1.\" Copyright (c) 1983, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)telnetd.8 8.3 (Berkeley) 3/1/94 33.\" $FreeBSD: src/libexec/telnetd/telnetd.8,v 1.16.2.7 2001/08/16 10:44:21 ru Exp $ 34.\" $DragonFly: src/libexec/telnetd/telnetd.8,v 1.3 2006/02/17 19:33:32 swildner Exp $ 35.\" 36.Dd March 1, 1994 37.Dt TELNETD 8 38.Os 39.Sh NAME 40.Nm telnetd 41.Nd DARPA 42.Tn TELNET 43protocol server 44.Sh SYNOPSIS 45.Nm /usr/libexec/telnetd 46.Op Fl Uhlkns 47.Op Fl D Ar debugmode 48.Op Fl I Ns Ar initid 49.Op Fl S Ar tos 50.Op Fl X Ar authtype 51.Op Fl a Ar authmode 52.Op Fl edebug 53.Op Fl p Ar loginprog 54.Op Fl r Ns Ar lowpty-highpty 55.Op Fl u Ar len 56.Op Fl debug Op Ar port 57.Sh DESCRIPTION 58The 59.Nm 60command is a server which supports the 61.Tn DARPA 62standard 63.Tn TELNET 64virtual terminal protocol. 65.Nm Telnetd 66is normally invoked by the internet server (see 67.Xr inetd 8 ) 68for requests to connect to the 69.Tn TELNET 70port as indicated by the 71.Pa /etc/services 72file (see 73.Xr services 5 ) . 74The 75.Fl debug 76option may be used to start up 77.Nm 78manually, instead of through 79.Xr inetd 8 . 80If started up this way, 81.Ar port 82may be specified to run 83.Nm 84on an alternate 85.Tn TCP 86port number. 87.Pp 88The 89.Nm 90command accepts the following options: 91.Bl -tag -width indent 92.It Fl a Ar authmode 93This option may be used for specifying what mode should 94be used for authentication. 95Note that this option is only useful if 96.Nm 97has been compiled with support for the 98.Dv AUTHENTICATION 99option. 100There are several valid values for 101.Ar authmode : 102.Bl -tag -width debug 103.It Cm debug 104Turn on authentication debugging code. 105.It Cm user 106Only allow connections when the remote user 107can provide valid authentication information 108to identify the remote user, 109and is allowed access to the specified account 110without providing a password. 111.It Cm valid 112Only allow connections when the remote user 113can provide valid authentication information 114to identify the remote user. 115The 116.Xr login 1 117command will provide any additional user verification 118needed if the remote user is not allowed automatic 119access to the specified account. 120.It Cm other 121Only allow connections that supply some authentication information. 122This option is currently not supported 123by any of the existing authentication mechanisms, 124and is thus the same as specifying 125.Fl a 126.Cm valid . 127.It Cm none 128This is the default state. 129Authentication information is not required. 130If no or insufficient authentication information 131is provided, then the 132.Xr login 1 133program will provide the necessary user 134verification. 135.It Cm off 136Disable the authentication code. 137All user verification will happen through the 138.Xr login 1 139program. 140.El 141.It Fl D Ar debugmode 142This option may be used for debugging purposes. 143This allows 144.Nm 145to print out debugging information 146to the connection, allowing the user to see what 147.Nm 148is doing. 149There are several possible values for 150.Ar debugmode : 151.Bl -tag -width exercise 152.It Cm options 153Print information about the negotiation of 154.Tn TELNET 155options. 156.It Cm report 157Print the 158.Cm options 159information, plus some additional information 160about what processing is going on. 161.It Cm netdata 162Display the data stream received by 163.Nm . 164.It Cm ptydata 165Display data written to the pty. 166.It Cm exercise 167Has not been implemented yet. 168.El 169.It Fl debug 170Enable debugging on each socket created by 171.Nm 172(see 173.Dv SO_DEBUG 174in 175.Xr socket 2 ) . 176.It Fl edebug 177If 178.Nm 179has been compiled with support for data encryption, then the 180.Fl edebug 181option may be used to enable encryption debugging code. 182.It Fl p Ar loginprog 183Specify an alternate 184.Xr login 1 185command to run to complete the login. The alternate command must 186understand the same command arguments as the standard login. 