Debian系统中Telnet服务的最佳实践
一 总体安全原则
二 安装与最小配置
sudo apt install telnetsudo apt install telnetd/etc/xinetd.d/telnet,示例:service telnet {
disable = no
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
server_args = -h
log_on_failure += USERID
}
sudo systemctl restart xinetd/etc/xinetd.d/telnet中加入only_from = <trusted_ip_or_network>。/etc/hosts.deny写入ALL: ALL,在/etc/hosts.allow写入in.telnetd: 192.168.1.0/24(示例仅放行内网网段)。log_on_success += HOST、log_on_failure += HOST,便于追踪来源与失败尝试。三 加固与加密方案
sudo ufw allow from <trusted_ip> to any port 23;如已放行全局,可先deny telnet再按需放行。DROP全局23/tcp,再对受信源ACCEPT。su或sudo提权;结合PAM/登录策略限制root远程登录能力。sudo apt-get install stunnel4/etc/stunnel/stunnel.conf:[telnet]
accept = 23
connect = 127.0.0.1:23
cert = /etc/stunnel/stunnel.pem
sudo openssl req -new -x509 -days 365 -nodes -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pemsudo systemctl start stunnel4 && sudo systemctl enable stunnel4sudo apt update && sudo apt upgrade四 性能与运维要点
wait/flags与日志级别,平衡性能与可观测性。/etc/sysctl.conf:net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_keepalive_intvl = 10
net.ipv4.tcp_keepalive_probes = 6
net.core.somaxconn = 128
应用:sudo sysctl -p/etc/security/limits.conf:* soft nofile 65536
* hard nofile 65536
/var/log/*中与telnet相关的日志(由xinetd、TCP Wrappers、stunnel输出),对异常来源IP、失败登录激增设置告警。五 替代方案与迁移步骤
sudo apt install openssh-server openssh-client/etc/ssh/sshd_config):
PermitRootLogin noPubkeyAuthentication yesPasswordAuthentication no(在确保公钥已分发且可用后再关闭口令)AllowUsers <userlist>(按需限制可登录用户)sudo systemctl restart sshsudo systemctl stop xinetd && sudo systemctl disable xinetdsudo systemctl stop inetd && sudo systemctl disable inetdsudo ufw deny 23/tcp 或删除对应iptables规则。