Uninstall telnet-server Package
Ensures the telnet-server package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
telnet-server provides an unencrypted remote-access service offering no confidentiality or integrity for passwords or the session. If a privileged user logs in over it, their password can be captured on the wire. It is unneeded functionality that widens the attack surface; removing it prevents accidental or intentional activation of telnet.
What Pavois checks
Pavois verifies that the telnet-server package is absent from the package database. A present server binary can be (re)started to expose a cleartext login port, so the package query is the authoritative signal independent of any unit being enabled now.
describe package('telnetd') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family run rpm -q telnet-server and expect package telnet-server is not installed. Optionally confirm nothing listens on port 23 with ss -lntp | grep ':23' (no output).
Inspect & investigate
Removal is recorded by the package manager: dnf history / rpm -q --last telnet-server (RHEL) or grep telnet-server /var/log/dpkg.log (Debian/Ubuntu). Past telnet logins, if the service ran, appear in /var/log/secure or /var/log/auth.log.
Remediation
Pavois's harden plan declares the telnet-server package resource with action remove, so pavois harden apply uninstalls it via the system package manager (dnf/apt).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | telnetd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving telnet-server installed risks cleartext capture of privileged credentials and session hijacking. Precaution before applying: confirm SSH access works and that no device or automation reaches this host over telnet (port 23); otherwise removal could lock out a system administered through telnet. Once SSH is verified, removal is safe.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.4, 2.1.16, 2.1.15 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.