connection.
 471 .It "DO SGA"
 472 Indicates that it does not need to receive
 473 .Dv IAC GA,
 474 the go ahead command.
 475 .It "DO NAWS"
 476 Requests that the client inform the server when
 477 the window (display) size changes.
 478 .It "DO TERMINAL-SPEED"
 479 Indicates a desire to be able to request information
 480 about the speed of the serial line to which
 481 the client is attached.
 482 .It "DO XDISPLOC"
 483 Indicates a desire to be able to request the name
 484 of the X windows display that is associated with
 485 the telnet client.
 486 .It "DO NEW-ENVIRON"
 487 Indicates a desire to be able to request environment
 488 variable information, as described in RFC 1572.
 489 .It "DO ENVIRON"
 490 Indicates a desire to be able to request environment
 491 variable information, as described in RFC 1408.
 492 .It "DO LINEMODE"
 493 Only sent if
 494 .Nm telnetd
 495 is compiled with support for linemode, and
 496 requests that the client do line by line processing.
 497 .It "DO TIMING-MARK"
 498 Only sent if
 499 .Nm telnetd
 500 is compiled with support for both linemode and
 501 kludge linemode, and the client responded with
 502 .Dv WONT LINEMODE.
 503 If the client responds with
 504 .Dv WILL TM,
 505 the it is assumed that the client supports
 506 kludge linemode.
 507 Note that the
 508 .Op Fl k
 509 option can be used to disable this.
 510 .It "DO AUTHENTICATION"
 511 Only sent if
 512 .Nm telnetd
 513 is compiled with support for authentication, and
 514 indicates a willingness to receive authentication
 515 information for automatic login.
 516 .It "DO ENCRYPT"
 517 Only sent if
 518 .Nm telnetd
 519 is compiled with support for data encryption, and
 520 indicates a willingness to decrypt
 521 the data stream.
 522 .Sh ENVIRONMENT
 523 .Sh FILES
 524 .Pa /etc/services
 525 .br
 526 .Pa /etc/inittab
 527 (UNICOS systems only)
 528 .br
 529 .Pa /etc/iptos
 530 (if supported)
 531 .br
 532 .Pa /usr/ucb/bftp
 533 (if supported)
 534 .Sh "SEE ALSO"
 535 .Xr telnet 1 ,
 536 .Xr login 1 ,
 537 .Xr bftp 1
 538 (if supported)
 539 .Sh STANDARDS
 540 .Bl -tag -compact -width RFC-1572
 541 .It Cm RFC-854
 542 .Tn TELNET
 543 PROTOCOL SPECIFICATION
 544 .It Cm RFC-855
 545 TELNET OPTION SPECIFICATIONS
 546 .It Cm RFC-856
 547 TELNET BINARY TRANSMISSION
 548 .It Cm RFC-857
 549 TELNET ECHO OPTION
 550 .It Cm RFC-858
 551 TELNET SUPPRESS GO AHEAD OPTION
 552 .It Cm RFC-859
 553 TELNET STATUS OPTION
 554 .It Cm RFC-860
 555 TELNET TIMING MARK OPTION
 556 .It Cm RFC-861
 557 TELNET EXTENDED OPTIONS - LIST OPTION
 558 .It Cm RFC-885
 559 TELNET END OF RECORD OPTION
 560 .It Cm RFC-1073
 561 Telnet Window Size Option
 562 .It Cm RFC-1079
 563 Telnet Terminal Speed Option
 564 .It Cm RFC-1091
 565 Telnet Terminal-Type Option
 566 .It Cm RFC-1096
 567 Telnet X Display Location Option
 568 .It Cm RFC-1123
 569 Requirements for Internet Hosts -- Application and Support
 570 .It Cm RFC-1184
 571 Telnet Linemode Option
 572 .It Cm RFC-1372
 573 Telnet Remote Flow Control Option
 574 .It Cm RFC-1416
 575 Telnet Authentication Option
 576 .It Cm RFC-1411
 577 Telnet Authentication: Kerberos Version 4
 578 .It Cm RFC-1412
 579 Telnet Authentication: SPX
 580 .It Cm RFC-1571
 581 Telnet Environment Option Interoperability Issues
 582 .It Cm RFC-1572
 583 Telnet Environment Option
 584 .Sh BUGS
 585 Some
 586 .Tn TELNET
 587 commands are only partially implemented.
 588 .Pp
 589 Because of bugs in the original 4.2 BSD
 590 .Xr telnet 1 ,
 591 .Nm telnetd
 592 performs some dubious protocol exchanges to try to discover if the remote
 593 client is, in fact, a 4.2 BSD
 594 .Xr telnet 1 .
 595 .Pp
 596 Binary mode
 597 has no common interpretation except between similar operating systems
 598 (Unix in this case).
 599 .Pp
 600 The terminal type name received from the remote client is converted to
 601 lower case.
 602 .Pp
 603 .Nm Telnetd
 604 never sends
 605 .Tn TELNET
 606 .Dv IAC GA
 607 (go ahead) commands.