How to manage Telnet servers (1)

To effectively protect the security of the Telnet server, we have added authorization, authentication, and other effective measures to its system. Here we will introduce the Identity Authentication System of the Telnet server. Let's take a look at the Administrator's management configuration process. For details, see the text.

Configure the Telnet server to allow access by the Administrator using Password Authentication

Application to: Windows Server 2008, Windows Vista

You can use this process to allow users who log on as members of the local Administrators Group and use the password to authenticate their management permissions during the Telnet session.

Windows Vista and Windows Server 2008 introduce User Account Control (UAC) to improve security based on whether you are logged on as a member of the local Administrators Group. UAC also affects the use of management permissions in Telnet sessions.

Membership or equivalent identity in the Local Administrators Group is the minimum requirement to complete this process.

By default, users who log on to the remote Telnet server using NTLM identity authentication can use their management permissions.

When you connect to the Telnet server using password authentication, the filter token is based on the following three conditions:

Whether the security account used to start the Telnet service is a local service or LocalSystem.

Whether the user account is a domain account or a local account of the Telnet server.

Whether the registry key value of LocalAccountTokenFilterPolicy is 0 or 1.

The default password is "password ".

The following table shows the possible combination of these factors when a password authentication is used to connect to the remote Telnet server. A short line in the cell indicates that the setting does not exist.

RunTelnet Service Security Account	User Account type	LocalAccountTokenFilterPolicy registry key value	The generated token is
Local Service	-	-	Filtered
LocalSystem	Domain	-	Complete
LocalSystem	Local	0	Filtered
LocalSystem	Local	1	Complete

Membership or equivalent identity in the Local Administrators Group is the minimum requirement to complete this process.

To set the registry key value of the Local Account Token Filter Policy

Start Registry Editor. Click Start, type regedit in the Start search box, and then press Enter.

If the "User Account Control" dialog box appears, confirm that the operation you want to perform is displayed, and click "continue ".

Open the registry key:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System

If the entry LocalAccountTokenFilterPolicy does not exist, right-click "system" and choose "edit", "new", and "DWORD (32-bit) value ". type the name LocalAccountTokenFilterPolicy and set its value to 1.

This entry is valid only when the Telnet service is running in the LocalSystem context.

To run Telnet using a local service security account

Stop the Telnet service.

On the "Telnet properties" dialog box in the "service" Management Unit, click the "login" tab.

In "Logon identity", click "this account", and then type "local service" in the text box ".

In the "password" and "Confirm Password" text boxes, type the Administrator account password.

Click OK to save the changes.

Open Registry Editor. Click Start, type regedit in the Start search box, and then press Enter.

If the "User Account Control" dialog box appears, confirm that the operation you want to perform is displayed, and click "continue ".