BTELNET(1)

NAME
btelnet - Brimstone proxy telnet

SYNOPSIS
btelnet [ -sd ]

DESCRIPTION
btelnet is the program which is invoked by inetd on the firewall to handle requests coming in on the TELNET service. The user is forced to authenticate himself, and then is put into the btelnet command mode.

OPTIONS

-d  turn on debugging. Aside from logging DEBUG level syslogs, there is no guarantee that this will do anything interesting, especially for non-developers.

-s  enable standard input mode. Prevent the program from exiting when it discovers (via getpeername(2) ) that stdio is not connected to a network. Used exclusively for testing, especially with a debugger. Note that it will not take any other action, so it will continue to spit out telnet control sequences to standard out. Also note that when you eventually connect to a remote telnet server, it may not present you with a login problem until you finish telnet options processing, which is challenging for many to do manually via the keyboard.

COMMAND MODE
When in command mode (with the prompt proxy telnet> ) you can perform serveral commands, the most useful of which are open and fork since they are the only ones which actually effect anything. open <hostname> [-][port]
    Open a connection to hostname on port port (port 23 -- TELNET by default). Before making a connection BTELNET goes through Brimstone access control checks to ensure that the connections is administratively allowed.

    If the connection is made to port 23, then the connection has TELNET semantics (e.g. the stored telnet options, see below, are replayed so that TELNET option negotiation will occur. If there is a - before the port, then the sense of the TELNET semantics is reversed (e.g. if it is port 23, then TELNET semantics are NOT preserved, or if it is on some other port, then TELNET semantics ARE preserved. This is to allow telnet servers running on alternate ports (like Brimstone's own administration server running on port SUPDUP ) the same abilities as normal telnet. It also allows telnet client/servers which get confused by Brimstone's form of options negotiation to be placated (cisco's telnet client is an example of one which appears to be non-compliant and gets confused).
fork <command> [command args]
    fork is the general Brimstone escape command to allow users to do things which cannot easily be layered on top of TELNET or FTP . Currently, we use this to allow users to start X11 forwarders, and generic TCP/IP forwarders. Note for administrators: see TELNET_FORK_CMD and TELNET_*_FCMD below for information on how to administratively deny all access to these commands.

    fork x <DISPLAY> < + | MIT-MAGIC-COOKIE <cookie> > <hostgroup> ...
        Start the X11 forwarder, with output directed to display DISPLAY. If you are using xhost based security, use the + option (Mnemonic: xhost + ). If you are using xauth based security, use the MIT-MAGIC-COOKIE option. (Mnemonic: same as xauth list output). The <hostgroup> ... (of which at least one is required) restricts what hosts are allowed to contact the X forwarder for X relay service.

        A <hostgroup> can either be a simple hostname, or it can be a hostname/netmask pair (e.g. 128.59.0.0/255.255.0.0 would allow all of Columbia University access)

        This will return one line, which will give the display name of the X11 relay process running on the firewall.

        The user is responsible for handling all X11 security configuration which is NOT performed on the firewall (e.g if you are using host based security, you must `xhost +firewall.machine.name`, or if you are using xauth based security, you must add the COOKIE of the DISPLAY host on the client source host with the display DISPLAY replaced by the display which the fork x command gives you.)

        Note that aside from any COOKIE security (which is actually implemented without the X forwarder being aware of it) the X forwarder will, for every new X client attempting to gain access to the local DISPLAY, open a window on the local DISPLAY asking for confirmation that the connection is known and should be allowed through. It is EXTREMELY important that the user pay attention and only allow those connections he knows are valid.

    fork relay -p -- <half connection> <half connection>
        Do some bizarre stuff which ends up starting the X forwarder.

help
    Ask for brief help about known commands.

close
    Close the BTELNET session without making any connections to remote machines.

ENVIRONMENTAL VARIABLES
BTELNET understands the following environmental variables.

BS_CLIENT_CONF location of configuration file containing configuration variables as described below.

BS_ACL_CONF location of Brimstone Access Control List (local mode only) which contains the defintions and restrictions on users.