187.It Fl h 188Disable the printing of host-specific information before 189login has been completed. 190.It Fl I Ar initid 191This option is only applicable to 192.Tn UNICOS 193systems prior to 7.0. 194It specifies the 195.Dv ID 196from 197.Pa /etc/inittab 198to use when init starts login sessions. The default 199.Dv ID 200is 201.Dv fe . 202.It Fl k 203This option is only useful if 204.Nm 205has been compiled with both linemode and kludge linemode 206support. If the 207.Fl k 208option is specified, then if the remote client does not 209support the 210.Dv LINEMODE 211option, then 212.Nm 213will operate in character at a time mode. 214It will still support kludge linemode, but will only 215go into kludge linemode if the remote client requests 216it. 217(This is done by the client sending 218.Dv DONT SUPPRESS-GO-AHEAD 219and 220.Dv DONT ECHO . ) 221The 222.Fl k 223option is most useful when there are remote clients 224that do not support kludge linemode, but pass the heuristic 225(if they respond with 226.Dv WILL TIMING-MARK 227in response to a 228.Dv DO TIMING-MARK ) 229for kludge linemode support. 230.It Fl l 231Specify line mode. Try to force clients to use line- 232at-a-time mode. 233If the 234.Dv LINEMODE 235option is not supported, it will go 236into kludge linemode. 237.It Fl n 238Disable 239.Dv TCP 240keep-alives. Normally 241.Nm 242enables the 243.Tn TCP 244keep-alive mechanism to probe connections that 245have been idle for some period of time to determine 246if the client is still there, so that idle connections 247from machines that have crashed or can no longer 248be reached may be cleaned up. 249.It Fl r Ar lowpty-highpty 250This option is only enabled when 251.Nm 252is compiled for 253.Dv UNICOS . 254It specifies an inclusive range of pseudo-terminal devices to 255use. If the system has sysconf variable 256.Dv _SC_CRAY_NPTY 257configured, the default pty search range is 0 to 258.Dv _SC_CRAY_NPTY ; 259otherwise, the default range is 0 to 128. Either 260.Ar lowpty 261or 262.Ar highpty 263may be omitted to allow changing 264either end of the search range. If 265.Ar lowpty 266is omitted, the - character is still required so that 267.Nm 268can differentiate 269.Ar highpty 270from 271.Ar lowpty . 272.It Fl s 273This option is only enabled if 274.Nm 275is compiled with support for 276.Tn SecurID 277cards. 278It causes the 279.Fl s 280option to be passed on to 281.Xr login 1 , 282and thus is only useful if 283.Xr login 1 284supports the 285.Fl s 286flag to indicate that only 287.Tn SecurID 288validated logins are allowed, and is 289usually useful for controlling remote logins 290from outside of a firewall. 291.It Fl S Ar tos 292.It Fl u Ar len 293This option is used to specify the size of the field 294in the 295.Dv utmp 296structure that holds the remote host name. 297If the resolved host name is longer than 298.Ar len , 299the dotted decimal value will be used instead. 300This allows hosts with very long host names that 301overflow this field to still be uniquely identified. 302Specifying 303.Fl u0 304indicates that only dotted decimal addresses 305should be put into the 306.Pa utmp 307file. 308.It Fl U 309This option causes 310.Nm 311to refuse connections from addresses that 312cannot be mapped back into a symbolic name 313via the 314.Xr gethostbyaddr 3 315routine. 316.It Fl X Ar authtype 317This option is only valid if 318.Nm 319has been built with support for the authentication option. 320It disables the use of 321.Ar authtype 322authentication, and 323can be used to temporarily disable 324a specific authentication type without having to recompile 325.Nm . 