The second approach is to not have them on the firewall. A root exploit on the firewall system is a serious issue and avoiding any chance of it is frequently the best technique. Applications such as sendmail, pop, ftp, and Web servers have recurring problems that can compromise the integrity of the system. Most often, these services can be moved to other systems to avoid exposing the firewall, or they can be removed altogether. Network Access Network access is part and parcel with facilities support.
Network access includes items such as rpcd, tftpd and telnet.
Realistically speaking, there should be no reason to support any of these functions into the firewall system. User Access Ordinary users should not have access to the firewall system. Every additional ID on the system is one additional point of entry. In addition, the system should be configured so that root only has access directly to the console. This is a well-publicized security step that far too few sysadmins actually take.