1.\" Copyright (c) 1983, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.man% 5.\" 6.\" @(#)telnetd.8 8.3 (Berkeley) 03/01/94 7.\" 8.Dd 9.Dt TELNETD 8 10.Os BSD 4.2 11.Sh NAME 12.Nm telnetd 13.Nd DARPA 14.Tn TELNET 15protocol server 16.Sh SYNOPSIS 17.Nm /usr/libexec/telnetd 18.Op Fl BUhlkns 19.Op Fl D Ar debugmode 20.Op Fl I Ns Ar initid 21.Op Fl S Ar tos 22.Op Fl X Ar authtype 23.Op Fl a Ar authmode 24.Op Fl edebug 25.Op Fl r Ns Ar lowpty-highpty 26.Op Fl u Ar len 27.Op Fl debug Op Ar port 28.Sh DESCRIPTION 29The 30.Nm telnetd 31command is a server which supports the 32.Tn DARPA 33standard 34.Tn TELNET 35virtual terminal protocol. 36.Nm Telnetd 37is normally invoked by the internet server (see 38.Xr inetd 8 ) 39for requests to connect to the 40.Tn TELNET 41port as indicated by the 42.Pa /etc/services 43file (see 44.Xr services 5 ) . 45The 46.Fl debug 47option may be used to start up 48.Nm telnetd 49manually, instead of through 50.Xr inetd 8 . 51If started up this way, 52.Ar port 53may be specified to run 54.Nm telnetd 55on an alternate 56.Tn TCP 57port number. 58.Pp 59The 60.Nm telnetd 61command accepts the following options: 62.Bl -tag -width "-a authmode" 63.It Fl a Ar authmode 64This option may be used for specifying what mode should 65be used for authentication. 66Note that this option is only useful if 67.Nm telnetd 68has been compiled with support for the 69.Dv AUTHENTICATION 70option. 71There are several valid values for 72.Ar authmode: 73.Bl -tag -width debug 74.It debug 75Turns on authentication debugging code. 76.It user 77Only allow connections when the remote user 78can provide valid authentication information 79to identify the remote user, 80and is allowed access to the specified account 81without providing a password. 82.It valid 83Only allow connections when the remote user 84can provide valid authentication information 85to identify the remote user. 86The 87.Xr login 1 88command will provide any additional user verification 89needed if the remote user is not allowed automatic 90access to the specified account. 91.It other 92Only allow connections that supply some authentication information. 93This option is currently not supported 94by any of the existing authentication mechanisms, 95and is thus the same as specifying 96.Fl a 97.Cm valid . 98.It none 99This is the default state. 100Authentication information is not required. 101If no or insufficient authentication information 102is provided, then the 103.Xr login 1 104program will provide the necessary user 105verification. 106.It off 107This disables the authentication code. 108All user verification will happen through the 109.Xr login 1 110program. 111.El 112.It Fl B 113Specifies bftp server mode. In this mode, 114.Nm telnetd 115causes login to start a 116.Xr bftp 1 117session rather than the user's 118normal shell. In bftp daemon mode normal 119logins are not supported, and it must be used 120on a port other than the normal 121.Tn TELNET 122port. 123.It Fl D Ar debugmode 124This option may be used for debugging purposes. 125This allows 126.Nm telnetd 127to print out debugging information 128to the connection, allowing the user to see what 129.Nm telnetd 130is doing. 131There are several possible values for 132.Ar debugmode: 133.Bl -tag -width exercise 134.It Cm options 135Prints information about the negotiation of 136.Tn TELNET 137options. 138.It Cm report 139Prints the 140.Cm options 141information, plus some additional information 142about what processing is going on. 143.It Cm netdata 144Displays the data stream received by 145.Nm telnetd. 146.It Cm ptydata 147Displays data written to the pty. 148.It Cm exercise 149Has not been implemented yet. 150.El 151.It Fl debug 152Enables debugging on each socket created by 153.Nm telnetd 154(see 155.Dv SO_DEBUG 156in 157.Xr socket 2 ) . 