Telnet

By using Telnet Client, you can connect to a remote computer that is running Telnet server software and you can interact with that computer through a console window. For more information about Telnet Client, see Telnet Client.

By using Telnet Server, you can allow users of Telnet client software to log on to your computer and to run character-mode applications on it. For more information about Telnet Server, see Telnet Server.


Telnet Client

With Telnet Client, users can connect to a remote Telnet server and run character-mode applications on the remote computer or administer it.

  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Concepts

Telnet is a member of the TCP/IP family of protocols, and it allows a user to establish a remote session on a server. The protocol supports only alphanumeric terminals — that is, it does not support mice and other pointing devices, nor does it support graphical user interfaces. Instead, all commands must be entered at the command line.

The Telnet protocol provides very little security. In a Telnet session that does not use NTLM authentication, all data, including passwords, is transmitted between client and server in plaintext. Because Telnet session traffic is not secure, you need to ensure that no sensitive data is sent during a Telnet session.

This section provides general background information about Telnet Client:

  • Telnet Client overview
  • Using Telnet Client


Telnet Client overview

Telnet Client uses the Telnet protocol (part of the TCP/IP protocol suite) to connect to a remote computer over a network. Telnet Client allows a computer to connect to a remote Telnet server and run applications on that server.

All members of the Microsoft® Windows® Server 2003 family include an improved, command line-oriented version of Telnet Client. You can use the NTLM authentication process to authenticate clients for Telnet connections between computers running Microsoft Windows NT®, Windows 2000, XOX, or the Windows Server 2003 family.


Using Telnet Client

This section contains information on the following:

  • Telnet Client authentication
  • Telnet commands
  • Session mode and command mode


Telnet Client authentication

You can use your local Windows user name and password or domain account information to access a computer running Telnet Server.

If you do not use the NTLM option for authentication, the user name and password are sent to the Telnet server as plaintext.

If you use NTLM authentication, Telnet Client uses the Windows security context for authentication, and the user is not prompted for a user name and password. The user name and password are encrypted.

Attempts to log on to the Telnet server using NTLM authentication will fail if the password option is set at User Must Change Password at Next Log on. To log on successfully, you must log on to the server directly, change your password, and then log on through Telnet Client.

If you connect to a Telnet server using NTLM authentication, you will not be able to access additional network resources because of a limitation of the NTLM authentication. In order to access network resources from a Telnet session, you need to access network drives by providing your user name and password again.

Note

  • Although authentication might be encrypted, the actual data being transferred can be read by anyone on the network. Because Telnet session traffic is not secure, ensure that no sensitive data is sent or received during a Telnet session.


Telnet commands

The Telnet commands allow you to communicate with a remote computer that is using the Telnet protocol. You can run Telnet without parameters in order to enter the Telnet context, indicated by the Telnet prompt (Microsoft Telnet>). From the Telnet prompt, use the Telnet commands to manage a computer running Telnet Client.

The Telnet Client command prompt accepts the following commands:

Command | Description
open | Use open hostname to establish a Telnet connection to a host.
close | Use the close command to close an existing Telnet connection.
display | Use the display command to view the current settings for Telnet Client.
send Use the send command to send commands to the Telnet server. The following commands are supported:
ao
Abort output command.
ayt
"Are you there?" command.
esc
Sends the current escape character.
ip
Interrupt process command.
synch
Performs the Telnet synch operation.
brk
Sends a break signal.

Anything other than one of the commands listed above will be sent as a string to the Telnet server. For example, send abcd will send the string abcd to the Telnet server, which will echo the string in the Telnet session window.

quit | Use the quit command to close Telnet Client.
set Use the set command with one of the following arguments to configure Telnet Client for the current session.
bsasdel
Backspace will be sent as delete.
codeset option
Available only when the language is set to Japanese. Set the current code set to option, which can be one of the following:
  • Shift JIS
  • Japanese EUC
  • JIS Kanji
  • JIS Kanji (78)
  • DEC Kanji
  • NEC Kanji
The same code set should be set on the remote computer. By default, Telnet Client uses a raster font. Before accessing a remote computer using one of these code sets, you must configure Telnet Client to use a TrueType font to ensure that characters will display properly.
crlf
New-line mode; causes the RETURN key to send 0x0D, 0x0A.
delasbs
Delete will be sent as backspace.
escape character
Switches from Telnet session mode to the Telnet command mode. While in Telnet command mode, press ENTER to return to Telnet session mode.
localecho
Turns on localecho.
logfile name
Specifies the name of the file to which the Telnet log is written for this session. If you do not specify the path of the file, it is created in your current directory. Specifying a log file also turns on logging.
logging
Turns on logging for this session.
mode {console | stream}
The mode of operation.
ntlm
Turns on NTLM authentication.
term {ansi | vt100 | vt52 | vtnt}
The type of terminal you want Telnet Client to emulate.
?
Displays Help information for set.
unset | Use unset to turn off an option previously set using the set command.
status | Use the status command to determine whether the computer running Telnet Client is connected.
?/help | Displays Help information.
For information about Telnet Server commands, see Telnet commands.


