On the bright side that CVE seems like pretty great news for the hardware hacking community hoping to get root on embedded devices which have open telnetd.
The Day the Telnet Died
161–170 of 414 posts
Re: The Day the Telnet Died
#162Earlier quoted context omitted.
Breaching the daemon only allows for the attacker to get access to the login. User accounts should still be secured requiring authentication. >If this was so easy to deal with, someone would have done it. Sadly this is not the case. There is a lot of inertia towards solutions like ssh or sudo. It may be easy to delete them, but actually getting such a changed accepted is no trivial task.
> Breaching the daemon only allows for the attacker to get access to the login Yes, but potentially any login. See the problem? If you compromise the gatekeeper, you are now the keymaster. Or whatever :)
I'll admit it is still problematic. But at least there is only 1 gatekeeper instead of 2.
Re: The Day the Telnet Died
#163Earlier quoted context omitted.
If you think you can do better you're welcome to do better. I say this without a hint of sarcasm. This is how open source works. It's a do–ocracy, not a democracy. Whoever makes a telnet server gets to decide how the telnet server works and how much testing it gets before release.
Maybe the lesson here is to stop letting the GNU folks do things, if this is what they do. This is only one example of craziness coming out of the GNU camp.
Or, flip the responsibility to what it has always been understood to be, when using open source software from random volunteers (some being bad actors) on the internet for anything remotely critical: audit the source.
Re: The Day the Telnet Died
#164Re: The Day the Telnet Died
#165Why are people still using telnet across the internet in this century? Was this _all_ attack traffic? (OK, I know one ancient talker that uses it - but on a very non-standard port so a port 23 block wouldn't be relevant)
One? All the talkers still use it and all the MUDs/MOOs etc. far out number the talkers.
N.U.T.S. 3.3.3 4eva! There was a NUTS 4, but about a decade too late.
Re: The Day the Telnet Died
#166Earlier quoted context omitted.
https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c28...
That's crazy. This is core business critical software but they just YOLO critical changes without any automated tests? this PR would be insta-rejected in the small SAAS shop I work at.
Most 90’s era software had zero tests. Nobody gave it a second thought.
Re: The Day the Telnet Died
#167Earlier quoted context omitted.
> that users connect to using Telnet Not anymore ;) Seriously though: did you notice any spikes up or down? If you'd run it on a non-standard port, anyone can still connect with netcat, socat, etc etc.
Ah, not really. We are on a non-standard port (9000). I just meant some folks use the telnet client to connect, and we do negotiate some telnet options. I use tintin++ these days but I think most of our players are still using decades old zMUD versions to connect!
I always preferred gmud, but zmud has all the bells and whistles. All I needed was ANSI color, aliases, triggers, and command history.
How can I get access?
Re: The Day the Telnet Died
#168Earlier quoted context omitted.
None of this affects the use of telnet the client program nor the ability to run a telnetd on your own host (but do be sure it's patched!). What's happened is that global routing on the internet (or big chunks of it, it's not really clear) has started blocking telnet's default port to protect presumably-unpatched/unpatchable dinosaur systems from automated attack. So you can no longer (probably) rely on getting to a…
> started blocking telnet's default port But that's 23 and smtp is 25.
SMTP has and is almost blocked everywhere to dissuade spam.
Re: The Day the Telnet Died
#169Never mind telnetd. Tier 1 transit providers doing port filtering is EXTREMELY alarming. They have partitioned the Internet, and in a way that automatic routing (BGP) can't get around.
Re: The Day the Telnet Died
#170Earlier quoted context omitted.
If you think you can do better you're welcome to do better. I say this without a hint of sarcasm. This is how open source works. It's a do–ocracy, not a democracy. Whoever makes a telnet server gets to decide how the telnet server works and how much testing it gets before release.
Maybe the lesson here is to stop letting the GNU folks do things, if this is what they do. This is only one example of craziness coming out of the GNU camp.
GNU doesn’t provide labor, only organizational tools like mailing lists and whatnot. The projects that GNU supports are still run by individual volunteers. If you want it done better then please volunteer so that you can be the one doing it better.