[rhn-users] Root login with telnet

[Joe Ogulin]

Bill Watson wrote:
> I have heard often the trauma of sending passwords in clear text over the
> network. If one has port 23 isolated from the internet and in a typical
> office environment, is there still risk? There is zero chance that any
> employee is capable of such interception, and the network switches wouldn't
> allow said person the opportunity if they could. 
> 
> Please explain the actual risks so I am enlightened.
> 

Your biggest threat is actually an internal attack.  You never know where
someone goes to with their web browsers.  You never know who has a password
hacked.  All you need is either a malicious, soon-to-be-former employee, OR
a clueless user who keeps passwords on post-it notes tacked to their monitors,
or some equally clueless user who clicks on every link in an email sent to him
or her (or clicks on all those embedded advertisement links in pages), and you
have an instant way for your internal systems to be attacked.

Telnet also does not provide sufficient logging facilities for forensics of
break-ins.  With ssh, you will get the necessary forensics, especially if you
set the logging level high enough.

Joe

-- 
Joe Ogulin
Sr. Secure Systems Software Engineer
BAE Systems IT

Environmental statement:
This message is made of 100% recycled electrons.

Disclaimer:  This message is purely my fault.