Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Day the Telnet Died

labs.greynoise.io

Post reply on HN
Print view View original

311–320 of 414 posts

Re: The Day the Telnet Died

#311

Post by ajross »

PhilipRoman wrote: post #240
ajross wrote: post #135

Earlier quoted context omitted.

> Nobody verifies host keys, The known_hosts file is verification of host keys. It's not verification of a host cert, which is a different thing. Most sshd instances are running on ad hoc hardware without the ability to associate them with someone a cert authority would be willing to authenticate. Basically people running services that need cert-based authentication are already using TLS (or if they're using sshd the…

>>Nobody verifies host keys, >The known_hosts file is verification of host keys I think the point was that those devices typically generate host keys dynamically and therefore the host key verification is usually turned off, leaving you just with encryption (which is still better than telnet - at least you're safe against passive adversaries). At least that's what I've seen in practice.

Host key verification is a client feature and is on by default. Have you really never gotten the giant warning after a reinstall? That's what that is. SSH is telling you that the server has changed and isn't what you think.

Re: The Day the Telnet Died

#312

Post by RupertSalt »

Kim_Bruning wrote: post #310
RupertSalt wrote: post #285

Earlier quoted context omitted.

No. MUDs should never have adopted port 23 or port 22 or any pre-assigned ports. There is no "well-known port assignment" from IANA for MUD-type games or servers. The end of RFC854, the very last paragraph, states: https://datatracker.ietf.org/doc/html/rfc854 Port Assignment When used for remote user access to service hosts (i.e., remote terminal access) this protocol is assigned server port 23 (27 octal). That is L=…

You mean something like this? mudplayer:x:1001:1001:MUD Player:/home/mudplayer:/usr/games/adventure

[flagged]

Re: The Day the Telnet Died

#313

Post by kps »

RupertSalt wrote: post #285
Kim_Bruning wrote: post #280

Earlier quoted context omitted.

They're remote terminal applications? Remote interactive text sessions. Over TELetype NETworking? You're saying that connecting my tty (emulator), to a remote host is not the purpose of telnet? Though ... I suppose by now a switch to port 22 could make sense.

No. MUDs should never have adopted port 23 or port 22 or any pre-assigned ports. There is no "well-known port assignment" from IANA for MUD-type games or servers. The end of RFC854, the very last paragraph, states: https://datatracker.ietf.org/doc/html/rfc854 Port Assignment When used for remote user access to service hosts (i.e., remote terminal access) this protocol is assigned server port 23 (27 octal). That is L=…

> by longstanding convention, that port 23/tcp is given to telnetd type login servers

First thing I ever telnetted to was Melvyl, University of California's library catalogue, around 1985. This was “remote user access” (I was a remote user) to “service hosts” (running the catalogue) providing “remote terminal access”. It was not a login.

Re: The Day the Telnet Died

#314

Post by paulddraper »

tokyobreakfast wrote: post #121
paulddraper wrote: post #118

Earlier quoted context omitted.

There's no UNIX requirement for telnet. Ubuntu does not include it by default (starting 16.04?). Most most distros don't.

Two wrongs don't make a right. Apple still includes uucp for some unknown reason. The saving disk space argument makes no sense because telnet was one of the smaller binaries in /usr/bin. Telnet continues to be widely used for select use cases and being told we're naughty by not including it feels punitive and just adds extra steps. What are you supposed to do, trash a $1m piece of industrial equipment because Apple…

You can have it, it’s not on the base install.

99% of Mac users never use it, directly or indirectly. Asking that they have it anyway is a self centric view.

Re: The Day the Telnet Died

#315

Post by itintheory »

wellf wrote: post #245
Quarrel wrote: post #107

What an amazing bug. I probably spent my first 10 years on the internet just using telnet. They were wild times. You could log ethernet traffic and see passwords. Towards the end of those we started to have a few more single-user machines, but the vast majority were old school many many user machines, where "root" was thought to be tightly restricted (of course, even then, in practice it wasn't if you were in the kno…

Never used telnet to log in to something but it is a cool debugging tool, so used it for that. E.g. can this container even send traffic to that container at all.

I'm a fan of 'nc' / netcat for this purpose. It's small, quick, and can send or receive over TCP or UDP.

Re: The Day the Telnet Died

#316

Post by paulddraper »

its_magic wrote: post #204
jmb99 wrote: post #180

Earlier quoted context omitted.

How on god’s green earth is `sudo apt install telnet` sufficiently challenging to be a driving factor to creating your own distro??

