Remove Rsh Trust Files
Ensures no .rhosts trust file exists under /root or /home, removing any host-based unauthenticated R-services access.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A ~/.rhosts file declares remote host/user pairs that may log in or run commands as the local user without a password, via the legacy R-services (rlogin, rsh, rcp). If .rhosts/pam_rhosts support is enabled, these files grant host-based, unauthenticated access that is trivially spoofable on the network, a classic remote-compromise vector. Even when R-services look disabled, leftover trust files are a latent backdoor, which is why this rule is rated high. No .rhosts file should exist under /root or /home.
What Pavois checks
Pavois runs a live find over /root and /home (single filesystem via -xdev) for any .rhosts file. Enumerating files actually on disk catches trust files in every home directory, including dormant ones an attacker may have planted, rather than trusting a static account list.
describe command('find /root /home -xdev -name .rhosts 2>/dev/null') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Search for any rhosts trust file:
find /root /home -xdev -name .rhosts 2>/dev/null, expected output is empty (no path printed).
Inspect & investigate
R-services access, if PAM rhosts is enabled, surfaces in the auth log:
grep -E 'rhosts|rlogin|rsh' /var/log/auth.log(Debian/Ubuntu) //var/log/secure(RHEL), showspam_rhostsdecisions.- File creation can be tracked via an auditd watch on home directories (
/var/log/audit/audit.log).
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: review each file found (find /root /home -xdev -name .rhosts), treat its presence as suspicious, then delete it with rm <path>. Also confirm the R-services packages (rsh-server, rsh-redone) are removed and pam_rhosts is not enabled.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find /home /root -maxdepth 2 -name .rhosts 2>/dev/null; ls -l /etc/hosts.equiv 2>/dev/null # rm -f each after review |
|---|---|
| reason | removing .rhosts/hosts.equiv kills rsh trust, review (rsh should not be used) |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: any .rhosts file can grant unauthenticated, spoofable network logins as its owner, a direct remote-compromise path.
Precautions before applying: legitimate modern systems do not use .rhosts; finding one warrants investigation as a possible intrusion artifact before deletion. Removing the file is non-disruptive (R-services are obsolete), but check that no antiquated batch job relies on rsh/rcp trust, and migrate it to SSH key-based authentication.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.2.10, 7.2.9 | direct | per OS, see the benchmark table | high |
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.