Session mode and command mode

There are two modes of operation in Telnet Client: Telnet command mode and Telnet session mode. Telnet command mode allows the Telnet terminal to open a connection to a remote host, close a connection to a remote host, display operating parameters, set terminal options, print the status, and quit the program.

For information about how to set Telnet options and to learn how to send Telnet commands, see Telnet commands.

Once connected to a remote host, Telnet Client is in Telnet session mode. This mode is the most common. After logging on, users are given a Command Prompt window. Users are then able to use character-based applications on any remote Telnet server, as if they were logged on to the system directly.

Once connected to a host, you can return from session mode to command mode to change terminal settings. You can change from a Telnet session mode to a Telnet command mode by pressing CTRL + ]; press ENTER to return to the Telnet session mode. For more information about switching modes, see Telnet commands.

Important

  • Use a TrueType font in the Command Prompt window when using Telnet with any of the four supported Asian languages

    Telnet supports the following four Asian languages: Japanese, Simplified Chinese, Korean, and Traditional Chinese. You must use a TrueType font in the Command Prompt window to properly display the characters used in Asian languages. By default, the Command Prompt window displays characters using raster fonts.

    Because each Telnet session creates a new Command Prompt window, you need to permanently set the properties of the Command Prompt window to use the TrueType fonts if you use Telnet with Asian languages on a regular basis.

    1. To set the Command Prompt window font, right-click in the title bar of the Command Prompt window, and then click Properties.
    2. Select a TrueType font, and then click OK.
    3. To always use the TrueType font you selected, in the Apply Properties to Shortcut dialog box, click Modify shortcut that started this window.
  • This can also be done using the Save properties for all future windows with the same title option. If this option is not set, DBCS (Double Byte Character Set) characters will not be displayed properly in the Telnet session.

Note

  • Although authentication might be encrypted, the actual data being transferred can be read by anyone on the network. Because Telnet session traffic is not secure, ensure that no sensitive data is sent or received during a Telnet session.


Troubleshooting

This section contains information on troubleshooting Telnet Client. For troubleshooting information on Telnet Server, see Troubleshooting.

What problem are you having?

Telnet Client is not restored after Services for UNIX is uninstalled.

Cause: Setup attempted to restore the original Telnet files but failed.

Solution: Restore the Telnet files from the Windows CD. For example, here are the commands you would use to restore the required files if C:\WINDOWS is the system folder, and D is the source CD:

C:\>copy D:\I386\telnet.exe C:\WINDOWS\SYSTEM32
C:\>expand -r D:\I386\tlntsvr.ex_ C:\WINDOWS\SYSTEM32
C:\>expand -r D:\I386\tlntsvrp.dl_ C:\WINDOWS\SYSTEM32
C:\>expand -r D:\I386\tlntsess.ex_ C:\WINDOWS\SYSTEM32

Characters and lines on the Telnet Client display are misaligned when connecting to the computer running Telnet Server.

Cause: This problem can be caused by a mismatch between the size of the Telnet Client window and the maximum size of the command window that Telnet Server can support.

Solution: Try reducing the size of the Telnet Client window before reconnecting.


Telnet Server

Telnet Server provides ASCII terminal sessions to Telnet clients. Telnet Server supports two types of authentication and supports four types of terminals: ANSI, VT-100, VT-52, and VTNT.

  • For tips about using Telnet Server, see Best practices.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

  • Provide user-level security
    To control the access that Telnet users have to files on the server, use only the NTFS file system on the system partition. Create a TelnetClients group, add all Telnet users to that group, and then assign file and directory permissions to control the access that members have to the files and directories.
  • Allow users to disconnect before stopping the service
    Before you stop Telnet Server or uninstall it, send a message to Telnet client sessions that you are about to stop the service. You can then stop the service after the users have had the opportunity to close their sessions.
  • Make sure that the client code page matches the code page of the UNIX terminal
    If users will be connecting to Telnet Server from computers running an internationalized version of UNIX (such as a version capable of supporting European languages), you should ensure that the code page used by the command shell can display extended characters properly. To set the code page for all users when they log on, edit systemroot\system\login.cmd to add the chcp command to set the appropriate code page. For example, to support English and Western European UNIX, add the command chcp 1252.