326.El 327.Pp 328.Nm Telnetd 329operates by allocating a pseudo-terminal device (see 330.Xr pty 4 ) 331for a client, then creating a login process which has 332the slave side of the pseudo-terminal as 333.Dv stdin , 334.Dv stdout 335and 336.Dv stderr . 337.Nm Telnetd 338manipulates the master side of the pseudo-terminal, 339implementing the 340.Tn TELNET 341protocol and passing characters 342between the remote client and the login process. 343.Pp 344When a 345.Tn TELNET 346session is started up, 347.Nm 348sends 349.Tn TELNET 350options to the client side indicating 351a willingness to do the 352following 353.Tn TELNET 354options, which are described in more detail below: 355.Bd -literal -offset indent 356DO AUTHENTICATION 357WILL ENCRYPT 358DO TERMINAL TYPE 359DO TSPEED 360DO XDISPLOC 361DO NEW-ENVIRON 362DO ENVIRON 363WILL SUPPRESS GO AHEAD 364DO ECHO 365DO LINEMODE 366DO NAWS 367WILL STATUS 368DO LFLOW 369DO TIMING-MARK 370.Ed 371.Pp 372The pseudo-terminal allocated to the client is configured 373to operate in 374.Dq cooked 375mode, and with 376.Dv XTABS and 377.Dv CRMOD 378enabled (see 379.Xr tty 4 ) . 380.Pp 381.Nm Telnetd 382has support for enabling locally the following 383.Tn TELNET 384options: 385.Bl -tag -width "DO AUTHENTICATION" 386.It "WILL ECHO" 387When the 388.Dv LINEMODE 389option is enabled, a 390.Dv WILL ECHO 391or 392.Dv WONT ECHO 393will be sent to the client to indicate the 394current state of terminal echoing. 395When terminal echo is not desired, a 396.Dv WILL ECHO 397is sent to indicate that 398.Nm 399will take care of echoing any data that needs to be 400echoed to the terminal, and then nothing is echoed. 401When terminal echo is desired, a 402.Dv WONT ECHO 403is sent to indicate that 404.Nm 405will not be doing any terminal echoing, so the 406client should do any terminal echoing that is needed. 407.It "WILL BINARY" 408Indicate that the client is willing to send a 4098 bits of data, rather than the normal 7 bits 410of the Network Virtual Terminal. 411.It "WILL SGA" 412Indicate that it will not be sending 413.Dv IAC GA , 414go ahead, commands. 415.It "WILL STATUS" 416Indicate a willingness to send the client, upon 417request, of the current status of all 418.Tn TELNET 419options. 420.It "WILL TIMING-MARK" 421Whenever a 422.Dv DO TIMING-MARK 423command is received, it is always responded 424to with a 425.Dv WILL TIMING-MARK . 426.It "WILL LOGOUT" 427When a 428.Dv DO LOGOUT 429is received, a 430.Dv WILL LOGOUT 431is sent in response, and the 432.Tn TELNET 433session is shut down. 434.It "WILL ENCRYPT" 435Only sent if 436.Nm 437is compiled with support for data encryption, and 438indicates a willingness to decrypt 439the data stream. 440.El 441.Pp 442.Nm Telnetd 443has support for enabling remotely the following 444.Tn TELNET 445options: 446.Bl -tag -width "DO AUTHENTICATION" 447.It "DO BINARY" 448Sent to indicate that 449.Nm 450is willing to receive an 8 bit data stream. 451.It "DO LFLOW" 452Requests that the client handle flow control 453characters remotely. 454.It "DO ECHO" 455This is not really supported, but is sent to identify a 456.Bx 4.2 457.Xr telnet 1 458client, which will improperly respond with 459.Dv WILL ECHO . 460If a 461.Dv WILL ECHO 462is received, a 463.Dv DONT ECHO 464will be sent in response. 465.It "DO TERMINAL-TYPE" 466Indicate a desire to be able to request the 467name of the type of terminal that is attached 468to the client side of the connection. 469.It "DO SGA" 470Indicate that it does not need to receive 471.Dv IAC GA , 472the go ahead command. 473.It "DO NAWS" 474Requests that the client inform the server when 475the window (display) size changes. 476.It "DO TERMINAL-SPEED" 477Indicate a desire to be able to request information 478about the speed of the serial line to which 479the client is attached. 480.It "DO XDISPLOC" 481Indicate a desire to be able to request the name 482of the X Window System display that is associated with 483the telnet client. 