Title

The rexec daemon must not be running. (Cat I impact)

Discussion

The rexecd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.

Check Content

Open a terminal session and use the following command to view the rexec status. defaults read /var/db/launchd.db/com.apple.launchd/overrides com.apple.rexecd If the command does not return a value of 1, this is a finding.

Fix Text

Open a terminal session and use the following command to set the rexec status. launchctl unload -w /System/Library/LaunchDaemons/exec.plist NOTE: This command is being run to adjust the overrides file; unloading errors are normal, repeat the check to verify.

Additional Identifiers

Rule ID: SV-38054r1_rule

Vulnerability ID: V-4688

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.