Remove telnet Clients
Ensures the telnet client package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The telnet client speaks an insecure, unencrypted protocol: credentials and session data sent to a remote host can be captured by anyone on the network path. Removing the client prevents users from establishing cleartext sessions and steers them to the encrypted SSH client instead.
What Pavois checks
Pavois verifies that the telnet package is absent from the package database. The presence of the client binary is the relevant exposure (users could open cleartext sessions to any host), so querying the package manager directly is the authoritative signal.
describe package('telnet') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu run dpkg -s telnet and expect package 'telnet' is not installed; on RHEL-family run rpm -q telnet and expect package telnet is not installed.
Inspect & investigate
Removal is recorded in grep telnet /var/log/dpkg.log (Debian/Ubuntu) or dnf history / rpm -q --last telnet (RHEL family).
Remediation
Pavois's harden plan declares the telnet package resource with action remove, so pavois harden apply uninstalls the client via the system package manager (apt/dnf).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | telnet |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the telnet client is generally safe: SSH replaces it for remote shells. Precaution: the telnet binary is sometimes used as a quick TCP port-probe (telnet host port); if scripts or admins rely on that, switch them to nc/ncat or ss/curl before removing the package.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.13 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.