Uninstall the telnet server
Ensures the telnetd (telnet server) package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
telnetd provides a cleartext remote login service: credentials and every keystroke travel unencrypted and without integrity protection, so a network observer can capture passwords and hijack sessions. Any remote shell need is met by SSH; removing the telnet server eliminates a high-risk attack vector.
What Pavois checks
Pavois verifies that the telnetd package is absent from the package database. A present server binary can be (re)started to expose a cleartext login port, so the package query is the authoritative signal, independent of any inetd/systemd unit state.
describe package('telnetd') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s telnetd and expect package 'telnetd' is not installed. Optionally confirm nothing listens on port 23 with ss -lntp | grep ':23' (no output).
Inspect & investigate
Removal is recorded in grep telnetd /var/log/dpkg.log. Past telnet logins, if the service ran, appear in /var/log/auth.log.
Remediation
Pavois's harden plan declares the telnetd package resource with action remove, so pavois harden apply uninstalls it via apt.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | telnetd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving telnetd installed risks credential theft and session hijacking over the network. Precaution before applying: confirm that SSH access is working and that no automation connects over telnet (port 23); otherwise you could lose remote access to a host that was administered through telnet. Once SSH is verified, removal is safe.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-215035, UBTU-24-100030 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.