BS_RMNT_CONF location of the client/server configuration file (client/server mode only).

FILES
/etc/bs.client.conf client configuration file.

/etc/bs.acl.conf Brimstone Access Control List.

/etc/bs.rmnt.conf Client/Server configuration file

CONFIGURATION VARIABLES
BTELNET accepts many configuration values, all of which are specified the the client configuration file.
+--------------------------------------------------------------------+
| Variable              | Type    | Description                      |
|   Default             |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_PROMPT         | string  | Prompt printing in mail command  |
|   telnet>             |         | loop                             |
+-----------------------+---------+----------------------------------+
| TELNET_AUTHTIMEOUT    | number  | Number of seconds user is allowed|
|   90                  |         | to spend authenticating himself  |
+-----------------------+---------+----------------------------------+
| TELNET_USERNAME       | string  | Prompt asking for user's name    |
|   Username:           |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_INVALID        | string  | Error message: Error during user |
|   Invalid entry       |         | input                            |
+-----------------------+---------+----------------------------------+
| TELNET_RESPONSE       | string  | Prompt asking for user's password|
|   Response:           |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_CMDTIMEOUT     | number  | Number of seconds user can remain|
|   600                 |         | idle while in command mode       |
+-----------------------+---------+----------------------------------+
| TELNET_UNKCMD         | string  | Error message:  command unknown  |
|   Unknown command     |         |                                  |
|   (try "help")        |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_UNKFCMD        | string  | Error message: fork subcommand   |
|   Unknown fork command|         | unknown                          |
+-----------------------+---------+----------------------------------+
| TELNET_UNKNOWNPORT    | string  | Error message: service not in    |
|   Unknown/invalid port|         | /etc/services                    |
+-----------------------+---------+----------------------------------+
| TELNET_CONNTIMEOUT    | number  | Number of seconds will wait for  |
|   15                  |         | remote machine to response before|
|                       |         | failing/tring other IP addresses |
+-----------------------+---------+----------------------------------+
| TELNET_CONNCLOSE      | string  | Connection to proxy has closed.  |
|   Connection closed   |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_CONNFAIL       | string  | Error:  Connection to remote     |
|   Connection failed   |         | machine failed                   |
+-----------------------+---------+----------------------------------+
| TELNET_UNKHOST        | string  | Error:  Hostname not in DNS      |
|   Host unknown        |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_CONNPEER       | string  | Error: getpeername() failed      |
|   Connection failed   |         |                                  |
|   during getpeername()|         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_CONNECTED      | format  | Informational message telling    |
|   Connected to %s     |         | user what hostname and port      |
|   port %d             |         | number he was successfully       |
|                       |         | connected to.  Note printf-style |
|                       |         | arguments cannot be changed.     |
+-----------------------+---------+----------------------------------+
| TELNET_XERR           | string  | Generic usage error message      |
|   Syntax error        |         |                                  |
+-----------------------+---------+----------------------------------+
| TELENT_XAUTHERR       | string  | Problems running xauth           |
|   Xauth failed        |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_FORK_CMD       | string  | Set to "off" if you wish to      |
|   on                  |         | disable the "fork" command       |
+-----------------------+---------+----------------------------------+
| TELNET_FORK_CMD_MSG   | string  | Error: user tried to use         |
|   Fork command        |         | disabled command                 |
|   administratively    |         |                                  |
|   turned off          |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_X_FCMD         | string  | Set to "off" if you wish to      |
|   on                  |         | disable the "fork x" command     |
+-----------------------+---------+----------------------------------+
| TELNET_X_FCMD_MSG     | string  | Error: user tried to use         |
|   Fork x command      |         | disabled command                 |
|   administratively    |         |                                  |
|   turned off          |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_RELAY_FCMD     | string  | Set to "off" if you wish to      |
|   on                  |         | disable the "fork relay" command |
+-----------------------+---------+----------------------------------+
| TELNET_RELAY_FCMD_MSG | string  | Error: user tried to use         |
|   Fork relay command  |         | disabled command                 |
|   administratively    |         |                                  |
|   turned off          |         |                                  |
+-----------------------+---------+----------------------------------+
| TELNET_GREET          | stringn | Multi-line greeting message      |
|   NONE                |         | printed BEFORE user authenticates|
|                       |         | himself                          |
+-----------------------+---------+----------------------------------+
| TELNET_FAIL           | stringn | Multi-line greeting message      |
|   NONE                |         | printed if user did NOT          |
|                       |         | successfully authenticate        |
|                       |         | himself                          |
+-----------------------+---------+----------------------------------+
| TELNET_WELCOME        | stringn | Multi-line message printed       |
|                       |         | if user successfully             |
|                       |         | authenticates himself            |
+-----------------------+---------+----------------------------------+
| TELNET_HELP           | stringn | Multi-line message printed if    |
|                       |         | user requires help               |
+-----------------------+---------+----------------------------------+
| TELNET_CLOSE          | stringn | Multi-line message printed if    |
|                       |         | user calls close/quit/exit/etc   |
+-----------------------+---------+----------------------------------+

