<Group id="obsolete">
<title>Obsolete Services</title>
<description>This section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Red Hat Enterprise Linux 6
by default.
<br /><br />
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host
firewall software such as <tt>iptables</tt> to restrict access to the
vulnerable service to only those remote hosts which have a known
need to use it.</description>

<Group id="inetd_and_xinetd">
<title>Xinetd</title>
<description>The <tt>xinetd</tt> service acts as a dedicated listener for some
network services (mostly, obsolete ones) and can be used to provide access
controls and perform some logging. It has been largely obsoleted by other
features, and it is not installed by default. The older Inetd service
is not even available as part of Red Hat Enterprise Linux 6.</description>

<Rule id="service_xinetd_disabled" severity="medium">
<title>Disable xinetd Service</title>
<description>
<service-disable-macro service="xinetd" />
</description>
<ocil>
If network services are using the xinetd service, this is not applicable.
<br /><br />
<service-disable-check-macro service="xinetd" /></ocil>
<rationale>
The xinetd service provides a dedicated listener service for some programs,
which is no longer necessary for commonly-used network services. Disabling
it ensures that these uncommon services are not running, and also prevents
attacks against xinetd itself.
</rationale>
<ident stig="GEN003700" />
<oval id="service_xinetd_disabled" />
<ref nist="ECSC-1" disa="305" />
</Rule>

</Group>
<Group id="telnet">
<title>Telnet</title>
<description>The telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol.</description>

<Rule id="service_telnetd_disabled" severity="high">
<title>Disable telnet Service</title>
<description>
<service-disable-macro service="telnet" />
</description>
<ocil><service-disable-check-macro service="telnet" /></ocil>
<rationale>
The telnet protocol uses unencrypted network communication, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network. The telnet protocol is also
subject to man-in-the-middle attacks.
</rationale>
<ident stig="GEN003850" />
<oval id="service_telnetd_disabled" />
<ref nist="DCPP-1" disa="197" />
</Rule>
</Group>

<Group id="r_services">
<title>Rlogin, Rsh, and Rexec</title>
<description>The Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model.</description>

<Rule id="package_rsh-server_removed" severity="medium">
<title>Uninstall rsh-server Package</title>
<description>The <tt>rsh-server</tt> package can be uninstalled with
the following command:
<pre># yum erase rsh-server</pre>
</description>
<ocil><package-check-macro package="rsh-server" /> </ocil>
<rationale>The <tt>rsh-server</tt> package provides several obsolete and insecure
network services. Removing it
decreases the risk of those services' accidental (or intentional)
activation.
</rationale>
<ident stig="GEN003845" />
<oval id="package_rsh-server_removed" />
<ref nist="ECSC-1" disa="305" />
</Rule>

<Rule id="service_rexec_disabled" severity="high">
<title>Disable rexec Service</title>
<description>The <tt>rexec</tt> service, which is available with
the <tt>rsh-server</tt> package and runs as a service through xinetd,
should be disabled.
<service-disable-macro service="rexec" />
</description> 
<ocil><service-disable-check-macro service="rexec" /></ocil>
<rationale>The rexec service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.
</rationale>
<ident stig="GEN003840" />
<oval id="service_rexec_disabled" />
<ref nist="EBRP-1,ECSC-1" disa="1435" />
</Rule>

<Rule id="service_rsh_disabled" severity="high">
<title>Disable rsh Service</title>
<description>The <tt>rsh</tt> service, which is available with
the <tt>rsh-server</tt> package and runs as a service through xinetd,
should be disabled.
<service-disable-macro service="rsh" />
</description> 
<ocil><service-disable-check-macro service="rsh" /></ocil>
<rationale>The rsh service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.
</rationale>
<ident stig="GEN003820" />
<oval id="service_rsh_disabled" />
<ref nist="EBRU-1" disa="68" />
</Rule>

<Rule id="service_rlogin_disabled" severity="medium">
<title>Disable rlogin Service</title>
<description>The <tt>rlogin</tt> service, which is available with
the <tt>rsh-server</tt> package and runs as a service through xinetd,
should be disabled.
<service-disable-macro service="rlogin" />
</description> 
<ocil><service-disable-check-macro service="rlogin" /></ocil>
<rationale>The rlogin service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.
</rationale>
<ident stig="GEN003830" />
<oval id="service_rlogin_disabled" />
<ref nist="DCPP-1" disa="68" />
</Rule>

