can't telnet to host

[Sol Linderstein]

Hi,

I've got a Solaris 8 machine that I inherited and I'm stumped as to
why I can't telnet to it. I know that telnet service works by default
on Solaris and I don't know what my predecessor did to disable it.

If I try to telnet to the machine I get:

Trying a.b.c.d...
Connected to myhost.com.
Escape character is '^]'.


SunOS 5.8

Connection closed by foreign host.

There are no /etc/hosts.allow or /etc/hosts.deny files so I don't
think TCP wrappers are in play here.

Here's the entry in /etc/inetd.conf:

telnet stream tcp6 nowait root /usr/sbin/in.telnetd
in.telnetd

It's not commented out so inetd should spawn in.telnetd as needed.

The binary does exist and is executable:

-r-xr-xr-x 1 root bin 28112 Nov 30 2000
/usr/sbin/in.telnetd

Where else can I look?

Thanks,
Sol

[Darren Dunham]

Sol Linderstein <slinderstein@yahoo.com> wrote:

> Where else can I look?

Besides doing analysis of the in.telnetd binary against a known good
copy, you could 'truss -f -p <inetd PID>' to a file as you attempt to
telnet in.

That should show inetd doing the fork/exec of the telnetd process, and
what that process does later. What interactions the process has might
lead you to find a cause.

--
Darren Dunham [email]ddunham@taos.com[/email]
Unix System Administrator Taos - The SysAdmin Company
Got some Dr Pepper? San Francisco, CA bay area
< This line left intentionally blank to confuse you. >

[Sol Linderstein]

"Oscar del Rio" <delrio@mie.utoronto.ca> wrote in message news:<HInKwv.Av0@mie.utoronto.ca>...

....

>
> The "SunOS 5.8" banner is from in.telnetd so inetd is working fine.
> At that point telnetd is supposed to run /bin/login which will
> give you the login/password prompts.
> It seems /bin/login is failing.
>
> It is possible that the system was hacked and /bin/login replaced.
> If you do not know what the former owner did with the machine,
> I would recommend reinstalling the system from scratch.

Bingo! We were hacked a while ago. I cleaned up lots of hacked
binaries but not /bin/login. I put in a good one and telnet works!
Yes, I know telnet is insecure but I'm not enabling telnet for the
long-term, just for short-term access for someone who needs to login
remotely and may not have an ssh client.

Yes, it's time to reinstall the machine.

Thanks for the help.

Sol

[Anthony Mandic]

Sol Linderstein wrote:

> Bingo! We were hacked a while ago. I cleaned up lots of hacked
> binaries but not /bin/login.

How do you mean "cleaned up"?

> Yes, it's time to reinstall the machine.

Either that or restore from backup.

-am © 2003

[drilett]

Anything less than new install on hacked machinemight benefit from a
check for rootkit.
chkroot kit will test these binaries and find missing or corrupt bins.
see:
[url]http://www.chkrootkit.org/[/url]

Still best to reinstall.

--
drilett


Posted via [url]http://dbforums.com[/url]