[wip] telnetd: init module #40160

teto · 2018-05-08T02:30:19Z

Motivation for this change

I am trying to package mininet, which I believe rely on mininet.
Eitherway it doesn't hurt to have a telnet module.

It doesn't seem to work though, I can't connect to it via telnet 127.0.0.1. journalctl -b doesn't show any error. I wonder if that's firewall related

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

GrahamcOfBorg · 2018-05-08T02:44:26Z

Success on x86_64-linux (full log)

Attempted: telnet

Partial log (click to expand)

these paths will be fetched (0.07 MiB download, 0.18 MiB unpacked):
  /nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2
copying path '/nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2' from 'https://cache.nixos.org'...
/nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2

GrahamcOfBorg · 2018-05-08T02:44:28Z

Success on aarch64-linux (full log)

Attempted: telnet

Partial log (click to expand)

these paths will be fetched (0.06 MiB download, 0.18 MiB unpacked):
  /nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2
copying path '/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2' from 'https://cache.nixos.org'...
/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2

jtojnar · 2018-05-08T03:01:20Z

nixos/modules/services/web-servers/telnet.nix

+    networking.firewall.allowedUDPPorts =  [ cfg.port ];
+
+    users.extraUsers.telnetd.uid = config.ids.uids.telnetd;
+    users.extraGroups.telnetd.gid = config.ids.gids.telnetd;


Why does telnet need static id?

It doesn't I guess. I copied other modules but why do other services need a static id either ?

They need static uids to avoid having to adjust the owner of large amount of files on service startup.

Yes, but does telnet create any files of its own?

not that I know

Mic92 · 2018-05-08T06:22:43Z

nixos/modules/services/web-servers/telnet.nix

+
+  config = mkIf config.services.telnet.enable {
+
+    networking.firewall.allowedUDPPorts =  [ cfg.port ];


Should this not be tcp?

Firewall ports should not be opened by default. Please add a dedicated option for that: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix#L140

it should ! still remember the nagle lesson with telnet thanks

The option on the link you mention defaults to true so it doesn't add much security :s

yes. ssh is the only service where we make it true by default. All other services defaults to false.

This is a convention we have for nixos and exception might surprise users.

ok I fixed it

Mic92 · 2018-05-08T06:23:11Z

nixos/modules/services/web-servers/telnet.nix

+    };
+
+    port = mkOption {
+      default = 12345;


default port for telnet is 23.

Mic92 · 2018-05-08T06:27:37Z

nixos/modules/services/web-servers/telnet.nix

+      default = false;
+      type = types.bool;
+      description = ''
+        Enable telnetd.


I am not sure if we should put a warning here since due missing encryption telnet should be only used in trusted networks. Also your mininet example might be about man-in-the-middle attacks on telnet.

teto · 2018-05-08T08:21:12Z

It doesn't seem to bind though I gave the module CAP_NET_BIND_SERVICE capability (later tried with =+ep)
telnetd[28847]: bind: Permission denied

jtojnar · 2018-05-08T21:49:01Z

nixos/modules/misc/ids.nix

@@ -307,6 +307,7 @@
      duplicati = 289;
      monetdb = 290;
      restic = 291;
+      telnetd = 292;


This is not used anymore

matthewbauer · 2018-05-09T06:33:50Z

@GrahamcOfBorg eval

GrahamcOfBorg · 2018-05-09T06:46:21Z

Success on aarch64-linux (full log)

Attempted: telnet

Partial log (click to expand)

these paths will be fetched (0.06 MiB download, 0.18 MiB unpacked):
  /nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2
copying path '/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2' from 'https://cache.nixos.org'...
/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2

GrahamcOfBorg · 2018-05-09T06:46:21Z

Success on x86_64-linux (full log)

Attempted: telnet

Partial log (click to expand)

/nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2

teto · 2018-05-09T06:49:14Z

for some reason telnetd can't bind even though it has the capability and though I set Restart="always", the service won't restart on nixos-rebuild so it's not easy to test. It seems like busybox binds to ipv6 first so I added (locally a -b 127.0.0.1)

GrahamcOfBorg · 2018-05-09T10:02:33Z

Success on aarch64-linux (full log)

Attempted: telnet

Partial log (click to expand)

/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2

GrahamcOfBorg · 2018-05-09T10:02:44Z

Success on x86_64-linux (full log)

Attempted: telnet

Partial log (click to expand)

/nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2

Mic92 · 2018-05-14T09:52:52Z

The problem was that telnetd was forking:

Either use Type=forking or pass the -F flag to telnetd:

diff --git a/nixos/modules/services/web-servers/telnet.nix b/nixos/modules/services/web-servers/telnet.nix
index ce21c480794..7fc527e42c9 100644
--- a/nixos/modules/services/web-servers/telnet.nix
+++ b/nixos/modules/services/web-servers/telnet.nix
@@ -4,11 +4,7 @@ with lib;
 
 let
   cfg = config.services.telnet;
-
-  user = "telnetd";
-in
-{
-
+in {
   options.services.telnet = {
 
     enable = mkOption {
@@ -42,34 +38,24 @@ in
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
 
     users.extraUsers = singleton {
-      name = user;
+      name = "telnetd";
       group = "telnetd";
       description = "Telnet daemon";
     };
 
-    # users.extraGroups = singleton {
-    #   name = "telnetd";
-    # };
+    users.extraGroups = singleton {
+      name = "telnetd";
+    };
 
     systemd.services.telnetd = {
       description = "Telnet server";
       wantedBy = [ "multi-user.target" ];
 