Because I go long periods of time without internet access, and I don't want to have to "sudo apt install" a fucking thing, ever. Especially not a tiny utility that is all of 172k in size, that I might need for something. Understand? I want EVERYTHING that I might use installed AT ALL TIMES, FROM DAY ONE, so that I can IMMEDIATELY USE IT when required. This is only one of many reasons why I abandoned the giant dumpste…

The easiest way to make your own “distro” is apt-get install stuffiwant…

Re: The Day the Telnet Died

#317

Post by RupertSalt »

kps wrote: post #313
RupertSalt wrote: post #285

Earlier quoted context omitted.

No. MUDs should never have adopted port 23 or port 22 or any pre-assigned ports. There is no "well-known port assignment" from IANA for MUD-type games or servers. The end of RFC854, the very last paragraph, states: https://datatracker.ietf.org/doc/html/rfc854 Port Assignment When used for remote user access to service hosts (i.e., remote terminal access) this protocol is assigned server port 23 (27 octal). That is L=…

> by longstanding convention, that port 23/tcp is given to telnetd type login servers First thing I ever telnetted to was Melvyl, University of California's library catalogue, around 1985. This was “remote user access” (I was a remote user) to “service hosts” (running the catalogue) providing “remote terminal access”. It was not a login.

I remember using MELVYL too, and you're completely right about that.

I would suggest that MELVYL on port 23/tcp was also unnecessarily impinging on the IETF standards. MELVYL could have easily established its own well-known port with the IANA and not conflicted with the TELNET login port.

Before the WWW, there were a multiplicity of search services and indexes. Remember Archie, WAIS, and Gopher? Apparently, WAIS was assigned port 210/tcp, but Archie apparently used TELNET on 23/tcp as well.

I think some of the pioneering Internet services were perceived as not requiring a dedicated port. If MELVYL was the only service running on the mainframe and it wasn't running a Unix telnetd, then why not usurp 23/tcp? The admins there probably perceived it as a virtual "octopus cable" connecting remote "terminal labs", and for sure they had alternate methods of access for OS servicing and configuration purposes. In the beginning of MELVYL they were undecided about which protocol would prevail, and TCP/IP was competing with others, so port numbers may have been afterthoughts for the architects.

The most important thing may have been the principle of not surprising users or confusing them with parameters. "telnetting to a host" was way easier without trying to specify that they needed a port number. Just ask any Unix admin where MUD users try to bang on their telnetd port trying to play the game...

Re: The Day the Telnet Died

#318

Post by alphager »

1718627440 wrote: post #243
prmoustache wrote: post #227

Earlier quoted context omitted.

It hasn't for the most part of the last 2 decades.

The telnet client comes with MS Windows, Linux and macOS. The only platforms were you need to install some extra component are Android and iOS.

Telnet client is an optional feature in Windows that needs to be enabled/installed.

Re: The Day the Telnet Died

#319

Post by ordu »

RupertSalt wrote: post #275
VadimPR wrote: post #271

Earlier quoted context omitted.

Lots of text games - MUDs - still play over telnet using dedicated MUD clients that implement their own telnet stack. Outright blocking the port has an outsized side efffe on them, this is simply not right.

If MUDs and other games were indeed using port 23/tcp for player access, they were not only incorrect but rather dangerous. Since 23/tcp is a well-known IANA-registered port for the Telnet service, it is an RFC violation to use it for a service that is not telnetd/remote logins via TELNET protocol. Any port below 1024 signifies that it is a "privileged port". This is an archaic distinction that developed in high-trus…

> Any port below 1024 signifies that it is a "privileged port". This is an archaic distinction that developed in high-trust R&E networks, but it did signify that the listener on the port had administrative/root access to spawn a service there, so it was kind of a signal that you could "trust" the remote server with your login credentials.

If something is running on a privileged port is not enough to trust it. Firstly you need to trust to a host, you need to know where are you connecting to. If you connect to a random host with a privileged port and pass it your credentials you are doing stupid things.

This thing with privileged ports is protecting you from users who could run arbitrary code on a server. From them and not from anyone else. So for MUD there is a lot of reasons to run on 23 port, it is a signal for users of MUD that they are connecting to a process hat was started by the owner of the machine having the root.

> If your favorite MUD runs on port 23 today, such as nethack or something, then I am glad for this change, which will force the administrator to select a unique port that does not imply privilege, TELNET protocol, or shell login credentials. It is totally RFC-compliant to select an unassigned port above 1023, and MUD conventions have popularized several numbers that are still recognizable to players today.

If I was running a MUD, I would find some way to get around. I could use 22 for example, though it could cause me problems with logging in with ssh. But it is not an issue really, there are 1k privileged ports, I could choose one from them.

Post reply on HN