Uninstall the rsh-server Package
Ensures the rsh-server package (insecure rshd/rlogind/rexecd services) is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The rsh-server package provides the rshd, rlogind and rexecd services, which offer unencrypted remote access with very weak, trust-based authentication (.rhosts/hosts.equiv). Passwords and the entire session travel in clear text, so a network eavesdropper can capture credentials and hijack connections, if a privileged user logs in this way, root can be compromised. Removing the package eliminates these obsolete services and prevents their accidental or malicious activation.
What Pavois checks
Pavois queries the package database with describe package('rsh-server') and asserts it should_not be_installed. Checking the actual installed package is more reliable than scanning for config files, which may be absent even when the daemon is present.
describe package('rsh-server') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu: dpkg -s rsh-server → package 'rsh-server' is not installed. On AlmaLinux/Fedora: rpm -q rsh-server → package rsh-server is not installed. Confirm no listener with ss -ltnp | grep -E ':513|:514' (no output).
Inspect & investigate
Removal is recorded in /var/log/dpkg.log (Debian/Ubuntu) or dnf history / /var/log/dnf.rpm.log (RPM). Past rsh logins, if the service ran, would appear in /var/log/auth.log or journalctl. Confirm state with dpkg -l rsh-server / rpm -q rsh-server.
Remediation
Pavois's harden plan removes the rsh-server package (resource package, action remove). Apply it with pavois harden apply. This stops and uninstalls the rshd/rlogind/rexecd services.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | rsh-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing rsh-server stops any rsh/rlogin/rexec remote access. Before applying, ensure SSH is installed and working so you keep remote administration access, and confirm no legacy hosts depend on rsh trust relationships. Any inbound rsh sessions will be cut; migrate clients to SSH first to avoid disruption.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.4 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b), IA-5(1)(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-215030, UBTU-24-100040 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.