SV-220039r603265: The rsh daemon must not be running. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The rsh daemon must not be running.

Description

Discussion Text

The rshd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service. Satisfies: SRG-OS-000033, SRG-OS-000505, SRG-OS-000555

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000068V-4687SV-27435

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

# svcs network/shell
If the service is enabled, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.solaris11:def:250
# The rsh daemon must not be running.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# rshd is not online
# smf_object (smf_test)
test_1() {
  (svcs -H -o state 'svc://localhost/network/shell:default') | grep -qxF 'ONLINE'
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Disable the remote shell service and restart inetd.
Procedure:
# svcadm disable network/shell
# svcadm refresh inetd