-      # binds by default to ipv6 ?
-      # script = "${pkgs.busybox}/bin/telnetd -p ${toString cfg.port} -b 127.0.0.1";
-
       serviceConfig = {
-        # defaults to ipv6 otherwise ?
-        ExecStart="${pkgs.busybox}/bin/telnetd -p ${toString cfg.port} -b 127.0.0.1";
-        User = user;
+        ExecStart="${pkgs.busybox}/bin/telnetd -p ${toString cfg.port} -F";
+        User = "telnetd";
         Group = "telnetd";
-        AmbientCapabilities="CAP_NET_BIND_SERVICE";
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE=+eip";
-        # RuntimeDirectory = [ "telnetd" ];
-        Restart = "always";
-        RestartSec = "500ms";
-        # StartLimitInterval = 86400;
-        StartLimitBurst = 5;
+        AmbientCapabilities = "cap_net_bind_service";
       };
     };
   };

However I still cannot login.

GrahamcOfBorg · 2018-05-15T02:41:11Z

Success on aarch64-linux (full log)

Attempted: telnet

Partial log (click to expand)

these paths will be fetched (0.06 MiB download, 0.18 MiB unpacked):
  /nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2
copying path '/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2' from 'https://cache.nixos.org'...
/nix/store/gs2l6q78kjp08r7z783p1xck24c8hx08-telnet-1.2

GrahamcOfBorg · 2018-05-15T02:41:19Z

Success on x86_64-linux (full log)

Attempted: telnet

Partial log (click to expand)

these paths will be fetched (0.07 MiB download, 0.18 MiB unpacked):
  /nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2
copying path '/nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2' from 'https://cache.nixos.org'...
/nix/store/fhrlryhspp3f5rhkp1mi1m4yzx4czrr8-telnet-1.2

Mic92 · 2018-05-15T08:50:47Z

I was not able to login though. It kept closing my connection without logging useful information. I am also not sure how this is supposed to work. Because the user is running as telnetd it should not be possible to give me a shell for a different user.

teto · 2018-05-15T13:38:55Z

The push was just to sync my computers sry xD
The -F flag refers to some 3rd party software forauthentication so I prefered to use the forking mechanism. I can't login either and I see nothing in journalctl -b telnetd.

It appears I don't really need this immediately so I'll put it on hold.

matthewbauer · 2018-05-16T16:23:39Z

Is busybox the right place to get telnetd? Inetutils also has it.

teto · 2018-06-25T03:14:43Z

closing since it doesn't seem like a hard requirement for mininet (my initial motivation) and I can't make it work. thanks for the comments, hopefully someone will pick it up.

GrahamcOfBorg added 6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels May 8, 2018

jtojnar reviewed May 8, 2018

View reviewed changes

Mic92 reviewed May 8, 2018

View reviewed changes

jtojnar reviewed May 8, 2018

View reviewed changes

teto changed the title ~~telnetd: init module~~ [wip] telnetd: init module May 14, 2018

teto added 5 commits May 15, 2018 10:39

telnet: adding module

68be241

taking into account reviews

59c7029

ok

ff44083

still trying to bind...

5e7bcd4

mic92 patch

09a9710

teto force-pushed the telnet branch from 2c2f7e3 to 534159a Compare May 15, 2018 02:28

trying forking instead

534159a

teto closed this Jun 25, 2018

teto mentioned this pull request May 25, 2019

Telnet server module #61968

Open

teto deleted the telnet branch September 24, 2023 15:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[wip] telnetd: init module #40160

[wip] telnetd: init module #40160

teto commented May 8, 2018

GrahamcOfBorg commented May 8, 2018

GrahamcOfBorg commented May 8, 2018

jtojnar May 8, 2018

teto May 8, 2018

Mic92 May 8, 2018 •

edited

jtojnar May 8, 2018

teto May 8, 2018

Mic92 May 8, 2018

Mic92 May 8, 2018

teto May 8, 2018

teto May 8, 2018

Mic92 May 8, 2018

Mic92 May 8, 2018

teto May 8, 2018

Mic92 May 8, 2018

Mic92 May 8, 2018

teto commented May 8, 2018

jtojnar May 8, 2018

matthewbauer commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

teto commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

Mic92 commented May 14, 2018

GrahamcOfBorg commented May 15, 2018

GrahamcOfBorg commented May 15, 2018

Mic92 commented May 15, 2018 •

edited

teto commented May 15, 2018

matthewbauer commented May 16, 2018

teto commented Jun 25, 2018


		config = mkIf config.services.telnet.enable {

		networking.firewall.allowedUDPPorts = [ cfg.port ];

[wip] telnetd: init module #40160

[wip] telnetd: init module #40160

Conversation

teto commented May 8, 2018

Motivation for this change

Things done

GrahamcOfBorg commented May 8, 2018

GrahamcOfBorg commented May 8, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Mic92 May 8, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

teto commented May 8, 2018

Choose a reason for hiding this comment

matthewbauer commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

teto commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

GrahamcOfBorg commented May 9, 2018

Mic92 commented May 14, 2018

GrahamcOfBorg commented May 15, 2018

GrahamcOfBorg commented May 15, 2018

Mic92 commented May 15, 2018 • edited

teto commented May 15, 2018

matthewbauer commented May 16, 2018

teto commented Jun 25, 2018

Mic92 May 8, 2018 •

edited

Mic92 commented May 15, 2018 •

edited