Project: Linux Howtos

Exorcise FTP, Telnet And Other Evil Daemons

By Henry Kingman <feedback@freeos.com>
Posted: ( 2001-07-12 02:14:17 EST by )
Telnet and ftp send passwords over the network in clear text that can be easily sniffed. You should replace them with more modern tools such as ssh and scp. SSLtelnet/SSLftp are also available but do not seem to be in such wide use.

Telnet and ftp send passwords over the network in clear text that can be easily sniffed. You should replace them with more modern tools such as ssh and scp. SSLtelnet/SSLftp are also available but do not seem to be in such wide use.

SSH is a better telnet than telnet -- it even handles remote X sessions transparently, letting you ssh into another machine and run X aps there with the display automagically exported to your local X server. Give it a try: log on to your ISP from an X term using ssh and type something like xeyes &.

SSH is even available for Windows and Mac clients (though you'd need a Windows or Mac X server in order to run X aps remotely). The SSH license is kind of weird, though, and if you are a commercial user you may want to have a look at BSD's OpenSSH or follow the development of LSH, the GPL'ed knock-off.

You can probably disable telnet and ftp services by editing your inetd.conf file. Before you do so, you may wish to warn your users about the coming move to ssh/scp by mentioning it in /etc/motd (message of the day). This file is the first thing the user sees when they log on. While you're at it, you could try posting something ominous there, such as "Unauthorized use of this computer is prohibited. Your actions are being logged."

Inetd is the super server that listens on a whole bunch of ports. When it hears something, it consults /etc/services and /etc/inetd and launches the appropriate service. If you comment out a service in inetd.conf, inetd will turn a deaf ear toward it.

Besides commenting out telnet and ftp you can probabably also do without:

discard
daytime
chargen
gopher
shell
login
exec
talk
tftp
finger
netstat
systat
Now you need to hang up inetd. It will then restart, read inetd.conf and begin its new and less permissive life:

killall -HUP inetd

Replacing Telnet- OpenSSH, a secure alternative

Other articles by Henry Kingman

Current Rating: [ 7.25 / 10 ] Number of Times Rated: [ 16 ]

Contents Articles   Howtos   Interviews   News   Opinions   Reviews Comparison Links   Articles   Howtos   Interviews   Opinions   Reviews   Websites News

Linux About Linux

Print It! Printer Friendly Version