SEE ALSO
telnet(1), bs.client.conf(5), bs.acl.conf(5), bs.rmnt.conf(5), sos_config(5), RFC1123,

IMPLEMENTATION NOTES
The following is excerpted from btelnet.c
/**********************************************************************
 *
 *                   TELNET OPTION PROCESSING
 *
 *
 *  You are not expected to understand this and no-one should
 *  be forced to!
 *
 *
 * Our basic theory is that during initialization time, the telnet
 * client we are talking to is going to send us a bunch of options.
 * We, also, are going to request for remote side ECHO and NOSGA
 * (meaning we are doing echo, and we are in character-by-character
 * mode--this is so that we can handle passwords correctly)
 * We will save this flurry of options for future use, and turn
 * everything off except ECHO and NOSGA.
 *
 * Due to the duplex nature of telnet options processing, replies can
 * also be questions depending on what mode you are in, so we have to
 * be sure not to propagate option loops.
 *
 * If we are going to connect to a non-telnet protocol port
 * (e.g. finger), we must turn ECHO and SGA off since finger
 * cannot handle such telnet-specific options.  However, since we
 * will always get a reply to telnet requests, we cannot turn
 * options off at this point since the replies from the source
 * telnet would be forwarded to the dest service, which will get
 * *very* confused.
 *
 * So, what we will do is after we have logged in, we will turn ECHO
 * and NOSGA back off and let the command mode be done in local
 * echo/line-by-line mode so that non-telnet protocols will be happy
 * when you connect to them since it is already in the default mode;
 * telnet protocols will be handled as described later.  We are just
 * hoping (and trusting that people follow the RFC) that the telnet
 * client will send no more telnet options since they will only
 * confuse non-telnet clients.
 *
 * Now, for telnet aware clients (e.g. clients on port 23 or ones
 * where the user prepended the service name with a dash), we will
 * REPLAY the telnet options we recorded during initialization time.
 * The duplex nature of telnet will mean that even though the source
 * telnet did not send these option requests, the replies that it gets
 * will cause it to finish the negotiation.  This could potentially
 * cause a options loop if *both* the source and destination programs
 * don't follow the RFC, but anyone who does this should be shot
 * anyway. Non-RFC complient clients may also get confused.  All
 * telnets based on the reference (BSD) implementation are fine, but
 * some "dumb" DOS or other wierd implementations could have problems.
 * Be on the lookout.
 *
 * Lets talk about RFC1123:
 *
 *   3.5.  TELNET REQUIREMENTS SUMMARY
 *
 *                                                  |        | | | |S| |
 *                                                  |        | | | |H| |F
 *                                                  |        | | | |O|M|o
 *                                                  |        | |S| |U|U|o
 *                                                  |        | |H| |L|S|t
 *                                                  |        |M|O| |D|T|n
 *                                                  |        |U|U|M| | |o
 *                                                  |        |S|L|A|N|N|t
 *                                                  |        |T|D|Y|O|O|t
 * FEATURE                                          |SECTION | | | |T|T|e
 * -------------------------------------------------|--------|-|-|-|-|-|--
 *                                                  |        | | | | | |
 * Option Negotiation                               |3.2.1   |x| | | | |
 *   Avoid negotiation loops                        |3.2.1   |x| | | | | DO