158.It Fl edebug 159If 160.Nm telnetd 161has been compiled with support for data encryption, then the 162.Fl edebug 163option may be used to enable encryption debugging code. 164.It Fl h 165Disables the printing of host-specific information before 166login has been completed. 167.It Fl I Ar initid 168This option is only applicable to 169.Tn UNICOS 170systems prior to 7.0. 171It specifies the 172.Dv ID 173from 174.Pa /etc/inittab 175to use when init starts login sessions. The default 176.Dv ID 177is 178.Dv fe. 179.It Fl k 180This option is only useful if 181.Nm telnetd 182has been compiled with both linemode and kludge linemode 183support. If the 184.Fl k 185option is specified, then if the remote client does not 186support the 187.Dv LINEMODE 188option, then 189.Nm telnetd 190will operate in character at a time mode. 191It will still support kludge linemode, but will only 192go into kludge linemode if the remote client requests 193it. 194(This is done by by the client sending 195.Dv DONT SUPPRESS-GO-AHEAD 196and 197.Dv DONT ECHO . ) 198The 199.Fl k 200option is most useful when there are remote clients 201that do not support kludge linemode, but pass the heuristic 202(if they respond with 203.Dv WILL TIMING-MARK 204in response to a 205.Dv DO TIMING-MARK) 206for kludge linemode support. 207.It Fl l 208Specifies line mode. Tries to force clients to use line- 209at-a-time mode. 210If the 211.Dv LINEMODE 212option is not supported, it will go 213into kludge linemode. 214.It Fl n 215Disable 216.Dv TCP 217keep-alives. Normally 218.Nm telnetd 219enables the 220.Tn TCP 221keep-alive mechanism to probe connections that 222have been idle for some period of time to determine 223if the client is still there, so that idle connections 224from machines that have crashed or can no longer 225be reached may be cleaned up. 226.It Fl r Ar lowpty-highpty 227This option is only enabled when 228.Nm telnetd 229is compiled for 230.Dv UNICOS. 231It specifies an inclusive range of pseudo-terminal devices to 232use. If the system has sysconf variable 233.Dv _SC_CRAY_NPTY 234configured, the default pty search range is 0 to 235.Dv _SC_CRAY_NPTY; 236otherwise, the default range is 0 to 128. Either 237.Ar lowpty 238or 239.Ar highpty 240may be omitted to allow changing 241either end of the search range. If 242.Ar lowpty 243is omitted, the - character is still required so that 244.Nm telnetd 245can differentiate 246.Ar highpty 247from 248.Ar lowpty . 249.It Fl s 250This option is only enabled if 251.Nm telnetd 252is compiled with support for 253.Tn SecurID 254cards. 255It causes the 256.Fl s 257option to be passed on to 258.Xr login 1 , 259and thus is only useful if 260.Xr login 1 261supports the 262.Fl s 263flag to indicate that only 264.Tn SecurID 265validated logins are allowed, and is 266usually useful for controlling remote logins 267from outside of a firewall. 268.It Fl S Ar tos 269.It Fl u Ar len 270This option is used to specify the size of the field 271in the 272.Dv utmp 273structure that holds the remote host name. 274If the resolved host name is longer than 275.Ar len , 276the dotted decimal value will be used instead. 277This allows hosts with very long host names that 278overflow this field to still be uniquely identified. 279Specifying 280.Fl u0 281indicates that only dotted decimal addresses 282should be put into the 283.Pa utmp 284file. 285.It Fl U 286This option causes 287.Nm telnetd 288to refuse connections from addresses that 289cannot be mapped back into a symbolic name 290via the 291.Xr gethostbyaddr 3 292routine. 