Uninstall the rsh Package
Ensures the rsh package (legacy rsh/rcp/rlogin clients) is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
On RPM-based systems the rsh package provides the legacy rsh, rcp and rlogin clients, which transmit credentials and session data in clear text. They have well-known security exposures and were replaced by SSH long ago. Even with no rsh server running, leaving the clients installed lets users inadvertently run rsh or rlogin and expose their credentials to a network eavesdropper or a spoofed server.
What Pavois checks
Pavois queries the RPM database directly with describe package('rsh') and asserts it should_not be_installed. This reflects the actual installed state, which a file-path scan could miss or misreport.
describe package('rsh') do
it { should_not be_installed }
endHow to verify it is applied
On AlmaLinux/Fedora, run rpm -q rsh. Expected output: package rsh is not installed. You can also confirm with command -v rsh rlogin rcp (no output).
Inspect & investigate
Package transactions are recorded by DNF/RPM: review dnf history or /var/log/dnf.rpm.log (filter with grep rsh). Use rpm -q rsh to confirm the current state.
Remediation
Pavois's harden plan removes the rsh package (resource package, action remove). Apply it with pavois harden apply. This removes the rsh, rcp and rlogin client binaries.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | rsh |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low-risk removal on modern systems. Before applying, confirm no scripts or automation still invoke rsh, rcp or rlogin, and migrate them to ssh/scp. No service is affected and there is no lockout risk since these are client tools only.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| NIST | 3.1.13 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.