 *   Refuse unsupported options                     |3.2.1   |x| | | | | DO
 *   Negotiation OK anytime on connection           |3.2.1   | |x| | | | <X1>
 *   Default to NVT                                 |3.2.1   |x| | | | | DO
 *   Send official name in Term-Type option         |3.2.8   |x| | | | | N/A
 *   Accept any name in Term-Type option            |3.2.8   |x| | | | | N/A
 *   Implement Binary, Suppress-GA options          |3.3.3   |x| | | | | <X2>
 *   Echo, Status, EOL, Ext-Opt-List options        |3.3.3   | |x| | | | <X3>
 *   Implement Window-Size option if appropriate    |3.3.3   | |x| | | | <X4>
 *   Server initiate mode negotiations              |3.3.4   | |x| | | | DO
 *   User can enable/disable init negotiations      |3.3.4   | |x| | | | DO
 *                                                  |        | | | | | |
 * Go-Aheads                                        |        | | | | | |
 *   Non-GA server negotiate SUPPRESS-GA option     |3.2.2   |x| | | | | DO
 *   User or Server accept SUPPRESS-GA option       |3.2.2   |x| | | | | DO
 *   User Telnet ignore GA's                        |3.2.2   | | |x| | | N/A
 *                                                  |        | | | | | |
 * Control Functions                                |        | | | | | |
 *   Support SE NOP DM IP AO AYT SB                 |3.2.3   |x| | | | | <X4>
 *   Support EOR EC EL Break                        |3.2.3   | | |x| | | <X4>
 *   Ignore unsupported control functions           |3.2.3   |x| | | | | DO
 *   User, Server discard urgent data up to DM      |3.2.4   |x| | | | | <X5>
 *   User Telnet send "Synch" after IP, AO, AYT     |3.2.4   | |x| | | | N/A
 *   Server Telnet reply Synch to IP                |3.2.4   | | |x| | | <X4>
 *   Server Telnet reply Synch to AO                |3.2.4   |x| | | | | <X4>
 *   User Telnet can flush output when send IP      |3.2.4   | |x| | | | N/A
 *                                                  |        | | | | | |
 * Encoding                                         |        | | | | | | N/A
 *                                                  |        | | | | | |
 * End-of-Line                                      |        | | | | | |
 *   EOL at Server same as local end-of-line        |3.3.1   |x| | | | | DO
 *   ASCII Server accept CR LF or CR NUL for EOL    |3.3.1   |x| | | | | DO
 *   User Telnet able to send CR LF, CR NUL, or LF  |3.3.1   |x| | | | | N/A
 *   Non-interactive uses CR LF for EOL             |3.3.1   |x| | | | | N/A
 *                                                  |        | | | | | |
 * User Telnet interface                            |        | | | | | | N/A
 *                                                  |        | | | | | |
 *
 *  <X1> - We allow negotiation until connection to remote service.  Whether
 *         negotiation is allowed then depends on whether the remote service
 *         allows it (e.g. telnet would, finger would not)
 *
 *  <X2> - We do not implement binary (does not matter since this is only
 *         name, password, and command mode).  Once connected to remote
 *         service, binary may be negotiated iff remote telnet allows it.
 *         SGA is negotiated on and off as needed.
 *
 *  <X3> - We negotiate echo on and off as needed.  Other options initally
 *         unnegotiated until connect.  After then as remote side supports
 *
 *  <X4> - We do not implement this--however, once connected to the remote
 *         service, any options which it supports will work.
 *
 *  <X5> - We do NOT implement urgent data since discarding data will cause
 *         encrypting telnet and other such utilities to loose very much.
 *
 *
 **********************************************************************/

BUGS
Remote does not have a n in it.