293.It Fl X Ar authtype 294This option is only valid if 295.Nm telnetd 296has been built with support for the authentication option. 297It disables the use of 298.Ar authtype 299authentication, and 300can be used to temporarily disable 301a specific authentication type without having to recompile 302.Nm telnetd . 303.El 304.Pp 305.Nm Telnetd 306operates by allocating a pseudo-terminal device (see 307.Xr pty 4 ) 308for a client, then creating a login process which has 309the slave side of the pseudo-terminal as 310.Dv stdin , 311.Dv stdout 312and 313.Dv stderr . 314.Nm Telnetd 315manipulates the master side of the pseudo-terminal, 316implementing the 317.Tn TELNET 318protocol and passing characters 319between the remote client and the login process. 320.Pp 321When a 322.Tn TELNET 323session is started up, 324.Nm telnetd 325sends 326.Tn TELNET 327options to the client side indicating 328a willingness to do the 329following 330.Tn TELNET 331options, which are described in more detail below: 332.Bd -literal -offset indent 333DO AUTHENTICATION 334WILL ENCRYPT 335DO TERMINAL TYPE 336DO TSPEED 337DO XDISPLOC 338DO NEW-ENVIRON 339DO ENVIRON 340WILL SUPPRESS GO AHEAD 341DO ECHO 342DO LINEMODE 343DO NAWS 344WILL STATUS 345DO LFLOW 346DO TIMING-MARK 347.Ed 348.Pp 349The pseudo-terminal allocated to the client is configured 350to operate in \*(lqcooked\*(rq mode, and with 351.Dv XTABS and 352.Dv CRMOD 353enabled (see 354.Xr tty 4 ) . 355.Pp 356.Nm Telnetd 357has support for enabling locally the following 358.Tn TELNET 359options: 360.Bl -tag -width "DO AUTHENTICATION" 361.It "WILL ECHO" 362When the 363.Dv LINEMODE 364option is enabled, a 365.Dv WILL ECHO 366or 367.Dv WONT ECHO 368will be sent to the client to indicate the 369current state of terminal echoing. 370When terminal echo is not desired, a 371.Dv WILL ECHO 372is sent to indicate that 373.Tn telnetd 374will take care of echoing any data that needs to be 375echoed to the terminal, and then nothing is echoed. 376When terminal echo is desired, a 377.Dv WONT ECHO 378is sent to indicate that 379.Tn telnetd 380will not be doing any terminal echoing, so the 381client should do any terminal echoing that is needed. 382.It "WILL BINARY" 383Indicates that the client is willing to send a 3848 bits of data, rather than the normal 7 bits 385of the Network Virtual Terminal. 386.It "WILL SGA" 387Indicates that it will not be sending 388.Dv IAC GA, 389go ahead, commands. 390.It "WILL STATUS" 391Indicates a willingness to send the client, upon 392request, of the current status of all 393.Tn TELNET 394options. 395.It "WILL TIMING-MARK" 396Whenever a 397.Dv DO TIMING-MARK 398command is received, it is always responded 399to with a 400.Dv WILL TIMING-MARK 401.It "WILL LOGOUT" 402When a 403.Dv DO LOGOUT 404is received, a 405.Dv WILL LOGOUT 406is sent in response, and the 407.Tn TELNET 408session is shut down. 409.It "WILL ENCRYPT" 410Only sent if 411.Nm telnetd 412is compiled with support for data encryption, and 413indicates a willingness to decrypt 414the data stream. 415.El 416.Pp 417.Nm Telnetd 418has support for enabling remotely the following 419.Tn TELNET 420options: 421.Bl -tag -width "DO AUTHENTICATION" 422.It "DO BINARY" 423Sent to indicate that 424.Tn telnetd 425is willing to receive an 8 bit data stream. 426.It "DO LFLOW" 427Requests that the client handle flow control 428characters remotely. 429.It "DO ECHO" 430This is not really supported, but is sent to identify a 4.2BSD 431.Xr telnet 1 432client, which will improperly respond with 433.Dv WILL ECHO. 434If a 435.Dv WILL ECHO 436is received, a 437.Dv DONT ECHO 438will be sent in response. 439.It "DO TERMINAL-TYPE" 440Indicates a desire to be able to request the 441name of the type of terminal that is attached 442to the client side of the connection. 