4.5.3. Insecure Services
Potentially, any network service is insecure. This is why turning unused services off is so important. Exploits for services are revealed and patched routinely, making it very important to keep packages associated with any network service updated. Refer to Chapter 3, Security Updates for more information about this issue.
Some network protocols are inherently more insecure than others. These include any services which do the following things:
- Pass Usernames and Passwords Over a Network Unencrypted — Many older protocols, such as Telnet and FTP, do not encrypt the authentication session and should be avoided whenever possible.
- Pass Sensitive Data Over a Network Unencrypted — Many protocols pass data over the network unencrypted. These protocols include Telnet, FTP, HTTP, and SMTP. Many network file systems, such as NFS and SMB, also pass information over the network unencrypted. It is the user's responsibility when using these protocols to limit what type of data is transmitted.Also, remote memory dump services, like
netdump, pass the contents of memory over the network unencrypted. Memory dumps can contain passwords or, even worse, database entries and other sensitive information.Other services likefingerandrwhodreveal information about users of the system.
Examples of inherently insecure services includes the following:
rloginrshtelnetvsftpd
All remote login and shell programs (
rlogin, rsh, and telnet) should be avoided in favor of SSH. (refer to Section 4.7, “Security Enhanced Communication Tools” for more information about sshd.)
FTP is not as inherently dangerous to the security of the system as remote shells, but FTP servers must be carefully configured and monitored to avoid problems. Refer to Section 5.6, “Securing FTP” for more information on securing FTP servers.
Services that should be carefully implemented and behind a firewall include:
fingerauthd(this was calledidentdin previous RHEL releases)netdumpnetdump-servernfsrwhodsendmailsmb(Samba)yppasswddypservypxfrd
More information on securing network services is available in Chapter 5, Server Security.
The next section discusses tools available to set up a simple firewall.
