Use SRP to establish secure LinuxTelnet Server 2

Article Title: Use SRP to establish secure LinuxTelnet Server 2. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
(8) The PAM Authentication Module provides authentication information to applications through the PAM library.
　　
(9) after the authentication is completed, the application has two options:
　　
Grant the required permissions to the user and notify the user.
　　
The authentication fails and the user is notified.
　　
For PAM workflow, see.
　　
　　 PAM Workflow
　　
PAM usage:
　　
# Cd/usr/src/redhat/SOURCES
/Srp-2.1.1/base/pam_eps.
# Install-m 644 pam_eps_auth.
So pam_eps_passwd.so/lib/security
　　
The above command installs the PAM module in the/lib/security directory. Run the "/usr/local/bin/tconf" command to create the/etc/tpasswd and/etc/tpasswd. conf files.
　　
2. Use the eps pam module for password verification
　　
(1) first back up the/etc/pam. d/system-auth file
　　
(2) modify the/etc/pam. d/system-auth file in the following format:
Auth required/lib/security/pam_unix.so likeauth
Nullok md5 shadow
Auth sufficient/lib/security/pam_eps_auth.so
Auth required/lib/security/pam_deny.so
Account sufficient/lib/security/pam_unix.so
Account required/lib/security/pam_deny.so
Password required/lib/security/pam_cracklib.so retry = 3
Password required/lib/security/pam_eps_passwd.so
Password sufficient/lib/security/pam_unix.so
Nullok use_authtok md5 shadow
Password required/lib/security/pam_deny.so
Session required/lib/security/pam_limits.so
Session required/lib/security/pam_unix.so
　　
Note that the first line in bold indicates that the PAM eps_auth module can meet the authentication requirements. The second line in bold indicates that the pam_eps_passwd.so module of PAM is used for password management.
　　
(3) convert the standard password to the EPS format
　　
(4) The module pam_eps_passwd.so in the/etc/pam. d/system-auth configuration file writes the password verification string of the EPS version to the/etc/tpasswd file. Modify the/etc/pam. dpasswd file in the following format:
Auth required/lib/security/pam_stack.so
Service = system-auth
Account required/lib/security/pam_stack.so
Service = system-auth
Password required/lib/security/pam_stack.so
Service = system-auth
　　
　　 4. Start the Telnet server in the SRP version
　　
(1) Go to the SRP source code telnet subdirectory and create the Telnet Server File and the Telnet client file respectively:
# Cd/usr/src/redhat/sourceces/srp-2.2.1/telnet
# Make; make install
　　
(2) create a super Access Program/etc/xinetd. d/srp-telnetd with the following content:
# Description: The SRP Telnet server
Serves Telnet connections.
# It uses SRP for authentication.
Service telnet {
Socket_type = stream
Wait = no
User = root
Server =/usr/local/sbin/telnetd
Log_on_success + = DURATION USERID
Log_on_failure + = USERID
Nice = 10
Disable = no}
　　
(3) Use the command to start xinetd again
# Killall-USR1 xinetd
　　
(4) create a/etc/pam. d/telnet file with the following content:
Auth required/lib/security/pam_listfile.so item = user sense = deny file =/etc/telnetusers onerr = succeed
Auth required/lib/security/pam_stack.so service = srp-telnet
Auth required/lib/security/pam_shells.so
Account required/lib/security/pam_stack.so service = srp-telnet
Session required/lib/security/pam_stack.so service = srp-telnet
　　
So far, a Telnet server using the SRP service has been established. First, perform a local test. The following is a typical session:
$/Usr/local/bin/telnet localhost 23
Trying 127.0.0.1...
Connected to localhost.intevo.com (127.0.0.1 ).
Escape character is '^]'.
[Trying SRP...]
SRP Username (root): cao
[Using 1024-bit modulus for 'CA']
SRP Password:
[SRP authentication successful]
[Input is now decrypted with type CAST128_CFB64]
[Output is now encrypted with type CAST128_CFB64]
Last login: Tue Dec 21 09:30:08 from cao.net
　　
If you want to telnet to the SRP server on another Linux computer, you need to install the SRP service support and SRP client software. The method is the same as on the SRP server.
　　
　　 5. Use the SRP client on a non-Linux platform
　　
SRP also supports other popular operating systems (Unix, BSD, Winodws, and MacOS ). You only need to install the Java Plug-in browser. View the relevant web site: http://srp.stanford.edu/demo/ before details.
　　
Summary:
　　
The above provides a more secure and fast Telnet method than OPENSSH for remote Linux servers. The SRP-based Telnet application is similar to other network applications in the client/server model. Once connected, the client can enjoy all the services provided by the server. The SRP software package is Telnet security software.