Red Hat Knowledgebase

Potentially, any network service is insecure. This is why turning unused services off is so important. Exploits for services are revealed and patched routinely, making it very important to keep packages associated with any network service updated.

Some network protocols are inherently more insecure than others. These include any services which do the following things:

• Pass Usernames and Passwords Over a Network Unencrypted - Many older protocols, such as Telnet and FTP, do not encrypt the authentication session and should be avoided whenever possible.
  
• Pass Sensitive Data Over a Network Unencrypted - Many protocols pass data over the network unencrypted. These protocols include Telnet, FTP, HTTP, and SMTP. Many network file systems, such as NFS and SMB, also pass information over the network unencrypted. It is the user's responsibility when using these protocols to limit what type of data is transmitted.
  

  Also, remote memory dump services, like netdump , pass the contents of memory over the network unencrypted. Memory dumps can contain passwords or, even worse, database entries and other sensitive information.

  Other services like finger and rwhod reveal information about users of the system.

Examples of inherently insecure services includes the following:

• rlogin
• rsh
• telnet
• vsftpd

All remote login and shell programs (rlogin, rsh, and telnet ) should be avoided in favor of SSH. FTP is not as inherently dangerous to the security of the system as remote shells, but FTP servers must be carefully configured and monitored to avoid problems.

Services which should be carefully implemented and behind a firewall include:

• finger
• identd
• netdump
• netdump-server
• nfs
• portmap
• rwhod
• sendmail
• smb (Samba)
• yppasswdd
• ypserv
• ypxfrd