New to -02: services off by default

[George Jones <gmj@pobox.com>]

2.5.3 Listening Services Should Be Off By Default

   Requirement. Services that cause the device to listen for traffic
      destined for itself SHOULD be off by default.  The user SHOULD
      have to take explicit actions to enable any such services.

   Justification. Open ports have the potential to expose
      vulnerabilities. The user, not the vendor, should decide which
      services are required and what risks to accept.  This will also
      prevent systems from being compromised through the misuse of
      services which the user was unaware were enabled.

   Examples. If the device supports SSH, HTTP, telnet and SNMP, in the
      default configuration they should all be disabled.

   Warnings. None.