Apache: The Definitive Guide, 3rd Edition

Turn Off Unwanted Services

You should run no more Unix services than are essential. The Unix utility ps tells you what programs are running. You may have the utility sockstat, which looks at what services are using sockets and therefore vulnerable to attacks from outside via TCP/IP. It produces output like this:

USER       COMMAND        PID     FD PROTO    LOCAL ADDRESS      FOREIGN ADDRESS
root     mysqld     157    4 tcp4   127.0.0.1.3306 *.*
root     sshd1      135    3 tcp4   *.22           *.*
root     inetd      100    4 tcp4   *.21           *.*

indicating that MySQL, SSH, and inet are running.

The utility lsof is more cryptic but more widely supported — it shows open files and sockets and which processes opened them. lsof can be found at ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/.

It is a good idea to restrict services so that they listen only on the appropriate interface. For example, if you have a database manager running, you may want it to listen on localhost so only the CGI stuff can talk to it. If you have two networks (one Internet, one backend), then some stuff may only want to listen on one of the two.