Uninstall talk-server Package
Ensures the talk-server (talkd) package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
talk-server exposes a network listener (talkd) for the obsolete, unencrypted talk protocol. A running server lets remote users initiate cleartext sessions and adds an unauthenticated network service. Removing the package eliminates the listener and reduces the attack surface.
What Pavois checks
Pavois verifies that the talk-server package is absent from the package database. The package check is authoritative: if the server binary is present it can be (re)started and expose a cleartext listener, so querying the package manager directly is the right signal.
describe package('talk-server') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q talk-server and expect package talk-server is not installed. Optionally confirm nothing listens with ss -lntup | grep talk.
Inspect & investigate
Removal is recorded by the package manager: dnf history or rpm -q --last talk-server. Past talkd activity (if it ran) appears in journalctl / /var/log/messages.
Remediation
Pavois's harden plan declares the talk-server package resource with action remove, so pavois harden apply uninstalls it via dnf.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | talk-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
An installed talk-server is a dormant cleartext network service that can be activated and abused. Removal is low-risk because the talk protocol has no modern operational use. Precaution: verify no legacy workflow depends on talkd before removing; provide an encrypted alternative if some user genuinely needs interactive messaging.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.