0103-rsh-uninstalled – rsh Installed¶

Rule ID¶

• 0103-rsh-uninstalled

Category¶

• system

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• The rsh package contains the client commands for the rsh service.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• These legacy clients contain numerous security exposures and have been replaced by the more secure SSH package. Even if the service has been removed, it is best to ensure that the client is also removed to prevent users from inadvertently attempting to use these commands, thereby exposing their credentials. Note that removing the rsh package will remove the clients for rsh, rcp, and rlogin.

Risk Items¶

• Data leakage

Audit Method¶

• Run the following command to check whether the rsh package is installed:

# rpm -q rsh
package rsh is not installed

Remediation¶

• Run the following command to remove the rsh package:

# yum remove rsh

Impact¶

• Many insecure service clients are used as troubleshooting tools and in test environments. Uninstalling them may reduce testing and troubleshooting capabilities. If needed, it is recommended to remove the client after use to prevent accidental or intentional misuse.

Default Value¶

References¶

CIS Controls¶

• Version 7

2.6 Address Unapproved Software

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.