I would just like to know what percent of you allow Telnet/SSH access to your servers. We never have a prob never will unless it is someone we have good business ties with but I have had a couple people looking for this over the weekend and just wanted to know how many of you guys have it..

A lot of hosts these days are offering SSH, but not Telnet access... maybe that should be an option in your poll?

yea, I offer SSH but not Telnet :)


Chris

I think many hosts offer SSH but not telnet...
Telnet is less secure, and SSH offers a lot of access with much added security.... correct me if I am wrong.

Originally posted by TheException
I think many hosts offer SSH but not telnet...
Telnet is less secure, and SSH offers a lot of access with much added security.... correct me if I am wrong.

Yes, however Telnet, SSH, FTP and possibly POP3 or IMAP could be using the same set of password. There is no point of disabling telnet if you don't disable FTP/POP3 or make FTP/POP3 use a different set of password than one used for SSH.

Originally posted by priyadi


Yes, however Telnet, SSH, FTP and possibly POP3 or IMAP could be using the same set of password. There is no point of disabling telnet if you don't disable FTP/POP3 or make FTP/POP3 use a different set of password than one used for SSH.

Exactly! I don't understand why so many people preach about disabling telnet when they don't even know why they should. They usually give the clear text authentication excuse, but they never talk about FTP or POP3. Also, it's not like anyone can just see what's being sent and received unless the server or a router along the route has been compromised.

It could just be a mind thing. Yes you could get the password from pop3/ssl but some folks might feel a little more secure knowing it was offered.


On another note one could disable ftp and force users to use scp (WinScp is a good windows client BTW) and use pop3 over ssl. Hmm, something tells me it will cause an uproar amongst customers just to lose that ease-of-use that they're used to. It's funny how it works out that way. ;)

I always get realy suspicious when someone asks for it without saying why they need it. Even if they finally convince me on why they need it, I'm suspicious if they didn't state why they needed it the first time they asked for it.

When/if it is finally granted, I always cut and paste:

"Please note that we aren't in the business of providing shell accounts. We provide web and email hosting. Any use of a shell account should be related to the publishing of your web site."

If they stay logged in with too much idle time, I'm thinking that they don't need it anymore, because they're not using it to publish their site. I might be considered strict though.

If I'm suspicious, I have been known to ask for copies of both sides of their credit card and their government issued ID, and still sometimes deny shell access. This is in our TOS of course, not that anyone reads those any more.

I provide SSH on request, it's not automaticly activated for my customers. For new customers I always ask why they need it, if they have been with us for some time, I will add it for them without asking questions.

SSH Only - We're a dedicated server and colo shop.