Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Day the Telnet Died

labs.greynoise.io

Post reply on HN
Print view View original

81–90 of 414 posts

Re: The Day the Telnet Died

#81

Post by nine_k »

charcircuit wrote: post #78
nine_k wrote: post #47

Earlier quoted context omitted.

What do you think proper architecture would be, given that ssh needs a capability to let root logins? I suppose it could be via a proper PAM module, which is widely supported. Too bad the first PAM RFC was published about the same time the first be version of ssh was released.

I think a proper architecture would not even have a root account. The server would just expose an authenticated endpoint that allows for configuration and updates to be pushed for it.

You are thinking 20 years ahead. In 1995 most servers were still pets, not cattle.

Re: The Day the Telnet Died

#82

Post by mananaysiempre »

iamnothere wrote: post #57
trebligdivad wrote: post #24

Why are people still using telnet across the internet in this century? Was this _all_ attack traffic? (OK, I know one ancient talker that uses it - but on a very non-standard port so a port 23 block wouldn't be relevant)

Hams use it over packet radio sometimes since encryption is forbidden on the amateur bands. IMHO we need a good telnet replacement that sends signed data. Most people interpret signatures as allowed under FCC rules, just not encryption.

> IMHO we need a good telnet replacement that sends signed data. Most people interpret signatures as allowed under FCC rules, just not encryption.

I know from bitter experience that IPsec is a “now you have two problems” kind of solution, but the Authentication Header is a thing and is supported by most (all?) implementations. Ham radio operators probably don’t have much use for the actual features of telnet compared to plain netcat, do they? (It’s mostly terminal feature negotiation and such.)

Re: The Day the Telnet Died

#83

Post by ozarkerD »

gerdesj wrote: post #9

telnet isn't just for ... telnet. $ telnet smtp.example.co.uk 25 HELO me MAIL FROM: gerdesj@example2.co.uk RCPT TO: gerdesj@example.co.uk DATA .. or you can use SWAKS! For some odd reason telnet is becoming rare as an installed binary.

I discovered swaks recently, god I love that tool

Re: The Day the Telnet Died

#85

Post by peteforde »

The scope of this CVE and the response to it are genuinely wild.

It's crazy to think that some dude is singlehandedly responsible for ultimately ending the telnet era in such a definitive way.

One for the history books.

Re: The Day the Telnet Died

#86

Post by [deleted] »

saulpw wrote: post #49
jopython wrote: post #45

This is about Telnetd. Not telnet itself.

...except that port 23 seems to now be filtered across the internet at large, leading to a huge drop-off in telnet traffic over the course of days if not hours. I think it's safe to say that even if you patch telnetd, being able to use telnet over the internet is not possible in many places (including Canada, according to the data).

[deleted]

Re: The Day the Telnet Died

#87

Post by fennec-posix »

pbhjpbhj wrote: post #34
RonanSoleste wrote: post #4

I still used telnet today (had to). Unsure of the patching here. But its definitely locked down to a subset of internal use only.

Embedded? Ancient? What sort of systems are you telnetting into?

Not the parent poster, but I also still use telnet. For me it's "Ancient", I have a few retired SPARC and PA-RISC boxes that run their period appropriate OSes as a hobby. Telnet/rlogin is the more reliable method to get into them remotely (just over the LAN).

They're on a LAN behind a NAT Router/Firewall, and I don't always keep them powered up (I'm not that insane) so I really don't have a concern for them.

Some of the more modern/high-performance examples I have run NetBSD with modern sshd and modern ciphers, but you can tell it's a bit of a workout for them.

Re: The Day the Telnet Died

#88

Post by 0xbadcafebee »

trebligdivad wrote: post #24

Why are people still using telnet across the internet in this century? Was this _all_ attack traffic? (OK, I know one ancient talker that uses it - but on a very non-standard port so a port 23 block wouldn't be relevant)

Telnet is used in legacy, IoT, embedded, and low-level industrial hardware. It's also intentionally enabled on devices where automation was written for telnet and it wasn't easy to switch to ssh.

If you investigate most commercial uses of ssh, the security is disabled or ignored. Nobody verifies host keys, and with automation where hosts cycle, you basically have to disable verification as there's no easy way around the host keys constantly changing. Without host key verification, there's kinda no point to the rest.

Even assuming the host keys were verified, the popular ssh conventions are to use either long-lived static keys (and almost nobody puts a password on theirs), or a password. Very few people use SSH with 2FA, and almost no-one uses ephemeral keys (OIDC) or certificates (which many people screw up).

So in terms of how people actually use it, SSH is one of the least secure transport methods. You'd be much more secure by using telnet over an HTTPS websocket with OAuth for login.

Re: The Day the Telnet Died

#89

Post by kalleboo »

accrual wrote: post #65
mmooss wrote: post #44

Earlier quoted context omitted.

Connection failed Maybe we should give the kind person who hosts it a break. Try it out tomorrow. (Yes, I should have thought of that before I tried.)

It might be the telnet filtering in action. The host responds to ping but I get nothing back on TCP/23, not even a reset.

It's still working over IPv6

Re: The Day the Telnet Died

#90

Post by neom »

erichanson wrote: post #84

I used to telnet into my POP3 account and check email by protocol. Shucks.

Your dial up ever die when you where checking your email? My ISP didn't allow for leave copy on server, I remember times I lost emails to this.
Post reply on HN