Protecting Telnet

---

Applies to SSHepherd 2.0

Overview

Telnet is especially exposed to attack because, unlike SSH, it isn’t encrypted. With SSHepherd®, the Telnet port is closed to the network, and authorized users reach it through an encrypted SSHepherd® tunnel.

Before you start

• The SSHepherd® Agent is installed on the Telnet host.
• shepctl is installed on the user’s computer.
• The user and the Telnet host are in the same SSHepherd® group, or the user has a Generic tunnel definition for it.

Configure the Telnet host

1. Configure the Telnet server to listen only on localhost (127.0.0.1), port 23. How you do this depends on your Telnet server.
2. Allow port 23 on the agent:
   1. In the Administrator Console, click Agents and select the Telnet host.
   2. Click the Settings tab.
   3. Add 23 to Allowed Ports.
   4. Click Save.
   The agent applies the change within seconds.

Connect with shepctl

1. Sign in with shepctl and open the tunnel: shepctl --hostname <telnet host name> --relayport 23 tunnelshepctl prints the local port, for example tunnel open on localhost: 33349.
2. In a second terminal, connect Telnet to that port: telnet 127.0.0.1 33349

To use the same port every time, add --port, for example --port 2323.

To use the Control App instead, ask your administrator for a Generic tunnel definition with Remote Host 127.0.0.1 and Remote Port 23. See Tunnel Definitions.