Remove clear-text network clients (NIS, rsh, talk, telnet, LDAP tools, FTP)

Description

Client packages for protocols that are obsolete or that send credentials without encryption:

• NIS client: nis (ypbind);
• rsh, rlogin and rcp: rsh-client, rsh-redone-client (up to 24.04);
• talk: talk, inetutils-talk;
• telnet: telnet, inetutils-telnet;
• LDAP command-line tools: ldap-utils;
• FTP: ftp, tnftp, inetutils-ftp.

The control passes when none of them is installed.

The NIS client also needs CB-UBU-SVC-003 (rpcbind); LDAP authentication through SSSD does not need ldap-utils.

Rationale

Using these clients exposes passwords and data on the network. An intruder who lands on the system can also use them to reach or probe other hosts. SSH, SFTP and LDAP over TLS libraries replace them.

Impact

Removes the listed packages, and any package that depends on them. On a stock Ubuntu image this includes the ubuntu-standard metapackage (and ubuntu-server on 20.04), which depends on telnet and ftp: the packages it pulled in stay installed, but packages added to it by later updates are no longer installed automatically. Administrators who use ldapsearch or telnet for troubleshooting lose them; nc or openssl s_client cover most of these uses. Systems that really need one of them must exclude this control in their tailoring file.

Audit

Run dpkg-query -W -f='${Package} ${Status}\n' nis rsh-client rsh-redone-client talk inetutils-talk telnet inetutils-telnet ldap-utils ftp tnftp inetutils-ftp. No line may end with install ok installed.

Automated: every check must pass. Scanners report each check by its id.

nis

NIS client.

name: nis
state: absent

rsh-client

rsh client.

name: rsh-client
state: absent

rsh-redone-client

rsh-redone client.

name: rsh-redone-client
state: absent

talk

talk client.

name: talk
state: absent

inetutils-talk

GNU inetutils talk client.

name: inetutils-talk
state: absent

telnet

telnet client.

name: telnet
state: absent

inetutils-telnet

GNU inetutils telnet client.

name: inetutils-telnet
state: absent

ldap-utils

OpenLDAP command-line tools.

name: ldap-utils
state: absent

ftp

ftp client.

name: ftp
state: absent

tnftp

tnftp client.

name: tnftp
state: absent

inetutils-ftp

GNU inetutils ftp client.

name: inetutils-ftp
state: absent

Remediation

Run apt purge nis rsh-client rsh-redone-client talk inetutils-talk telnet inetutils-telnet ldap-utils ftp tnftp inetutils-ftp, after checking the list of packages apt will remove.

Rollback

Reinstall the needed package with apt install <package>.

nis

Generated from check nis: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rsh-client

Generated from check rsh-client: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rsh-redone-client

Generated from check rsh-redone-client: the engine writes the fix for every output, it sets the expected value and the check runs again after.

talk

Generated from check talk: the engine writes the fix for every output, it sets the expected value and the check runs again after.

inetutils-talk

Generated from check inetutils-talk: the engine writes the fix for every output, it sets the expected value and the check runs again after.

telnet

Generated from check telnet: the engine writes the fix for every output, it sets the expected value and the check runs again after.

inetutils-telnet

Generated from check inetutils-telnet: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ldap-utils

Generated from check ldap-utils: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ftp

Generated from check ftp: the engine writes the fix for every output, it sets the expected value and the check runs again after.

tnftp

Generated from check tnftp: the engine writes the fix for every output, it sets the expected value and the check runs again after.

inetutils-ftp

Generated from check inetutils-ftp: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• apt-get(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• inetutils-telnet(1), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ldapsearch(1), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle