Telnet and ftp send passwords over the network in clear text that can be easily

sniffed. You should replace them with more modern tools such as ssh and scp.

SSLtelnet/SSLftp are also available but do not seem to be in such wide use.

SSH is a better telnet than telnet -- it even handles remote X sessions transparently,

letting you ssh into another machine and run X aps there with the display automagically

exported to your local X server. Give it a try: log on to your ISP from an X

term using ssh and type something like xeyes &.

SSH is even available for Windows and Mac clients (though you'd need a Windows

or Mac X server in order to run X aps remotely). The SSH license is kind of

weird, though, and if you are a commercial user you may want to have a look

at BSD's OpenSSH or follow the development of LSH, the GPL'ed knock-off.

You can probably disable telnet and ftp services by editing your inetd.conf

file. Before you do so, you may wish to warn your users about the coming move

to ssh/scp by mentioning it in /etc/motd (message of the day). This file is

the first thing the user sees when they log on. While you're at it, you could

try posting something ominous there, such as "Unauthorized use of this

computer is prohibited. Your actions are being logged."

Inetd is the super server that listens on a whole bunch of ports. When it hears

something, it consults /etc/services and /etc/inetd and launches the appropriate

service. If you comment out a service in inetd.conf, inetd will turn a deaf

ear toward it.

Besides commenting out telnet and ftp you can probabably also do without:

discard

daytime

chargen

gopher

shell

login

exec

talk

tftp

finger

netstat

systat

Now you need to hang up inetd. It will then restart, read inetd.conf and begin its new and less permissive life:

killall -HUP inetd