Uninstall talk-server Package
Ensures the talkd (talk-server) package is not installed, removing the legacy cleartext talk messaging daemon.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
talkd is the server for the legacy talk real-time messaging service. The talk software presents a security risk because it uses unencrypted protocols for communication, sending all traffic in cleartext over the network. Removing the talk-server package decreases the risk of the accidental (or intentional) activation of talk services and removes an obsolete listening daemon that has no place on a modern hardened host.
What Pavois checks
Pavois asserts absence of talkd via CINC/InSpec's package resource against the effective package database (dpkg). If the package is present, the talk daemon (typically launched via inetd on UDP/518) can be activated regardless of inetd config-file state, so the package check is the authoritative signal.
describe package('talkd') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s talkd; a compliant host returns package 'talkd' is not installed. Confirm nothing answers talk with ss -ulnp | grep ':518' (no output).
Inspect & investigate
- Removal events appear in
/var/log/dpkg.logand/var/log/apt/history.log. - After removal,
systemctl status talkd(or the inetd entry) reports not-found and UDP/518 is no longer bound (ss -ulnp).
Remediation
The harden plan declares a package resource for talkd with action remove; pavois harden apply uninstalls it via apt. The talk daemon can no longer be started.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | talkd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Impact is negligible: talk is an obsolete protocol with no legitimate modern use, so removing the server breaks nothing in practice. The only consideration is if some legacy interactive workflow still depends on talk, in that case migrate to an encrypted alternative (SSH/write over a trusted channel, modern chat) rather than keeping a cleartext daemon. No reboot or lockout risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.4 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.