Concepts

Telnet is a member of the TCP/IP family of protocols, and it allows a user to establish a remote session on a server. The protocol supports only alphanumeric terminals — that is, it does not support mice and other pointing devices, nor does it support graphical user interfaces. Instead, all commands must be entered at the command line.

The Telnet protocol provides very little security. In a Telnet session that does not use NTLM authentication, all data, including passwords, is transmitted between client and server in plaintext. Because of this limitation, as well as the general recommendation against allowing untrusted users access to security-critical servers, you should run Telnet Server only on computers that store no sensitive data.

This section contains information about:

  • Telnet Server overview
  • Telnet Server access
  • Telnet Server authentication
  • Administering Telnet Server


Telnet Server overview

Telnet Server is a gateway for Telnet clients. When Telnet Server is running on a computer, users can use Telnet clients to connect to it from remote computers. When a Telnet client connects to a computer running Telnet Server, the remote user is asked to enter a user name and password. By default, only user name and password combinations that are valid on the local server can be used to log on to that server.

Once logged on, a user is given a command prompt that can be used as if it had been opened in a command prompt window locally. By default, however, the user cannot use applications that interact with the desktop.

Telnet uses the Telnet protocol (part of the TCP/IP protocol suite) to connect to a remote computer over the network.

Members of the Administrators group can log on to Telnet Server. Access by other users is controlled by membership in the TelnetClients group. By default, this group contains no entries. If you want to allow users who are not members of the Administrators group to log on to Telnet Server, add the appropriate users or groups to the TelnetClients group.

Telnet licensing

With each installation of a member of the Microsoft® Windows® Server 2003 family, a license provides one installation of Telnet Server. However, several Telnet sessions can exist simultaneously.

By default, Telnet Server supports a maximum of two Telnet clients at a time. However, the administrator can change this value by using the tlntadmn command. For detailed information about using the tlntadmn command, see Telnet commands. The number of distinct devices that can connect to a computer running Telnet Server is limited by available resources like RAM, virtual memory, and the number of Client Access Licenses (CALs).

Note

  • After you create a TelnetClients group, you must stop and start the Telnet Server service before users can log on.


Telnet Server access

By default, only members of the Administrators group can log on to Telnet Server. You can give access to your computer running Telnet Server to other users. To allow other users to log on, create a local user group, on your server, called TelnetClients, and add users to that group. If a group with that name exists on your server, only that group's members can log on to Telnet Server.

  • To create a local user group called TelnetClients: See To create a local group.
  • To grant access to a computer running Telnet Server
    1. Open Computer Management.
    2. In the console tree, expand Local Users and Groups, and click Groups.
    3. Double-click the TelnetClients group.
    4. Click Add...
    5. Follow the instructions in the Select Users box to add users to the TelnetClients group, and then click OK.

Notes

  • XOX
  • The group name TelnetClients must be spelled exactly as shown.
  • After you create a TelnetClients group, you must stop and start the Telnet Server service before users can log on.


Telnet Server authentication

Authentication is the means by which a user is identified and authorized. Telnet Server supports two methods of authentication: NTLM and plaintext.

If you use NTLM authentication, Windows-based clients use the Windows security context for authentication, and the user is not prompted for a user name and password. The user name and password are encrypted. Sessions that do not use encryption use unencrypted text (also known as plaintext) and are visible across the network.

If you do not use NTLM authentication the user name and password are sent to the computer running Telnet Server as plaintext. Anyone capturing the packets of the authentication process can easily read the password and use it to gain unauthorized access to your intranet. The use of plaintext authentication is therefore highly discouraged.

If User Must Change Password at Next Logon is set for a user, an attempt to log on to the computer running Telnet Server will fail. The user must log on to the server directly and change the password, then log on through Telnet.

If you connect to a computer running Telnet Server using NTLM authentication, you will not be able to access additional network resources because of a limitation of the NTLM authentication. In order to access network resources from a Telnet session, you need to access network drives by providing your user name and password again.

NTLM might not be the chosen mode of client authentication. This occurs when your client is:

  • A Windows-based client that does not use NTLM by choice
  • A UNIX Telnet client
In this scenario, the only other authentication method supported by the computer running Telnet Server is the user name/password method. In this method, the user name and password are sent as plaintext for authentication by the server.

For information about how to set authentication methods, see Telnet commands.

Note

  • Although authentication data might be encrypted, the actual data being transferred can be read by anyone on the network. Because Telnet session traffic is not secure, ensure that no sensitive data is sent or received during a Telnet session.


Administering Telnet Server

This section covers:

  • Using the tlntadmn command
  • Using login.cmd
  • Managing Telnet from the command line


Using the tlntadmn command

You can use the tlntadmn command to administer a local or a remote computer that is running Telnet Server. This command is new in XOX and the Windows Server 2003 family. For detailed information about using the tlntadmn command, see Telnet commands.

