Armoring Linux

Чтобы проверить, какие скрипты остались, наберите: ps aux | wc -l

--- From the man pages --- 

If the -l option is specified, each ftp session is logged in the syslog 
If the -L flag is used, command logging will be on by default as soon as the ftp server is invoked.  This will cause  the  server  to log all USER 
commands, which if a user accidentally enters a password for that command instead of the username, will cause passwords to be logged via 
syslog. 
If the -i option is specified, files received by the ftpd(8) server will be logged to the xferlog(5). 
If the -o option is specified, files transmitted by the ftpd(8) server will be logged to the xferlog(5). 

--- snip snip --- 
Либо конфигурируем /etc/ftpaccess

       Ftpd authenticates users according to four rules. 

       4)     If  the  user name is ``anonymous'' or ``ftp'', an anonymous ftp account must be pre-sent in the password file (user ``ftp'').  In this case the user is allowed to log in by specifying any password (by convention this is given as the client host's name). 
Пример 3.
 

# 
# inetd.conf    This file describes the services that will be available 
#               through the INETD TCP/IP super server.  To re-configure 
#               the running INETD process, edit this file, then send the 
#               INETD process a SIGHUP signal. 
# 
# Version:      @(#)/etc/inetd.conf     3.10    05/27/93 
# 
# Authors:      Original taken from BSD UNIX 4.3/TAHOE. 
#               Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org> 
# 
# Modified for Debian Linux by Ian A. Murdock <imurdock@shell.portal.com> 
# 
# Modified for RHS Linux by Marc Ewing <marc@redhat.com> 
# 
# <service_name> <sock_type> <proto> <flags> <user> <server_path> <args> 
# 
# Echo, discard, daytime, and chargen are used primarily for testing. 
# 
# To re-read this file after changes, just do a 'killall -HUP inetd' 
# 
#echo   stream  tcp     nowait  root    internal 
#echo   dgram   udp     wait    root    internal 
#discard        stream  tcp     nowait  root    internal 
#discard        dgram   udp     wait    root    internal 
#daytime        stream  tcp     nowait  root    internal 
#daytime        dgram   udp     wait    root    internal 
#chargen        stream  tcp     nowait  root    internal 
#chargen        dgram   udp     wait    root    internal 
# 
# These are standard services. 
# 
ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -L -i -o 
telnet stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd 
#gopher stream  tcp     nowait  root    /usr/sbin/tcpd  gn 

# do not uncomment smtp unless you *really* know what you are doing. 
# smtp is handled by the sendmail daemon now, not smtpd.  It does NOT 
# run from here, it is started at boot time from /etc/rc.d/rc#.d. 
#smtp   stream  tcp     nowait  root    /usr/bin/smtpd  smtpd 
#nntp   stream  tcp     nowait  root    /usr/sbin/tcpd  in.nntpd 
# 
# Shell, login, exec and talk are BSD protocols. 
# 
#shell  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rshd 
#login  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rlogind 
#exec   stream  tcp     nowait  root    /usr/sbin/tcpd  in.rexecd 
#talk   dgram   udp     wait    root    /usr/sbin/tcpd  in.talkd 
#ntalk  dgram   udp     wait    root    /usr/sbin/tcpd  in.ntalkd 
#dtalk  stream  tcp     waut    nobody  /usr/sbin/tcpd  in.dtalkd 
# 
# Pop and imap mail services et al 
# 
#pop-2   stream  tcp     nowait  root    /usr/sbin/tcpd ipop2d 
#pop-3   stream  tcp     nowait  root    /usr/sbin/tcpd ipop3d 
#imap    stream  tcp     nowait  root    /usr/sbin/tcpd imapd 
# 
# The Internet UUCP service. 
# 
#uucp   stream  tcp     nowait  uucp    /usr/sbin/tcpd  /usr/lib/uucp/uucico    -l 
# 
# Tftp service is provided primarily for booting.  Most sites 
# run this only on machines acting as "boot servers." Do not uncomment 
# this unless you *need* it. 
# 
#tftp   dgram   udp     wait    root    /usr/sbin/tcpd  in.tftpd 
#bootps dgram   udp     wait    root    /usr/sbin/tcpd  bootpd 
# 
# Finger, systat and netstat give out user information which may be 
# valuable to potential "system crackers."  Many sites choose to disable 
# some or all of these services to improve security. 
# 
# cfinger is for GNU finger, which is currently not in use in RHS Linux 
# 
#finger stream  tcp     nowait  root    /usr/sbin/tcpd  in.fingerd 
#cfinger stream tcp     nowait  root    /usr/sbin/tcpd  in.cfingerd 
#systat stream  tcp     nowait  guest   /usr/sbin/tcpd  /bin/ps -auwwx 
#netstat        stream  tcp     nowait  guest   /usr/sbin/tcpd  /bin/netstat    -f inet 
# 
# Time service is used for clock syncronization. 
# 
#time   stream  tcp     nowait  nobody  /usr/sbin/tcpd  in.timed 
#time   dgram   udp     wait    nobody  /usr/sbin/tcpd  in.timed 
# 
# Authentication 
# 
#auth   stream  tcp     nowait    nobody    /usr/sbin/in.identd in.identd -l -e -o 
# 
# End of inetd.conf 
 

# 
# 
#  WARNING:  You must have specific authorization to access 
#            this machine.  Unauthorized users will be logged, 
#            monitored, and then shot on site! 
# 
# 

root:x:0:0:root:/root:/bin/bash 
bin:x:1:1:bin:/bin: 
daemon:x:2:2:daemon:/sbin: 
adm:x:3:4:adm:/var/adm: 
lp:x:4:7:lp:/var/spool/lpd: 
mail:x:8:12:mail:/var/spool/mail: 
uucp:x:10:14:uucp:/var/spool/uucp: 
nobody:x:99:99:Nobody:/: 
 

root 
bin 
daemon 
adm 
lp 
mail 
uucp 
nobody 

tty1 
tty2 
tty3 
tty4 
ttyp1 -- > Эта строка позволяет удаленному юзеру войти в систему под root ! Такой строки не должно быть в вашем файле. 
 

Service: Source (IP address, network, or name): <optional> : ALLOW or DENY 
Сервис: Источник (IP-адрес.сеть, доменное имя):необязательное поле: ALLOW or DENY 

Пример  /etc/hosts.allow 

in.telnetd: 192.168.1.0/255.255.255.0 : banners /etc/bannerfile : ALLOW 
in.ftpd: 192.168.1.30 :ALLOW 
imapd: ALL : spawn (/usr/local/bin/ids.sh %d %h %H %u) 

Пример  /etc/hosts.deny. Настоятельно рекомендуется виметь только такой hosts.deny файл! 

ALL: ALL DENY 

Прим. перевод.
Следите  за тем, чтобы hosts.allow и hosts.deny  обязательно заканчивались пустой строкой!