8

I have a debian dedicated server. I'm trying to secure it and one way I thought would be good is to shut down services I dont need, like FTP for example.

I am suggesting to run something like this on deployment:

service ntp stop
update-rc.d -f ntp remove
service vsftpd stop
update-rc.d -f vsftpd remove
service xinetd stop
update-rc.d -f xinetd remove

I am new to this. Is it generally regarded as poor security to do this, and lock it down the services with iptables, or is removing the service completely advisable and ultimately more secure?

2
  • 7
    If you're truly not using it, removal is certainly superior. I'm a little dubious that your system doesn't need ntp or xinetd internally, though.
    – ceejayoz
    Mar 18, 2015 at 13:19
  • 1
    Removal is good but not sufficient - you should also block all ports you don't actually use. (And NTP is something you should be using!)
    – Jenny D
    Mar 18, 2015 at 13:50

1 Answer 1

16

In general it is not a bad idea. I would even consider it recommendable. Why use resources for services not needed, anyway? Only reason to have some of these services might be some kind of dependency issue.

I wouldn't use update-rd.d though but sudo apt-get remove application. That way you can have a picture of the dependencies and could stop the process if it'll also remove something that you actually need.

All the dependencies are not visible to the package system, though. You could for example have a content management system that uses ftp for file uploads instead of direct file writing. In these kind of situations you could only bind the software to localhost interface.

NTP on the other hand increases security and you should have it updating the server's clock. If you don't need to use NTP as a server, you could configure ntpd not to provide that service to others.

2
  • What enhances security and stability is not so much the NTP daemon in particular, but having a reasonably well synchronized system clock. Doesn't need to be an NTP daemon, in many cases a cronjob doing ntpdate every now and then is good enough, and actually easier than to lock down ntpd. Mar 18, 2015 at 15:01
  • 4
    Well, that's a passable solutions too, but ntpd does more than just synchronizes the clock with one server. It also keeps the clock in time in between the synchronizations. I'd prefer ntpd in this situation, when it has good preconfiguration (Debian) using a suitable pool of open time servers. Mar 18, 2015 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .