{
  "id": "CB-UBU-SVC-013",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-013",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-013.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-013.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-SVC-013",
    "title": "Remove clear-text network clients (NIS, rsh, talk, telnet, LDAP tools, FTP)",
    "finding": {
      "title": "Clients for clear-text or obsolete network protocols are installed",
      "description": "These clients send credentials in clear text or help an intruder move to other systems."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "packages",
      "clients",
      "telnet",
      "rsh",
      "ftp",
      "nis",
      "ldap"
    ],
    "description": "Client packages for protocols that are obsolete or that send credentials without encryption:\n\n- NIS client: `nis` (ypbind);\n- rsh, rlogin and rcp: `rsh-client`, `rsh-redone-client` (up to 24.04);\n- talk: `talk`, `inetutils-talk`;\n- telnet: `telnet`, `inetutils-telnet`;\n- LDAP command-line tools: `ldap-utils`;\n- FTP: `ftp`, `tnftp`, `inetutils-ftp`.\n\nThe control passes when none of them is installed.\n",
    "rationale": "Using these clients exposes passwords and data on the network. An intruder who lands on the\nsystem can also use them to reach or probe other hosts. SSH, SFTP and LDAP over TLS libraries\nreplace them.\n",
    "impact": "Removes the listed packages, and any package that depends on them. On a stock Ubuntu image this\nincludes the `ubuntu-standard` metapackage (and `ubuntu-server` on 20.04), which depends on\n`telnet` and `ftp`: the packages it pulled in stay installed, but packages added to it by later\nupdates are no longer installed automatically. Administrators who use\n`ldapsearch` or `telnet` for troubleshooting lose them; `nc` or `openssl s_client` cover most\nof these uses. Systems that really need one of them must exclude this control in their\ntailoring file.\n",
    "notes": "The NIS client also needs CB-UBU-SVC-003 (rpcbind); LDAP authentication through SSSD does not\nneed `ldap-utils`.\n",
    "audit": {
      "manual": "Run `dpkg-query -W -f='${Package} ${Status}\\n' nis rsh-client rsh-redone-client talk\ninetutils-talk telnet inetutils-telnet ldap-utils ftp tnftp inetutils-ftp`. No line may end\nwith `install ok installed`.\n",
      "logic": "all",
      "checks": [
        {
          "id": "nis",
          "engine": "package",
          "description": "NIS client.",
          "spec": {
            "name": "nis",
            "state": "absent"
          }
        },
        {
          "id": "rsh-client",
          "engine": "package",
          "description": "rsh client.",
          "spec": {
            "name": "rsh-client",
            "state": "absent"
          }
        },
        {
          "id": "rsh-redone-client",
          "engine": "package",
          "description": "rsh-redone client.",
          "spec": {
            "name": "rsh-redone-client",
            "state": "absent"
          }
        },
        {
          "id": "talk",
          "engine": "package",
          "description": "talk client.",
          "spec": {
            "name": "talk",
            "state": "absent"
          }
        },
        {
          "id": "inetutils-talk",
          "engine": "package",
          "description": "GNU inetutils talk client.",
          "spec": {
            "name": "inetutils-talk",
            "state": "absent"
          }
        },
        {
          "id": "telnet",
          "engine": "package",
          "description": "telnet client.",
          "spec": {
            "name": "telnet",
            "state": "absent"
          }
        },
        {
          "id": "inetutils-telnet",
          "engine": "package",
          "description": "GNU inetutils telnet client.",
          "spec": {
            "name": "inetutils-telnet",
            "state": "absent"
          }
        },
        {
          "id": "ldap-utils",
          "engine": "package",
          "description": "OpenLDAP command-line tools.",
          "spec": {
            "name": "ldap-utils",
            "state": "absent"
          }
        },
        {
          "id": "ftp",
          "engine": "package",
          "description": "ftp client.",
          "spec": {
            "name": "ftp",
            "state": "absent"
          }
        },
        {
          "id": "tnftp",
          "engine": "package",
          "description": "tnftp client.",
          "spec": {
            "name": "tnftp",
            "state": "absent"
          }
        },
        {
          "id": "inetutils-ftp",
          "engine": "package",
          "description": "GNU inetutils ftp client.",
          "spec": {
            "name": "inetutils-ftp",
            "state": "absent"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Run `apt purge nis rsh-client rsh-redone-client talk inetutils-talk telnet inetutils-telnet\nldap-utils ftp tnftp inetutils-ftp`, after checking the list of packages apt will remove.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Reinstall the needed package with `apt install <package>`.\n",
      "scripts": [
        {
          "id": "nis",
          "from_check": "nis"
        },
        {
          "id": "rsh-client",
          "from_check": "rsh-client"
        },
        {
          "id": "rsh-redone-client",
          "from_check": "rsh-redone-client"
        },
        {
          "id": "talk",
          "from_check": "talk"
        },
        {
          "id": "inetutils-talk",
          "from_check": "inetutils-talk"
        },
        {
          "id": "telnet",
          "from_check": "telnet"
        },
        {
          "id": "inetutils-telnet",
          "from_check": "inetutils-telnet"
        },
        {
          "id": "ldap-utils",
          "from_check": "ldap-utils"
        },
        {
          "id": "ftp",
          "from_check": "ftp"
        },
        {
          "id": "tnftp",
          "from_check": "tnftp"
        },
        {
          "id": "inetutils-ftp",
          "from_check": "inetutils-ftp"
        }
      ]
    },
    "references": [
      {
        "title": "apt-get(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/apt-get.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "inetutils-telnet(1), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/inetutils-telnet.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ldapsearch(1), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/ldapsearch.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R62",
        "relation": "partial",
        "note": "R62 lists rsh, talk, telnet and NIS components among the services to remove."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1040"
      },
      {
        "framework": "mitre-attack",
        "id": "T1021"
      },
      {
        "framework": "cwe",
        "id": "CWE-319"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Stock image fails (telnet, ftp); with nis, rsh-redone-client, ldap-utils and inetutils-ftp installed they fail too; fix purges them (ubuntu-standard and ubuntu-server metapackages go with them, nothing else to autoremove), audit passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Stock image fails (telnet, ftp, tnftp); with nis, rsh-redone-client, ldap-utils and inetutils-ftp installed they fail too; fix purges them (ubuntu-standard goes with them), audit passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Stock image fails (telnet, inetutils-telnet, ftp, tnftp); with nis, rsh-redone-client, ldap-utils and inetutils-ftp installed they fail too; fix purges them (ubuntu-standard goes with them, nothing else to autoremove), audit passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Stock image fails (telnet, inetutils-telnet, ftp, tnftp); with nis, ldap-utils and inetutils-ftp installed they fail too; fix purges them, audit passes after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}