443.It "DO SGA" 444Indicates that it does not need to receive 445.Dv IAC GA, 446the go ahead command. 447.It "DO NAWS" 448Requests that the client inform the server when 449the window (display) size changes. 450.It "DO TERMINAL-SPEED" 451Indicates a desire to be able to request information 452about the speed of the serial line to which 453the client is attached. 454.It "DO XDISPLOC" 455Indicates a desire to be able to request the name 456of the X windows display that is associated with 457the telnet client. 458.It "DO NEW-ENVIRON" 459Indicates a desire to be able to request environment 460variable information, as described in RFC 1572. 461.It "DO ENVIRON" 462Indicates a desire to be able to request environment 463variable information, as described in RFC 1408. 464.It "DO LINEMODE" 465Only sent if 466.Nm telnetd 467is compiled with support for linemode, and 468requests that the client do line by line processing. 469.It "DO TIMING-MARK" 470Only sent if 471.Nm telnetd 472is compiled with support for both linemode and 473kludge linemode, and the client responded with 474.Dv WONT LINEMODE. 475If the client responds with 476.Dv WILL TM, 477the it is assumed that the client supports 478kludge linemode. 479Note that the 480.Op Fl k 481option can be used to disable this. 482.It "DO AUTHENTICATION" 483Only sent if 484.Nm telnetd 485is compiled with support for authentication, and 486indicates a willingness to receive authentication 487information for automatic login. 488.It "DO ENCRYPT" 489Only sent if 490.Nm telnetd 491is compiled with support for data encryption, and 492indicates a willingness to decrypt 493the data stream. 494.Sh ENVIRONMENT 495.Sh FILES 496.Pa /etc/services 497.br 498.Pa /etc/inittab 499(UNICOS systems only) 500.br 501.Pa /etc/iptos 502(if supported) 503.br 504.Pa /usr/ucb/bftp 505(if supported) 506.Sh "SEE ALSO" 507.Xr telnet 1 , 508.Xr login 1 , 509.Xr bftp 1 510(if supported) 511.Sh STANDARDS 512.Bl -tag -compact -width RFC-1572 513.It Cm RFC-854 514.Tn TELNET 515PROTOCOL SPECIFICATION 516.It Cm RFC-855 517TELNET OPTION SPECIFICATIONS 518.It Cm RFC-856 519TELNET BINARY TRANSMISSION 520.It Cm RFC-857 521TELNET ECHO OPTION 522.It Cm RFC-858 523TELNET SUPPRESS GO AHEAD OPTION 524.It Cm RFC-859 525TELNET STATUS OPTION 526.It Cm RFC-860 527TELNET TIMING MARK OPTION 528.It Cm RFC-861 529TELNET EXTENDED OPTIONS - LIST OPTION 530.It Cm RFC-885 531TELNET END OF RECORD OPTION 532.It Cm RFC-1073 533Telnet Window Size Option 534.It Cm RFC-1079 535Telnet Terminal Speed Option 536.It Cm RFC-1091 537Telnet Terminal-Type Option 538.It Cm RFC-1096 539Telnet X Display Location Option 540.It Cm RFC-1123 541Requirements for Internet Hosts -- Application and Support 542.It Cm RFC-1184 543Telnet Linemode Option 544.It Cm RFC-1372 545Telnet Remote Flow Control Option 546.It Cm RFC-1416 547Telnet Authentication Option 548.It Cm RFC-1411 549Telnet Authentication: Kerberos Version 4 550.It Cm RFC-1412 551Telnet Authentication: SPX 552.It Cm RFC-1571 553Telnet Environment Option Interoperability Issues 554.It Cm RFC-1572 555Telnet Environment Option 556.Sh BUGS 557Some 558.Tn TELNET 559commands are only partially implemented. 560.Pp 561Because of bugs in the original 4.2 BSD 562.Xr telnet 1 , 563.Nm telnetd 564performs some dubious protocol exchanges to try to discover if the remote 565client is, in fact, a 4.2 BSD 566.Xr telnet 1 . 567.Pp 568Binary mode 569has no common interpretation except between similar operating systems 570(Unix in this case). 571.Pp 572The terminal type name received from the remote client is converted to 573lower case. 574.Pp 575.Nm Telnetd 576never sends 577.Tn TELNET 578.Dv IAC GA 579(go ahead) commands. 580