Services That Send Passwords in the Clear

Some services are wrong no matter what

These were written before anyone assumed the network was hostile, and they send your password across it as readable text. No setting fixes that, so the answer is to remove them.

  a telnet login, as anyone on the network sees it:

     t  o  d  o     M  y  P  a  s  s  w  0  r  d
     └──────────┘   └───────────────────────────┘
       username               password

Check whether they are installed

dpkg -l | grep telnet
dpkg -l | grep ftp

dpkg -l lists everything installed, and grep keeps only the lines containing that word.

Remove them

sudo apt purge -y PACKAGENAME

Use purge, not remove. remove takes out the program but leaves its settings behind, and a check looking for whether the service is present can still find it.

💡 A telnet client is not a telnet server. The client is harmless. The server is what accepts logins on this machine. They are separate packages, so read the name before you remove it: telnetd and inetutils-telnetd are servers.

Try it yourself

dpkg -l | grep telnet        # is a telnet server installed?
dpkg -l | grep ftp           # what about a file server?