Ubuntu 上 Telnet 的安全设置与替代方案
一 基本安全原则
二 如必须使用 Telnet 的最小加固
sudo ufw allow from 192.168.1.0/24 to any port 23;同时确保已放行 SSH(22/TCP) 以免被锁死:sudo ufw allow ssh;最后启用:sudo ufw enable。sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 23 -j ACCEPT,其余来源默认丢弃:sudo iptables -A INPUT -p tcp --dport 23 -j DROP;按需保存规则(如 iptables-persistent)。pts/*),使 root 不能通过 Telnet 登录(仅影响 Telnet,不影响 SSH)。use_tcp_wrappers = yes;在 /etc/hosts.deny 写入 telnetd: ALL,在 /etc/hosts.allow 仅放行白名单,例如:telnetd: 192.168.1.100、telnetd: 192.168.1.0/24。sudo systemctl stop telnet.socket、sudo systemctl disable telnet.socket;验证状态:sudo systemctl status telnet.socket。如不再需要,可卸载相关包:sudo apt-get remove --purge xinetd telnetd(卸载前确保有其他远程管理方式)。三 更安全的替代与迁移
sudo apt install openssh-server、sudo systemctl start ssh、sudo systemctl enable ssh;防火墙放行:sudo ufw allow ssh。PermitRootLogin no、PasswordAuthentication no(配合密钥登录)、必要时更改端口(如 Port 2222),然后重启:sudo systemctl restart ssh。sudo apt install stunnel4;示例 /etc/stunnel/stunnel.conf:[telnet-tls]
accept = 2323
connect = 127.0.0.1:23
cert = /etc/ssl/certs/ssl-cert-snakeoil.pem
key = /etc/ssl/private/ssl-cert-snakeoil.key
启动:sudo systemctl start stunnel4、sudo systemctl enable stunnel4;仅允许本地或跳板机访问 2323/TCP,外网不直接暴露 23/TCP。四 快速配置示例
sudo ufw allow from 192.168.1.0/24 to any port 23
sudo ufw allow ssh
sudo ufw enable
sudo sed -i '/^tty/d' /etc/securetty # 简单示例:删除所有 tty 行
echo "telnetd: ALL" | sudo tee /etc/hosts.deny
echo "telnetd: 192.168.1.0/24" | sudo tee -a /etc/hosts.allow
sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
cat >>/etc/fail2ban/jail.local <<'EOF'
[telnet]
enabled = true
port = telnet
filter = telnetd
logpath = /var/log/auth.log
maxretry = 3
bantime = 600
EOF
sudo systemctl restart fail2ban
sudo ufw status
sudo systemctl status telnet.socket
sudo fail2ban-client status telnet
sudo systemctl disable --now telnet.socket
sudo apt-get remove --purge xinetd telnetd