How to keep unnecessary processes from starting

[Torbjørn Thorsen - Nextline]

Rashkae wrote:
> Derek Broughton wrote:
> 
>> As Brian says, one person's wheat is another's chaff, but as near as I can
>> tell, since you have pop3-login tasks under dovecot, you _are_ running a
>> mail server and so the only unnecessary tasks you have are at least 5 of
>> the 6 gettys - those are the consoles waiting for someone to login - and
>> possibly proftpd.  Since you're accessing the server from ssh, 1 console is
>> probably enough (actually, one console is almost _always_ enough, but they
>> take so few resources).  And since you're accessing the server from ssh,
>> you should have on-demand sftp, so if it's just you you don't really need
>> proftpd, and if it's others you might prefer them to use sftp anyway (more
>> secure).
> 
> 
> More encrypted does not necessarily mean more secure.  If you are
> providing files for download publicly, or even password protected where
> data privacy is not really a mandate, then an ftp server might well be
> more secure than giving all your leechers system accounts.  AFAIK, sftp
> only works if you give them shell access, which then needs to be managed
> accordingly.
> 

I'm not sure that is quite correct.
First, let's get it clear that "sftp" or "FTP over SSH" can mean quite a 
few things.
There is at least two separate things going on:
  * SSH file transfer protocol[1]
  * Secure Copy (scp)[2]

These are separate, but both use SSH as the underlying communication 
channel.
I think Secure Copy is implemented in the sshd executable itself on the 
server side, the client is available as "scp" on most systems.

On Ubuntu, using the openssh implementation, the "scp" uses Secure Copy, 
however, those Finnish guys[3] also distribute a "scp" executable that 
actually uses SSH file transfer protocol instead.

SSH file transfer protocol (sftp) is the bigger of the two, and a 
stronger analog to "Classical FTP".
It has a conversation with the server, enabling things directory 
listings, deleting and other filesystem-like actions.

When using a FTP-like client, say "sftp" or FileZilla, this is the 
protocol that is in use.
In the openssh implementation, "sftp" is implemented in a subsystem, 
with its own executable.
By taking a look at /etc/ssh/sshd_config, you can even find the line

Subsystem sftp /usr/lib/openssh/sftp-server

stating that sftp-server is the executable that implements the SFTP 
protocol.

So, there are two different things here, and having them supported in a 
"anonymous FTP"-like fashion is not straight forward.
You can quite easily restrict users to use only SFTP, but that renders 
Secure Copy unusable.

If you are to support both of these protocols, I think you need to use 
an alternative shell, like rssh[4].
This is packaged for Ubuntu on my 8.10 system, so utilizing that doesn't 
seem to bad to hard.

All in all, I recommend both the article and the comments in this[5] 
article from debian-administration.org.
Another thing to think about, as one commenter points out, is that SSH 
can do a lot of stuff by default, like making network tunnels and 
forwarding ports. With great power comes great responsibility, as they 
say ..

-- Torbjørn

[1]: http://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol
[2]: http://en.wikipedia.org/wiki/Secure_copy
[3]: http://www.ssh.com/
[4]: http://www.pizzashack.org/rssh/index.shtml
[5]: http://www.debian-administration.org/articles/94