Here is how I have made sure telnetd is not available:

Code:

ubuntu# find / -name telnetd
ubuntu#

That's very secure for telnetd ....

Here is how I secure fingerd:

Code:

ubuntu# find / -name fingerd
ubuntu#

That's very secure for fingerd ...

On production servers, I do not rely on configuration files for security when there are more secure ways to do things, especially when it comes to commands which can be used to exploit the system. It's easy to make a mistake in a config file, or even have some errand process overwrite one.

However, when the "not needs command" are off the server, it is really better.... if you really care about security.

For curl, for example (which I need from time to time), I have a wrapper:

Code:

ubuntu# cat /usr/bin/curl
#!/bin/sh
/usr/bin/php  /usr/bin/neo_curl.php  $@
#

Then, the PHP script above just logs as much details as it can (and does not call curl) ..... Because I have seen way too much malware attempting to use curl to download malicious code.

Of course, you don't need PHP do to this... but that is what I use to wrap, generally speaking, because I like logging the built in HTTPD globals vars.

When I need curl, I call it with a totally different name.

The more simple you secure you system (remove unneeded insecure commands, remove default names of exploitable commands, add more logging), the more secure your system will be.

At least, that is what I do..... and it works very well.