<Rule id="no_rsh_trust_files" severity="high">
<title>Remove Rsh Trust Files</title>
<description>The files <tt>/etc/hosts.equiv</tt> and <tt>~/.rhosts</tt> (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
<pre># rm /etc/hosts.equiv</pre>
<pre>$ rm ~/.rhosts</pre>
</description>
<ocil clause="these files exist">
The existence of the file <tt>/etc/hosts.equiv</tt> or a file named
<tt>.rhosts</tt> inside a user home directory indicates the presence
of an Rsh trust relationship.
</ocil>
<rationale>Trust files are convenient, but when
used in conjunction with the R-services, they can allow
unauthenticated access to a system.</rationale>
<ident stig="GEN002040" />
<ref nist="ECCD-1,ECCD-2" disa="366" />
<oval id="no_rsh_trust_files" />
</Rule>

<Rule id="rhosts_auth_pam_files" severity="medium">
<title>Remove rhosts_auth Entries</title>
<description>All pam files located within /etc/pam.d/ must not include rhosts_auth.
To remove these entries, run the following command:
<pre># sed -i '/.*rhosts_auth.*/d' /etc/pam.d/*</pre>
</description>
<ocil clause="these files exist">
The existence of an rhosts_auth entry enables the use of remote access to a 
particular account without authenticating.
</ocil>
<rationale>.rhosts files are used to specify a list of hosts permitted remote 
access to a particular account without authenticating. The use of such a mechanism 
defeats strong identification and authentication requirements.</rationale>
<ident stig="GEN002100" />
<ref nist="ECCD-1,ECCD-2" disa="366" />
<oval id="rhosts_auth_pam_files" />
</Rule>

</Group>
<Group id="nis">
<title>NIS</title>
<description>The Network Information Service (NIS), also known as 'Yellow
Pages' (YP), and its successor NIS+ have been made obsolete by
Kerberos, LDAP, and other modern centralized authentication
services. NIS should not be used because it suffers from security
problems inherent in its design, such as inadequate protection of
important authentication information.</description>

<Rule id="service_ypbind_disabled" severity="medium">
<title>Disable ypbind Service</title>
<description>The <tt>ypbind</tt> service, which allows the system to act as a client in
a NIS or NIS+ domain, should be disabled.
<service-disable-macro service="ypbind" />
</description>
<ocil><service-disable-check-macro service="ypbind" /></ocil>
<rationale>
Disabling the <tt>ypbind</tt> service ensures the system is not acting
as a client in a NIS or NIS+ domain.
</rationale>
<ident stig="GEN006400" />
<oval id="service_ypbind_disabled" />
<ref nist="ECSC-1" disa="1435" />
</Rule>
</Group>

<Group id="tftp">
<title>TFTP Server</title>
<description>
TFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found.</description>

<Rule id="service_tftp_disabled" severity="high">
<title>Disable tftp Service</title>
<description>The <tt>tftp</tt> service should be disabled.
<service-disable-macro service="tftp" />
</description>
<ocil><service-disable-check-macro service="tftp" /></ocil>
<rationale>
Disabling the <tt>tftp</tt> service ensures the system is not acting
as a TFTP server, which does not provide encryption or authentication.
</rationale>
<ident stig="GEN005140" />
<oval id="service_tftp_disabled" />
<ref nist="DCSW-1" disa="225" />
</Rule>

<Rule id="tftpd_uses_secure_mode" severity="high">
<title>Ensure <tt>tftp</tt> Daemon Uses Secure Mode</title>
<description>If running the <tt>tftp</tt> service is necessary, it should be configured
to change its root directory at startup. To do so, ensure
<tt>/etc/xinetd.d/tftp</tt> includes <tt>-s</tt> as a command line argument, as shown in
the following example (which is also the default):
<pre>server_args = -s /var/lib/tftpboot</pre>
</description>
<rationale>Using the <tt>-s</tt> option causes the TFTP service to only serve files from the
given directory. Serving files from an intentionally-specified directory
reduces the risk of sharing files which should remain private.
</rationale>
<ocil clause="this flag is missing">
If TFTP is not installed, this is not applicable.  To determine if TFTP is installed, 
run the following command:
<pre># rpm -qa | grep tftp</pre>
<br /><br />
Verify <tt>tftp</tt> is configured by with the <tt>-s</tt> option by running the
following command:
<pre>grep "server_args" /etc/xinetd.d/tftp</pre>
The output should indicate the <tt>server_args</tt> variable is configured with the <tt>-s</tt>
flag, matching the example below:
<pre> # grep "server_args" /etc/xinetd.d/tftp
server_args = -s /var/lib/tftpboot</pre>
</ocil>
<ident stig="GEN005080" />
<oval id="tftpd_uses_secure_mode" />
<ref nist="ECSC-1" disa="366" />
</Rule>

</Group>
</Group>
