Remove telnet Clients
Removes the clear-text inetutils-telnet client so users cannot connect over the insecure telnet protocol.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
inetutils-telnet is the telnet client. The telnet protocol is insecure and unencrypted: using it as a transmission medium can let an unauthorized observer steal credentials and read or alter session data. Since ssh provides an encrypted, authenticated session and is shipped by default, the telnet client is unnecessary and removing it prevents users from inadvertently connecting over an insecure protocol.
What Pavois checks
Pavois queries package('inetutils-telnet') against the package database to report the effective install state, whether the telnet command is actually present and runnable, rather than guessing from shell history or aliases. The package manager is the authoritative source.
describe package('inetutils-telnet') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s inetutils-telnet. The rule passes when it reports package 'inetutils-telnet' is not installed.
Inspect & investigate
Confirm removal with dpkg -s inetutils-telnet. Being a client there is no service log; package removal is recorded in /var/log/dpkg.log.
Remediation
Pavois's harden plan removes the inetutils-telnet package (resource package, action remove) when you run pavois harden apply. Only the client binary is uninstalled.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | inetutils-telnet |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration impact: keeping the client lets users connect over clear-text telnet, risking credential theft. Precaution before removing: the telnet command is sometimes used as an ad-hoc TCP port-test tool (telnet host port); migrate such checks to nc/ncat or ssh first. Removal is low-risk and does not affect any server software.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.4 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.