0099-rsync-uninstalled - rsync Installed or rsyncd Service Not Masked¶
Rule ID¶
- 0099-rsync-uninstalled
Category¶
- system
Level¶
- warn
Supported Versions¶
- Linux
Description¶
- Unless required, the rsync package should be removed to reduce the attack surface of the system.
The rsyncd service poses a security risk because it uses an unencrypted protocol for communication.
Note: If the rsync package is a required dependency but the rsyncd service is not required, the service should be masked.
Scan Frequency¶
- 0 */30 * * *
Rationale¶
- The syncd service can be used to synchronize files between systems over a network link.
Risk Items¶
-
Hacker Infiltration
-
Data Breach
-
Network Security
-
Cryptomining Risk
-
Bot Machine Risk
Audit Method¶
- Execute the following command to verify whether rsync is installed.
Remediation¶
- Run the command to remove rsync.
Impact¶
- None
Default Value¶
References¶
- None
CIS Controls¶
- Version 7
9.2 Ensure Only Approved Ports, Protocols, and Services Are Running
Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.