Remove telnet, rsh and talk servers and disable inetd super-servers

Description

The historical remote access servers are started by an inetd super-server, not by systemd units of their own:

• telnet servers: telnetd, inetutils-telnetd, telnetd-ssl;
• rsh, rlogin and rexec servers: rsh-server, rsh-redone-server (Debian 12 only);
• talk servers: talkd, inetutils-talkd.

The control requires these packages to be absent, and the super-servers that would launch them (xinetd.service, inetd.service from openbsd-inetd, inetutils-inetd.service) to be masked or not installed.

telnetd is a transitional package that pulls in inetutils-telnetd; both are checked. SSH access is not affected.

Rationale

telnet and rsh carry passwords and every keystroke in clear text, and rsh trusts the client's address and user name. SSH replaces all of them. A super-server accepts connections for every service listed in its configuration, which makes it easy to expose one by mistake.

Impact

Removes the listed server packages. Masking an inetd super-server stops every service it launches; check /etc/inetd.conf and /etc/xinetd.d/ before applying.

Audit

1. dpkg-query -W -f='${Status}\n' telnetd inetutils-telnetd telnetd-ssl rsh-server rsh-redone-server talkd inetutils-talkd must not show any install ok installed.
2. systemctl is-enabled xinetd.service inetd.service inetutils-inetd.service must print masked or fail because the unit does not exist.

Automated: every check must pass. Scanners report each check by its id.

telnetd

telnetd transitional package.

name: telnetd
state: absent

inetutils-telnetd

GNU inetutils telnet server.

name: inetutils-telnetd
state: absent

telnetd-ssl

telnet server with SSL.

name: telnetd-ssl
state: absent

rsh-server

rsh, rlogin and rexec servers.

name: rsh-server
state: absent

rsh-redone-server

rsh-redone rsh and rlogin servers.

name: rsh-redone-server
state: absent

talkd

talk server.

name: talkd
state: absent

inetutils-talkd

GNU inetutils talk server.

name: inetutils-talkd
state: absent

xinetd

xinetd super-server.

unit: xinetd.service
state: masked

openbsd-inetd

OpenBSD inetd super-server.

unit: inetd.service
state: masked

inetutils-inetd

GNU inetutils inetd super-server.

unit: inetutils-inetd.service
state: masked

Remediation

1. Run apt purge telnetd inetutils-telnetd telnetd-ssl rsh-server rsh-redone-server talkd inetutils-talkd.
2. Run systemctl mask --now <unit> for each installed super-server, or remove its package (apt purge xinetd openbsd-inetd inetutils-inetd) when nothing else depends on it.

Rollback

Reinstall the needed package with apt install, and systemctl unmask the super-server.

telnetd

Generated from check telnetd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

inetutils-telnetd

Generated from check inetutils-telnetd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

telnetd-ssl

Generated from check telnetd-ssl: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rsh-server

Generated from check rsh-server: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rsh-redone-server

Generated from check rsh-redone-server: the engine writes the fix for every output, it sets the expected value and the check runs again after.

talkd

Generated from check talkd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

inetutils-talkd

Generated from check inetutils-talkd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

xinetd

Generated from check xinetd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

openbsd-inetd

Generated from check openbsd-inetd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

inetutils-inetd

Generated from check inetutils-inetd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• telnetd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• inetd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• xinetd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle