Uninstall the rsh-client Package
Ensures the rsh-client package (legacy rsh/rcp/rlogin clients) is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The rsh-client package ships the legacy rsh, rcp and rlogin clients, which transmit credentials and session data in clear text over the network. An attacker on the path can trivially sniff passwords or hijack the session. These tools have been superseded by SSH for decades. Even when no rsh server is present, leaving the clients installed invites users to type rsh host or rlogin host out of habit and leak their credentials to a rogue or spoofed server.
What Pavois checks
Pavois queries the package database directly with describe package('rsh-client') and asserts it should_not be_installed. This reflects what is actually present on the system, so it cannot be fooled by a stray binary or an alias the way a file-path check could.
describe package('rsh-client') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu, run dpkg -s rsh-client. Expected output: dpkg-query: package 'rsh-client' is not installed. You can also confirm the binaries are gone with command -v rsh rlogin rcp (no output).
Inspect & investigate
Package operations are logged in /var/log/dpkg.log (filter with grep rsh-client /var/log/dpkg.log) and in /var/log/apt/history.log. Use dpkg -l rsh-client to confirm the current state.
Remediation
Pavois's harden plan removes the rsh-client package (resource package, action remove). Apply it with pavois harden apply. This also removes the rsh, rcp and rlogin client binaries.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | rsh-client |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the clients is low-risk on modern systems. Before applying, confirm no automation or scripts still call rsh, rcp or rlogin to reach legacy hosts, migrate them to ssh/scp first. There is no service disruption and no risk of lockout since these are client tools only.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.2, 2.2.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.13 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.