# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-SVC-013
title: Remove clear-text network clients (NIS, rsh, talk, telnet, LDAP tools, FTP)
finding:
  title: Clients for clear-text or obsolete network protocols are installed
  description: These clients send credentials in clear text or help an intruder move to other systems.
status: active
profiles: [core]
risk:
  severity: low
assessment: automated
tags: [packages, clients, telnet, rsh, ftp, nis, ldap]

description: |
  Client packages for protocols that are obsolete or that send credentials without encryption:

  - NIS client: `nis` (ypbind);
  - rsh, rlogin and rcp: `rsh-client`, `rsh-redone-client` (up to 24.04);
  - talk: `talk`, `inetutils-talk`;
  - telnet: `telnet`, `inetutils-telnet`;
  - LDAP command-line tools: `ldap-utils`;
  - FTP: `ftp`, `tnftp`, `inetutils-ftp`.

  The control passes when none of them is installed.
rationale: |
  Using these clients exposes passwords and data on the network. An intruder who lands on the
  system can also use them to reach or probe other hosts. SSH, SFTP and LDAP over TLS libraries
  replace them.
impact: |
  Removes the listed packages, and any package that depends on them. On a stock Ubuntu image this
  includes the `ubuntu-standard` metapackage (and `ubuntu-server` on 20.04), which depends on
  `telnet` and `ftp`: the packages it pulled in stay installed, but packages added to it by later
  updates are no longer installed automatically. Administrators who use
  `ldapsearch` or `telnet` for troubleshooting lose them; `nc` or `openssl s_client` cover most
  of these uses. Systems that really need one of them must exclude this control in their
  tailoring file.
notes: |
  The NIS client also needs CB-UBU-SVC-003 (rpcbind); LDAP authentication through SSSD does not
  need `ldap-utils`.

audit:
  manual: |
    Run `dpkg-query -W -f='${Package} ${Status}\n' nis rsh-client rsh-redone-client talk
    inetutils-talk telnet inetutils-telnet ldap-utils ftp tnftp inetutils-ftp`. No line may end
    with `install ok installed`.
  logic: all
  checks:
    - id: nis
      engine: package
      description: NIS client.
      spec: { name: nis, state: absent }
    - id: rsh-client
      engine: package
      description: rsh client.
      spec: { name: rsh-client, state: absent }
    - id: rsh-redone-client
      engine: package
      description: rsh-redone client.
      spec: { name: rsh-redone-client, state: absent }
    - id: talk
      engine: package
      description: talk client.
      spec: { name: talk, state: absent }
    - id: inetutils-talk
      engine: package
      description: GNU inetutils talk client.
      spec: { name: inetutils-talk, state: absent }
    - id: telnet
      engine: package
      description: telnet client.
      spec: { name: telnet, state: absent }
    - id: inetutils-telnet
      engine: package
      description: GNU inetutils telnet client.
      spec: { name: inetutils-telnet, state: absent }
    - id: ldap-utils
      engine: package
      description: OpenLDAP command-line tools.
      spec: { name: ldap-utils, state: absent }
    - id: ftp
      engine: package
      description: ftp client.
      spec: { name: ftp, state: absent }
    - id: tnftp
      engine: package
      description: tnftp client.
      spec: { name: tnftp, state: absent }
    - id: inetutils-ftp
      engine: package
      description: GNU inetutils ftp client.
      spec: { name: inetutils-ftp, state: absent }

remediation:
  manual: |
    Run `apt purge nis rsh-client rsh-redone-client talk inetutils-talk telnet inetutils-telnet
    ldap-utils ftp tnftp inetutils-ftp`, after checking the list of packages apt will remove.
  effects:
    restart: none
    disruption: low
    lockout_risk: false
  rollback: |
    Reinstall the needed package with `apt install <package>`.
  scripts:
    - id: nis
      from_check: nis
    - id: rsh-client
      from_check: rsh-client
    - id: rsh-redone-client
      from_check: rsh-redone-client
    - id: talk
      from_check: talk
    - id: inetutils-talk
      from_check: inetutils-talk
    - id: telnet
      from_check: telnet
    - id: inetutils-telnet
      from_check: inetutils-telnet
    - id: ldap-utils
      from_check: ldap-utils
    - id: ftp
      from_check: ftp
    - id: tnftp
      from_check: tnftp
    - id: inetutils-ftp
      from_check: inetutils-ftp

references:
  - title: apt-get(8), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man8/apt-get.8.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: inetutils-telnet(1), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man1/inetutils-telnet.1.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: ldapsearch(1), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man1/ldapsearch.1.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-19
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R62
    relation: partial
    note: R62 lists rsh, talk, telnet and NIS components among the services to remove.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: partial
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.2.1"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.2.2"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.2.3"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.2.4"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.2.5"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.2.6"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.2.1"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.2.2"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.2.3"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.2.4"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.2.5"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.2.6"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.2.1"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.2.2"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.2.3"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.2.4"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.2.5"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.2.6"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.2.1"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.2.2"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.2.3"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.2.4"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.2.5"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.2.6"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1040
  - framework: mitre-attack
    id: T1021
  - framework: cwe
    id: CWE-319

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic
    notes: "Stock image fails (telnet, ftp); with nis, rsh-redone-client, ldap-utils and inetutils-ftp installed they fail too; fix purges them (ubuntu-standard and ubuntu-server metapackages go with them, nothing else to autoremove), audit passes after reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic
    notes: "Stock image fails (telnet, ftp, tnftp); with nis, rsh-redone-client, ldap-utils and inetutils-ftp installed they fail too; fix purges them (ubuntu-standard goes with them), audit passes after reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic
    notes: "Stock image fails (telnet, inetutils-telnet, ftp, tnftp); with nis, rsh-redone-client, ldap-utils and inetutils-ftp installed they fail too; fix purges them (ubuntu-standard goes with them, nothing else to autoremove), audit passes after reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic
    notes: "Stock image fails (telnet, inetutils-telnet, ftp, tnftp); with nis, ldap-utils and inetutils-ftp installed they fail too; fix purges them, audit passes after reboot."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19