Uninstall the inet-based telnet server
Removes the clear-text inetutils-telnetd telnet server so no unencrypted remote-login daemon listens on the host.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
inetutils-telnetd is a telnet server that accepts remote logins over clear-text, unencrypted sessions. All traffic, including usernames and passwords, is transmitted in plain text with no integrity protection, so anyone on the network path can capture credentials or inject data. A listening telnet daemon is one of the highest-risk legacy services on a host; SSH must be used instead, which is why removing it is high severity.
What Pavois checks
Pavois queries package('inetutils-telnetd') against the package database to report the effective install state. This is more reliable than checking whether a telnet socket is currently open: with inetd/socket activation the daemon may not be listening at scan time yet starts on the first connection, so the package's presence is the true exposure.
describe package('inetutils-telnetd') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s inetutils-telnetd. The rule passes when it reports package 'inetutils-telnetd' is not installed. You can also confirm nothing listens on telnet with ss -lntp | grep ':23' (expect no output).
Inspect & investigate
Confirm removal with dpkg -s inetutils-telnetd. Telnet login attempts (when present) appear in /var/log/auth.log and via journalctl; package removal is recorded in /var/log/dpkg.log.
Remediation
Pavois's harden plan removes the inetutils-telnetd package (resource package, action remove) when you run pavois harden apply. Removing the package stops and uninstalls the telnet server.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | inetutils-telnetd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Precaution before removing: ensure SSH access is working so you do not lose remote management, if telnet is currently the only way in, set up and test SSH first. Removing the telnet server has no downside on a properly managed host and closes a critical clear-text exposure; any legitimate telnet use should be migrated to SSH.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.