484.It "DO NEW-ENVIRON" 485Indicate a desire to be able to request environment 486variable information, as described in RFC 1572. 487.It "DO ENVIRON" 488Indicate a desire to be able to request environment 489variable information, as described in RFC 1408. 490.It "DO LINEMODE" 491Only sent if 492.Nm 493is compiled with support for linemode, and 494requests that the client do line by line processing. 495.It "DO TIMING-MARK" 496Only sent if 497.Nm 498is compiled with support for both linemode and 499kludge linemode, and the client responded with 500.Dv WONT LINEMODE . 501If the client responds with 502.Dv WILL TM , 503the it is assumed that the client supports 504kludge linemode. 505Note that the 506.Op Fl k 507option can be used to disable this. 508.It "DO AUTHENTICATION" 509Only sent if 510.Nm 511is compiled with support for authentication, and 512indicates a willingness to receive authentication 513information for automatic login. 514.It "DO ENCRYPT" 515Only sent if 516.Nm 517is compiled with support for data encryption, and 518indicates a willingness to decrypt 519the data stream. 520.El 521.Sh NOTES 522By default 523.Nm 524will read the 525.Em \&he , 526.Em \&hn , 527and 528.Em \&im 529capabilities from 530.Pa /etc/gettytab 531and use that information (if present) to determine 532what to display before the login: prompt. You can 533also use a System V style 534.Pa /etc/issue 535file by using the 536.Em \&if 537capability, which will override 538.Em \&im . 539The information specified in either 540.Em \&im 541or 542.Em \&if 543will be displayed to both console and remote logins. 544.\" .Sh ENVIRONMENT 545.Sh FILES 546.Bl -tag -width /usr/ucb/bftp -compact 547.It Pa /etc/services 548.It Pa /etc/gettytab 549.It Pa /etc/inittab 550(UNICOS systems only) 551.It Pa /etc/iptos 552(if supported) 553.It Pa /usr/ucb/bftp 554(if supported) 555.El 556.Sh "SEE ALSO" 557.Xr bftp 1 , 558.Xr login 1 , 559.Xr gettytab 5 , 560.Xr telnet 1 561(if supported) 562.Sh STANDARDS 563.Bl -tag -compact -width RFC-1572 564.It Cm RFC-854 565.Tn TELNET 566PROTOCOL SPECIFICATION 567.It Cm RFC-855 568TELNET OPTION SPECIFICATIONS 569.It Cm RFC-856 570TELNET BINARY TRANSMISSION 571.It Cm RFC-857 572TELNET ECHO OPTION 573.It Cm RFC-858 574TELNET SUPPRESS GO AHEAD OPTION 575.It Cm RFC-859 576TELNET STATUS OPTION 577.It Cm RFC-860 578TELNET TIMING MARK OPTION 579.It Cm RFC-861 580TELNET EXTENDED OPTIONS - LIST OPTION 581.It Cm RFC-885 582TELNET END OF RECORD OPTION 583.It Cm RFC-1073 584Telnet Window Size Option 585.It Cm RFC-1079 586Telnet Terminal Speed Option 587.It Cm RFC-1091 588Telnet Terminal-Type Option 589.It Cm RFC-1096 590Telnet X Display Location Option 591.It Cm RFC-1123 592Requirements for Internet Hosts -- Application and Support 593.It Cm RFC-1184 594Telnet Linemode Option 595.It Cm RFC-1372 596Telnet Remote Flow Control Option 597.It Cm RFC-1416 598Telnet Authentication Option 599.It Cm RFC-1411 600Telnet Authentication: Kerberos Version 4 601.It Cm RFC-1412 602Telnet Authentication: SPX 603.It Cm RFC-1571 604Telnet Environment Option Interoperability Issues 605.It Cm RFC-1572 606Telnet Environment Option 607.El 608.Sh HISTORY 609IPv6 support was added by WIDE/KAME project. 610.Sh BUGS 611Some 612.Tn TELNET 613commands are only partially implemented. 614.Pp 615Because of bugs in the original 616.Bx 4.2 617.Xr telnet 1 , 618.Nm 619performs some dubious protocol exchanges to try to discover if the remote 620client is, in fact, a 621.Bx 4.2 622.Xr telnet 1 . 623.Pp 624Binary mode 625has no common interpretation except between similar operating systems 626(Unix in this case). 627.Pp 628The terminal type name received from the remote client is converted to 629lower case. 630.Pp 631.Nm Telnetd 632never sends 633.Tn TELNET 634.Dv IAC GA 635(go ahead) commands. 636