I don't want SunOS 5.8 to appear when someone logs into my machine... how do I go about changing the banner?
I was thumbing through my unix books and I haven't found anything... I'm probably looking under the wrong topic...
anyways... any help would be greatly appreciated.
Try edit /etc/motd
hmmm... that didn't work... still says "SunOS 5.8" when you open a telnet session to the box....
i tried editing /etc/issue, but that only added something to the login prompt.
any other ideas?
/etc/issue
Get more information in:
http://www.enteract.com/~lspitz/armoring.html
In my SCO Unixware 7 system in.telnetd daemon have -h key, but this key remove greeting message of telnet server at all
Best regards
The answer is in http://www.enteract.com/~lspitz/armoring.html. And it is specific to Solaris - that's a great write-up for any SunOS user, new or not...
in Solaris follow these steps to clear the telnet banners:
first go to /etc/default directory
# cd /etc/default
if this file does not exist then creat this file and type the banner
variable in that file
# vi telnetd
BANNER=""
save the file and exit
logout and login via telnet
i hope this helps
ta ta:D
Hi, try this out.
goto /etc/default
You will find "telnetd" file(if not create it default permissions)
write this:
BANNER="Welcome to my machine or whatever"
This should help.
I've read the previous posts and have followed the steps outlined in http://www.enteract.com/~lspitz/armoring.html, yet I still can see that the system is using SVR4.
I created the telnetd file in /etc/default My sole entry in the file is:
BANNER=""
Any assistance would be greatly appreciated!
This might be off topic, but why not chunk telnetd all together in favor of sshd? Sending passwords across telnet is dangerous.
Saluja,
What version of Solaris are you using and is it Sparc or Intel?
I created the banner after running telnet and this was what I got (on Solaris 2.6 {sparc}):
# telnet some1
Trying 10.14.1.2...
Connected to some1.
Escape character is '^]'.
SunOS 5.6
Warning ! This system is for use only by persons authorized by Inc. By accessing this system you are consenting to system
monitoring for law enforcement and other purposes. Unauthorized use of this
system may subject you to criminal prosecution and penalties.
login:
# ls -l /etc/default/tel*
-rw-r--r-- 1 root other 10 Aug 20 1:44 /etc/default/telnetd
# cat /etc/default/telnetd
BANNER=""
# telnet some1
Trying 10.14.1.2...
Connected to some1.
Escape character is '^]'.
Warning ! This system is for use only by persons authorized by Inc. By accessing this system you are consenting to system
monitoring for law enforcement and other purposes. Unauthorized use of this
system may subject you to criminal prosecution and penalties.
login: Connection closed by foreign host.
Running SunOS 5.5.1 on a Sparc
As soon as I telnet to the box I get:
UNIX(r) System V Release 4.0
Not sure if I was reading your post correctly, but I tried modifying the telnetd file from my own session - didn't help. Also tried deleting the old telnetd file, rebooting system, and recreating the telnetd file - no joy here either.
Any other suggestions?
The banner option is supported on Solaris 2.6 and above. There is no work around for 2.5.1 and below. You would have to live with it or upgrade.
1st let me talk to my friend Auswipe.
Telnet is perfectly fine in a trusted network. I also work for a large company(telecom) and we have a "secure" firewall. I know what you are saying about sniffers gaining passwds over telnet, but telnet is a fairly safe way to do business in a "secure" environment.
NOW TO THE TOPIC AT HAND.
***************************
MY 2 cents... I know your question is regarding SUN, and my box is HPUX but there is another banner that is used.
/usr/localcw/opt/sysguard/banners
You might look under the directory /usr and search for a file with "banner" in the name.
The files that are under /etc are used on my box only for the bootup screens: namely /etc/issue and /etc/copyright.
Hope this helps even though it is HP and not SUN.
Sorry Kelam but I would have to agree with Auswipe on ssh instead of telnet. I also work in a large telecom company (you may have heard of us in the news?) and it's ssh for anything. They were burned a while back and at least they got the security going if not the finanical.
Sincerly waiting for the axe to fall,
RTM
Off topic, but......
We don't telnet period. All our servers run SSHD and not TELNETD. SSHD is easy to install and so are SSH clients for both unix and windows. Even in a 'secure enclave or network', I recommend people use SSH.
Why do remote sessions with passwords and all information in the clear when the entire session can be in a nice, easy to use, cryptographic tunnel??
Your many times more likely to have an "attack" generated or participated by someone within your company... firewalls' no good in that situation...
I can't remember the exact percentabge, but your biggest threat is already inside...
Sleep tight tonight
Okay okay... I know that SSH is a great way to secure passwords, but I wasn't around when they decided what to use. Although telnet is the standard for my company, we do have another way to protect passwords from being captured.
We use the SecurID technology that only allows for 1 time unique passwords for all users logging in to our systems. It is used with a PIN that the user has and a rotating 6 digit number that changes every 60 seconds.
I might be wrong on this, but SecurID is a very good security measure to protect passwords.
Don't get me wrong SSH is great, but my company has the SecurID technology as our enterprise solution.
Secure ID is great!
It is also a more expensive solution than SSH, which is free for the average non-commercial user.
However, secure ID does not insure the data in the session is secure; SSH does because the entire session in encrypted.
From my understanding of your Secure ID architecture, your company uses clear text passwords with Secure ID architecture to protect passwords.
If this is the case, from a cost-benefit security perspective, SSH provides a bit less password protection (it can be stolen and reused if written down, etc.) and a great deal more session protection.
If your company's risk-management profile is such that the data in the sessions are non-sensitive and breaking into the boxes are are prime concern, then Secure ID would better suit the risk profile, etc.
We could discuss this for hours...... perhaps in another thread?
search for a file called "login.cfg" shud be in /usr directory .... I did this thing on AIX .. not sure abt solaris