Uninstall talk Package
Ensures the talk client package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The talk client speaks an obsolete, unencrypted terminal-chat protocol. Anyone on the network path can read the exchanged text, and the client may be activated accidentally or by an attacker. Removing the package eliminates this exposure and reduces the attack surface.
What Pavois checks
Pavois verifies that the talk package is absent from the package database. This package check is authoritative: an installed talk binary is a usable attack surface regardless of any config file, so querying the package manager directly is the correct signal.
describe package('talk') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu run dpkg -s talk and expect package 'talk' is not installed; on RHEL-family run rpm -q talk and expect package talk is not installed.
Inspect & investigate
Removal is recorded in the package manager history: grep talk /var/log/dpkg.log (Debian/Ubuntu) or dnf history / rpm -q --last talk (RHEL family).
Remediation
Pavois's harden plan declares the talk package resource with action remove, so pavois harden apply uninstalls it via the system package manager (apt/dnf).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | talk |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Keeping talk installed leaves an obsolete cleartext chat tool that can leak data or be misused. Removal is low-risk on servers since talk is not an operational dependency. Precaution: if any user or script still relies on talk, migrate them to an encrypted alternative (e.g. an SSH session or a TLS chat) before removing the package.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.3, 2.2.4 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.