← All rules
SOCLE-CLD-PKG-084// Packagescriticalinventory state

Uninstall the rsh-server Package

Ensures the rsh-server package (insecure rshd/rlogind/rexecd services) is not installed.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 5 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

The rsh-server package provides the rshd, rlogind and rexecd services, which offer unencrypted remote access with very weak, trust-based authentication (.rhosts/hosts.equiv). Passwords and the entire session travel in clear text, so a network eavesdropper can capture credentials and hijack connections, if a privileged user logs in this way, root can be compromised. Removing the package eliminates these obsolete services and prevents their accidental or malicious activation.

What Pavois checks

Pavois queries the package database with describe package('rsh-server') and asserts it should_not be_installed. Checking the actual installed package is more reliable than scanning for config files, which may be absent even when the daemon is present.

describe package('rsh-server') do
  it { should_not be_installed }
end

How to verify it is applied

On Debian/Ubuntu: dpkg -s rsh-serverpackage 'rsh-server' is not installed. On AlmaLinux/Fedora: rpm -q rsh-serverpackage rsh-server is not installed. Confirm no listener with ss -ltnp | grep -E ':513|:514' (no output).

Inspect & investigate

Removal is recorded in /var/log/dpkg.log (Debian/Ubuntu) or dnf history / /var/log/dnf.rpm.log (RPM). Past rsh logins, if the service ran, would appear in /var/log/auth.log or journalctl. Confirm state with dpkg -l rsh-server / rpm -q rsh-server.

Remediation

Pavois's harden plan removes the rsh-server package (resource package, action remove). Apply it with pavois harden apply. This stops and uninstalls the rshd/rlogind/rexecd services.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actionremove
namersh-server
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Removing rsh-server stops any rsh/rlogin/rexec remote access. Before applying, ensure SSH is installed and working so you keep remote administration access, and confirm no legacy hosts depend on rsh trust relationships. Any inbound rsh sessions will be cut; migrate clients to SSH first to avoid disruption.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R62direct2.0high
CIS2.2.4directper OS, see the benchmark tablehigh
NISTCM-6(a), CM-7(a), CM-7(b), IA-5(1)(c)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium
PCI DSS2.2.4supporting4.0.1medium
DISA STIGUBTU-22-215030, UBTU-24-100040directper OS STIG releasehigh

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references