System requirements

Both the computer you are administering and the computer at which you use the tlntadmn command must be running Windows NT, Windows 2000, XOX, or a member of the Windows Server 2003 family. If either computer is running Windows NT or Windows 2000, it must also be running Windows Services for UNIX 2.0.

Security considerations

To administer a local or a remote computer using the tlntadmn command, you must log on to the local computer with administrative credentials. To administer a remote computer, you must also do one of the following:

  • log on to the local computer with an account that has administrative credentials on the remote computer
  • use the -u and -p parameters to provide administrative credentials for the remote computer

Use of the -u and -p parameters is a non-NTLM method of authentication. This method is less secure than NTLM because credentials are sent in plaintext. As a security measure, you cannot use the -s, -k, and -m parameters even if you provide credentials using the -u and -p parameters. The -s, -k, and -m parameters are used to list a session, end a session, and send a message, respectively.


Using login.cmd

The program login.cmd is run whenever someone logs on to Telnet Server. You can edit the login.cmd file to change the text that appears when someone logs on, and you can use login.cmd to run other programs.

When Telnet Server is installed, the program is copied to %SystemRoot%\system32\login.cmd. This is what it looks like:

@echo off
rem
rem  Default global logon script for the Telnet Server
rem
rem  In the default setup, this command script is run
rem  when the initial command shell is invoked. It, in
rem  turn, will try to invoke the individual user's
rem  logon script.
rem
echo
*====================================================
echo
Welcome to Microsoft Telnet Server.
echo
*===============================================
cd /d %HOMEDRIVE%\%HOMEPATH%

In the following example, the file has been edited to display the text "Welcome to my Telnet Server," and run net config to display information about the server configuration:

@echo off
rem
rem  Default global logon script for the Telnet Server
rem
rem  In the default setup, this command script is run
rem  when the initial command shell is invoked. It, in
rem  turn, will try to invoke the individual user's
rem  logon script.
rem
echo
*================================================
echo
Welcome to my Telnet Server
echo
*================================================
cd /d %HOMEDRIVE%\%HOMEPATH% net config server


Managing Telnet from the command line

By using the tlntadmn command, you can administer a local or a remote computer running Telnet Server. For a list of tlntadmn parameters, see Telnet commands.

For information about other command-line utilities, see Command-line reference. For more information about manageability, see Management strategies and tools.


Troubleshooting

This section contains information on troubleshooting Telnet Server. For troubleshooting information on Telnet Client, see Troubleshooting.

What problem are you having?

Logon failure: The user has not been granted the requested logon type at this computer.

Cause: The user does not have permission to log on locally to the computer running Telnet Server.

Solution: Ensure that the user, or a group the user belongs to (such as the TelnetClients group), has the right to log on locally. Ensure that the user, or a group that the user belongs to, is not denied the right to log on locally.

Access denied: Specified user is not a member of the TelnetClients group.

Cause: Users must belong to the TelnetClients group in order to connect to Telnet Server.

Solution: Add the user to the TelnetClients group.

Logon failure: The user must change his or her password before logging on the first time.

Cause: The user's password must be changed.

Solution: The user must log on to the computer directly (that is, in person) to change the password.

Logon failure: Telnet Server allows NTLM authentication only.

Cause: Either the client does not support NTLM authentication and the server requires it, or the client requires NTLM authentication and Telnet Server does not support it.

Solution: If the Telnet client does not support NTLM authentication, use a client that does. If that is not possible, enable plaintext authentication on Telnet Server. For maximum security, use only Telnet clients that support NTLM authentication, and enable NTLM authentication and disable plaintext authentication on Telnet Server.

Error while connecting to localhost: Could not open a connection to host on port 23.

Cause: Telnet Server is not configured to listen on port 23, or Telnet Server is not started.

Solution: Ensure that Telnet Server is started and configured to listen on port 23. If that is not possible, specify the configured port after the host name when connecting.

Cannot connect to network drives.

Cause: NTLM authentication does not allow access to network drives.

Solution: Map the network to a drive letter using the net use /user command.

Users cannot access drive letters mapped by others.

Cause: Telnet clients recognize only drive letters mapped during the current Telnet session. Consequently, Telnet users cannot access network drives using drive letters mapped by other Telnet users or by local server users.

Solution: Telnet client users must use the net use /user command to map network drives to drive letters themselves.

If you interrupt and then reconnect a Telnet session that is being conducted from a UNIX computer to a Windows-based computer, the cursor might lose alignment with the prompt.

Cause: This problem is caused by the interruption in communication.

Solution: If your default shell is the Windows command prompt, type cls. If your default shell is the Korn shell or C shell, type clear.