Looking for Telnet on RHEL 8? Try Netcat Instead for Connectivity Checking

The Telnet protocol has been used for decades to provide remote access to computers and servers over TCP/IP networks. Telnet enabled a bidirectional interactive text-based session between hosts – essentially a remote terminal prompt.

However, Telnet suffers from some major downsides due to its insecure design:

• All data transmits in clear unencrypted plaintext that can be easily intercepted
• No built-in ability to authenticate users – just sends credentials in the clear
• Multiple vulnerabilities discovered over the years

To resolve these deficiencies, the SSH (Secure Shell) protocol was developed in the mid-1990s as a secure encrypted replacement for Telnet. As SSH adoption grew, usage of Telnet dropped steadily.

Most modern operating systems, including RHEL 8, no longer include Telnet clients/servers by default. Some Linux distributions don‘t package Telnet at all anymore due to its problematic security reputation.

But network and system administrators still occasionally need to check TCP or UDP connectivity to remote ports and services. Thus the quest begins trying to find Telnet installed somewhere to facilitate basic connectivity checking.

Luckily an excellent alternative already exists – the venerable Netcat (nc) utility. Like Telnet, nc can interact with network ports bi-directionally and test connectivity. But nc also provides a wealth of advanced networking capabilities that have earned it a reputation as the "TCP/IP Swiss Army knife".

In this comprehensive guide, we will explore all facets of using Netcat on RHEL 8 and modem Linux systems for improved network visibility, troubleshooting, security assessments and more!

Connectivity Checking Use Cases

While maligned for remote access these days, Telnet gained popularity over the years for its ability to interact with open network ports and test basic TCP/IP connectivity.

Here are some examples use cases where simple port/service checking provides value even in the age of SSH:

Network Troubleshooting – Quickly verify connectivity loss during an outage to determine if servers/services are still reachable. If ping fails but TCP ports respond, may indicate intermediate routing or firewall issue.

Change Validation – When making routing, switching, firewall or other network infrastructure changes, test accessibility before and after to validate intended configuration is working.

New Server Validation – As new systems come online, check connectivity to key ports and services as a simple validation after OS builds complete.

Migration Testing – Similar to above, as servers get migrated to new hardware or cloud providers, simple port checks help to validate successful cutover.

Auditing/Compliance – External and internal vulnerability scanners often use TCP/UDP port probing to discover services – invaluable for audit preparation and remediation.

Clearly some good reasons still exist to test network connectivity at the port/service level even though Telnet itself carries unacceptable security tradeoffs. This is the gap where Netcat neatly fits in…

Netcat Overview

Originally written as an ancillary tool for the Nmap port scanning project, Netcat (or nc) has evolved into a ubiquitous network utility used by system administrators and security practitioners alike.

Some key traits in line with the classic UNIX philosophy of "do one thing and do it well":

• Forward and redirect TCP or UDP ports
• Open TCP/UDP connections and send arbitrary data
• Listen on arbitrary TCP and UDP ports for incoming data
• Scriptable and integratable via standard input/output channels

But make no mistake – Netcat‘s flexibility provides functionality far beyond just a simple connectivity checker:

• Strong encryption via SSL/TLS for securing communications
• Proxy support for tunneling traffic through intermediaries
• Port scanning similarities to Nmap to reveal open ports/services
• Act as a network daemon for creating messaging, chat and file transfer services
• Powerful redirection capabilities combined with its piping make for an invaluable network exploration tool

Netcat has endured the test of time – still widely used 30+ years since initial inception. It comes bundled with many operating systems (like RHEL 8) and third-party security distributions. Netcat operates on a wide array of platforms including Linux, Windows, macOS, Solaris and more.

With this context, now we can dive deeper into specifically using Netcat on modern RHEL 8 systems!

Installing Netcat in RHEL 8

Since Netcat ships standard with RHEL 8 software repositories, installation is a simple one liner:

$ sudo dnf install nc

Confirm the installation was successful and check Netcat‘s version:

$ nc -h
nc -h
Ncat 7.70 ( https://nmap.org/ncat )

This installs both traditional Netcat and an enhanced "Ncat" edition from the original Nmap project – either supports the connectivity checking we need.

