← All rules
SOCLE-CLD-PKG-082// Packagescriticalinventory state

Uninstall the rsh-client Package

Ensures the rsh-client package (legacy rsh/rcp/rlogin clients) is not installed.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 4 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

The rsh-client package ships the legacy rsh, rcp and rlogin clients, which transmit credentials and session data in clear text over the network. An attacker on the path can trivially sniff passwords or hijack the session. These tools have been superseded by SSH for decades. Even when no rsh server is present, leaving the clients installed invites users to type rsh host or rlogin host out of habit and leak their credentials to a rogue or spoofed server.

What Pavois checks

Pavois queries the package database directly with describe package('rsh-client') and asserts it should_not be_installed. This reflects what is actually present on the system, so it cannot be fooled by a stray binary or an alias the way a file-path check could.

describe package('rsh-client') do
  it { should_not be_installed }
end

How to verify it is applied

On Debian/Ubuntu, run dpkg -s rsh-client. Expected output: dpkg-query: package 'rsh-client' is not installed. You can also confirm the binaries are gone with command -v rsh rlogin rcp (no output).

Inspect & investigate

Package operations are logged in /var/log/dpkg.log (filter with grep rsh-client /var/log/dpkg.log) and in /var/log/apt/history.log. Use dpkg -l rsh-client to confirm the current state.

Remediation

Pavois's harden plan removes the rsh-client package (resource package, action remove). Apply it with pavois harden apply. This also removes the rsh, rcp and rlogin client binaries.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actionremove
namersh-client
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Removing the clients is low-risk on modern systems. Before applying, confirm no automation or scripts still call rsh, rcp or rlogin to reach legacy hosts, migrate them to ssh/scp first. There is no service disruption and no risk of lockout since these are client tools only.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R62direct2.0high
CIS2.2.2, 2.2.4directper OS, see the benchmark tablehigh
NIST3.1.13supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium
PCI DSS2.2.4supporting4.0.1medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references