Uninstall the rsync Package
Ensures the rsync package (and its rsyncd daemon) is not installed when not required.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The rsync package can run an rsyncd daemon that, in its native protocol, exchanges data without encryption and historically without strong authentication, exposing transferred files and potentially the host to network attackers. On a hardened server where file synchronisation is not needed, removing rsync eliminates that attack surface and prevents the daemon from being accidentally enabled.
What Pavois checks
Pavois queries the package database with describe package('rsync') and asserts it should_not be_installed, reading the actual installed state rather than guessing from a binary path that could be a leftover or a symlink.
describe package('rsync') do
it { should_not be_installed }
endHow to verify it is applied
Debian/Ubuntu: dpkg -s rsync → package 'rsync' is not installed. RPM: rpm -q rsync → package rsync is not installed. Confirm no daemon listens with ss -ltnp | grep :873 (no output).
Inspect & investigate
Removal is logged in /var/log/dpkg.log (Debian/Ubuntu) or dnf history / /var/log/dnf.rpm.log (RPM). If rsyncd ran, its activity appears via journalctl -u rsync. Confirm state with dpkg -l rsync / rpm -q rsync.
Remediation
Pavois's harden plan removes the rsync package (resource package, action remove). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | rsync |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
rsync is widely used for backups and file transfers. Before removing it, confirm no backup jobs, deployment scripts or cron tasks invoke rsync, they will break otherwise. If you only need to disable the network service, masking rsync.service may be preferable to removing the binary; remove the package only when the tool itself is truly unused.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.13 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.