Checking TCP Connectivity with Netcat

By default Netcat communicates over TCP similar to Telnet. So we can leverage nc to check open ports and services on remote systems – a vital network troubleshooting step.

The basic syntax resembles Telnet:

$ nc [options] <destination> <port>

For example, to check HTTP connectivity on our GeekFlare server:

$ nc marketingscoop.com 80

A working web server port responds right away:

$ nc marketingscoop.com 80
<!doctype html>
<html>
<head>
    ...

Whereas a closed port hangs and times out:

$ nc marketingscoop.com 22
Ncat: Connection timed out.

This mimics the hands-on interaction of Telnet, but over Netcat‘s encrypted session for secure testing.

The "-vz" options skips handshake attempts and reports open or closed more explicitly:

$ nc -vz marketingscoop.com 80
Connection to marketingscoop.com 80 port [tcp/http] succeeded!

$ nc -vz marketingscoop.com 22 
marketingscoop.com [2606:4700:20::ac43:987e]:22: No route to host

Whether troubleshooting or just validating connectivity during maintenance windows, Netcat provides an invaluable tool for fast TCP port checking.

Checking UDP Connectivity with Netcat

Netcat isn‘t limited to just TCP – we can also use it to check connectivity over UDP:

$ nc -u marketingscoop.com 123

But UDP communication presents a challenge – it is a stateless protocol with no inherent confirmation that packets were received on the remote end.

Unlike TCP‘s handshaking, UDP requires a bit of finesse. The most reliable method is to launch a local UDP listener on the target server:

$ nc -ul 123 

Then execute your client Netcat command to target that open listener port:

$ nc -u marketingscoop.com 123

Traffic will flow bi-directionally allowing straightforward UDP connectivity verification.

This little extra effort provides reliable UDP testing – invaluable for DNS, DHCP, syslog and other key networking services.

Advanced Netcat Features and Functions

We have focused primarily on simple TCP and UDP connectivity checking as a replacement for legacy Telnet usage.

But Netcat offers an expansive set of additional capabilities that showcase its power and flexibility:

Encrypted Communications – Leverage Transport Layer Security (TLS) and Secure Socket Layer (SSL) to wrap connections in strong encryption:

$ nc -ssl server.com 443

Proxy Support – Tunnel connections through intermediary proxies with authentication:

$ nc -x proxy-server.com:8080 -X CONNECT server.com:443

Port Scanning – Check ranges of ports easily:

$ nc -v -z -w1 server.com 1-1024 

Port Forwarding – Redirect incoming ports to other destinations:

$ nc -l 2000 | nc example.com 3000

This provides just a glimpse into Netcat‘s extensive functionality – it has far too many capabilities to cover completely here.

Suffice to say it is an invaluable tool for network reconnaissance, service debugging, transferring files, backdoor shells, crafting basic messaging apps…the list goes on!

Scripting with Netcat

One last powerful facet of Netcat we will touch on is its scripting capabilities.

As a command line utility, nc integrates seamlessly into BASH scripts allowing automation of many network functions.

Some ideas to explore:

• Centralize connectivity checks into monitoring scripts
• Create ChatOps notification bots
• Port scanning and enumeration during pentests
• Harvesting data from unsecured services
• Redirect ports for troubleshooting or honeypots

The simplicity but flexibility of Netcat functions allows implementing virtually any network communications via scripting.

Conclusion

While the insecure Telnet protocol has been justifiably deprecated on modern Linux distributions like RHEL 8, valid use cases still exist for low-level TCP/UDP connectivity checking.

Rather than struggle with enabling messy Telnet packages, the venerable Netcat utility provides an efficient and secure alternative. Offering strong encryption, extensive protocol support, advanced redirection features and scripting capabilities, Netcat is a Swiss Army knife for critical network diagnostics.

All RHEL 8 admins should install, understand and utilize Netcat for enhanced visibility and control into networking infrastructure. With built-in integration and simple yet powerful options, Netcat can improve troubleshooting, auditing and management of TCP/IP communications and services.

So don‘t ask where Telnet went in RHEL 8 – Netcat is already there providing connectivity checking and far beyond!