Detections
Analytics

4.3.2.11 Ensure rwhod is not in use

Information

The rwhod daemon is the remote WHO service, which collects and broadcasts status information to peer servers on the same network.

Unless a system is specifically set up to provide WHO services, it is recommended that the rcmd_server fileset be removed to reduce the potential attack surface.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u bos.net.tcp.rcmd_server bos.net.tcp.server

- OR -

- IF - the bos.net.tcp.rcmd_server fileset is required as a dependency:

Run the following script to stop and disable rwhod

#!/usr/bin/ksh
DAEMONS="rwhod"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

Impact:

As well as providing the rwhod command (and other insecure daemons), the bos.net.tcp.rcmd_server fileset also provides two commands related to configuring authentication setting - standard or Kerberos . If your authentication policy specifies Kerberos as the preferred authentication mechanism - you should not remove this fileset, but disable the daemons instead.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215362r958478_rule, Vuln-ID|V-215362

Plugin: Unix

Control ID: cec6f828d903b46c9319a2df8613fe989b615a6cd438c2fa32990c759cd410d1