Uninstall the ssl compliant telnet server
Ensures the SSL-capable telnet server package telnetd-ssl is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Even with optional SSL support, telnetd-ssl is a legacy telnet server: SSL is not enforced, the protocol falls back to cleartext, and it duplicates a remote-access role already served securely by SSH. Removing it eliminates an unnecessary, weakly-protected login service.
What Pavois checks
Pavois verifies that the telnetd-ssl package is absent from the package database. A present binary can be started to expose a (possibly cleartext-fallback) login port, so the package query is the authoritative signal regardless of inetd/systemd unit state.
describe package('telnetd-ssl') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s telnetd-ssl and expect package 'telnetd-ssl' is not installed. Optionally confirm nothing listens on port 23 with ss -lntp | grep ':23' (no output).
Inspect & investigate
Removal is recorded in grep telnetd-ssl /var/log/dpkg.log. Past telnet logins, if the service ran, appear in /var/log/auth.log.
Remediation
Pavois's harden plan declares the telnetd-ssl package resource with action remove, so pavois harden apply uninstalls it via apt.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | telnetd-ssl |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
An installed telnetd-ssl is a redundant, weakly-protected login service whose SSL is not guaranteed. Precaution before applying: confirm SSH works and that no client connects over telnet/port 23; otherwise removal could cut off a host administered through this service. Once SSH is verified, removal is safe.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.