2/21 My moronic boss asked me to write a batch file to auomate a telnet
session and one requirement is it should not ask user for the
password. How do I kindly tell him that he is an idiot?
\_ setup ssh with passwordless public key or host-based authentication,
symlink telnet to ssh and let him believe that the users are using
telnet ;p
\_ The batch file will be placed in hundreds of Windows 98
machine's at a client site; none of these machines have ssh.
How do I tell him off? I told him it can't be done and he
insisted that it can be done.
\_ Why are you still even working there? I can't imagine
working in a place with a boss that stupid and an OS
that crappy.
\_ This isn't 1998.
\_ Include ssh along with the batch file. --dim
\_ He's a moron, true, but you've done your duty by telling him so, now
it is your job to make it work. I suggest a telnetd that auto-auths
anyone with no password. Yes, this is frightfully stupid, etc, etc,
but unless you want to polish your resume, swallow the bile and just
do it. Now is not a good time to get fired. Make sure you have it
documented that this is insecure and you told them so but were told
to do it anyway. You're then free from serious fallout. C.Y.A.
\_ I agree with the SSH suggestion. However, if you still need to
use telnet, you can embed a known password into the batch script.
You need to telnet to the same account, though. Or maybe have
the user save the password somewhere, but not ask on every
use.
\_ Create a server on a random port that does what he wants and have
your script telnet to that port.
\_ write a telnet program that automates the password and ship
it with your batch file. And document it that it's insecure.
\_ Upgrade windows. Realize that even windows has better tools
than telnet for running remote batch jobs.
\_ Whatever you do ignore the idiots here who give the 1990's dotcom
answer of "oh just quit!". Find a way to do the project and do it.
Document the insecurity and the specs and forget about it. Your job
is more important than religion.
\_ maybe he's talking about telnet -F option with Kerberos V5
authentication being used.
\_ acct with no passwd? |
http://csua.com/feed/