Title

The telnet daemon must not be running. (Cat I impact)

Discussion

The telnet daemon provides a typically unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised.

Check Content

# chkconfig --list | grep telnet If an entry is returned and any run level is “on” telnet is running. If the telnet daemon is running, this is a finding.

Fix Text

Identify the telnet service running and disable it. Procedure # insserv –r telnetd If telnet is running as an xinetd service, edit the /etc/xinetd.d file and set “disable = yes” and then restart the xinetd service: # rcxinetd restart disable the telnet server: chkconfig telnet off verify the telnet daemon is no longer running: # ps -ef |grep telnet

Additional Identifiers

Rule ID: SV-45809r1_rule

Vulnerability ID: V-24386

Group Title: GEN003850

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.